- White
House cyber czar's goal: 'Kill the password dead'
“He cited
studies showing as much as 80 percent of cyber intrusions — "some
ridiculously high number," he said — are caused by exploiting weak or
stolen passwords.”
My
comment: It is just obvious that more
resources should be invested into the efforts of mitigating the issue of weak
and stolen passwords.
In view
of the facts that biometrics solutions depend on a password for self-rescue,
one of the 2-factor authentications is a password and a PIN is a weakest form
of password, to shout 'Kill the password dead' is one thing and to practice it
is another. When people become heavily
dependent
on ID federations like Identity Ecosystem, using stronger passwords, if in
fewer numbers, will be more crucial than ever in view of the single point of
failure that ID federations necessarily create.
Before
blaming the password, we should notice that the textual memory is only a small
part of what we remember. We should make the best use of the whole memory of
ours.
The same
can apply to
- Heartbleed
shows the need for password change automation
- Report:
Soon Hackers May Topple Global Economy
“Within the
next five to seven years, as much as $21 trillion in global economic-value
creation depends on robust cyber security. This estimate is part of a report
prepared by McKinsey & Company. To put that number in context, a report by
Bain & Company estimates that GDP will swell to $90 trillion by 2020”
My
comment: With the two names of Israeli
Homeland Security and McKinsey given, it is not easy to dismiss these figures
as paranoiac. Mitigating the password predicament should make a huge
contribution.
- Is
Facelock the password alternative we’ve been waiting for?
http://theconversation.com/is-facelock-the-password-alternative-weve-been-waiting-for-28152
“Someone seeking to authenticate
their identity is presented with a succession of pages, each containing nine
faces of which one is a person well known to the subject. To prove identity,
the face of the familiar person in each grid is clicked.” “But there are downsides”
My comment: There are certainly downsides in using human
faces as the password in the ways of Facelock or Passfaces. There are ways out.
1. It is
nice to use face photos, but it is not wise to use only face photos, which
would make the criminals’ jobs too easy.
Human faces are not the only images that humans do not forget. We could think of using any KNOWN images of
episodic/autobiographic memory which we can easily and distinctly recognize.
2. We do
not have to limit to one the number of pictures to be picked up per page. The more of the pictures we pick up, the
higher the mathematical strength will be.
Permutations will certainly offer higher security than combinations,
though the order of convenience is opposite.
3. We do
not have to limit the size of matrix to 9 or so. Our experience tells that it can be
practicably expanded to picking up 8 out of 64 pictures per page when the 8
pictures are of our episodic/autobiographic memory.
4. We do
not have to make it a rule to store both the pictures and the hashed
verification data on the same server.
Storing the encrypted pictures on the user’s personal devices and
storing the hashed verification data on the servers could be considered where
appropriate.
5. Using pictures as passwords was just
unthinkable three decades ago, it was possible but still difficult a decade
ago, but with digital cameras and related software pre-installed in
smart-phones and personal devices, it is now just simple and easy as shown in
the videos below.
Anyway,
the cost of deployment is a dependent variable of the benefits of
deployment. Should it be relatively
small as against the benefit, it could be promoted as in the cases of
automobile/train against walking, telegram/telephone/fax/email against human
messengers, all of which seemingly require a heavy cost of deployment, but it
actually is very light as against the huge benefit of depoloyment. What we need to look at is the scale of the
benefits of using known pictures as well as text, with which we will be able to
manage many more passwords easily by remembrance
- App
prototype may be the end of passwords
“The
development of the system (Facelock) is still in a prototype phase. The
developers expect the photo password security tool to be available as an app
within six months to a year.
My
comment: An expanded password system
with which we use KNOWN pictures as well as texts has been around as commercial
products for more than several years in Japan
- Facelock
Could Replace Alphanumeric Website Passwords
http://www.newsweek.com/2014/07/04/facelock-could-replace-alphanumeric-website-passwords-256101.html
“There’s
apparently only one similar face-based password system currently on the market.
The technology, created by Reston, Virginia–based Passfaces, assigns faces to
you (as opposed to you picking them).”
My
comment: The writer is apparently unaware
of why Passfaces did not succeed. It is
not because it used photos of faces but it forced users to remember UNKNOWN
faces afresh and operate it in an insecure way.
- Should
You Use a Password Manager?
“the most
important thing to keep in mind regarding password managers is the master
password that you use to secure this tool. Any password manager is only secure
as your master password,"
My
comment: This is a nicely well-balanced
article by quoting all of pros (who like the convenience), cons (who dislike
the single point of failure) and those in the middle.
- Consumer
Reports: Get Passwords Under Control
“One
solution is using a password manager.” “another
option is to create easy-to-remember, hard-to-crack passwords yourself.”
My
comment: We should not forget convenience
when thinking about security, and we should not forget security when thinking about convenience.
- Passwords
Still Pose Big Security Risks
“Many
“advanced data stealing attacks” happen simply from poor password practices.”
My
comment: When told to drive nails, we
would like to be given hammers.
The same
applies to
On Your
Side Alert: Make sure your email passwords are strong
- Take
control of your password frustrations
“We are in the midst of an era I
call the ‘tyranny of the password,’” “We’re due
for a revolution.”
My
comment: I would like to say ‘tyranny of
the text password’. The textual memory
is only a small part of our remembrance.
- 8 ways
the password is dying
“Every
single major platform Google promotes declared war on the password in some
fashion.”
My
comment: I do not find any single point
where I can agree because
1. Automatic
Authentication is a form of ID federation, with which all accounts hinge on a
single password. That password is ever
more important. How can the password be
viewed as dying?
2. When an Android phone sensed by Chromebooks via Bluetooth to automatically
unlock your notebook is protected by a password, the password is involved in
the protection of the whole configuration.
How can the password be viewed as dying?
3. Whether
voice or fingerprints, biometrics are operated with a password for self-rescue
in case of false rejection, especially in the outdoor environment. How can the password be viewed as dying?
4.
Electronic tattoos may be accepted for very low security application. But would you allow the withdrawal of all
your money simply because the electronic tattoo is there? If complemented by a password, the password
is not dying.
5. How
can they assure that the pills will never be taken by somebody else? If complemented by a password, the password
is not dying.
6. The
idea of moving beyond passwords holds vast appeal indeed. But dreaming of
something that can displace what we remember altogether may well be dreaming of
a new material that floats in the air and sinks in the water. What we should think of is moving beyond ‘text
passwords”.
- The way you type can be your new
password!
“IBM's system monitors behaviour only
after a person has logged in using their password. This can prevent a fraudster
making transactions, pretending to be an authenticated user who has, for
example, gone to make coffee without logging out. When behaviours are detected
that are out of character, the software will ask them to log in again with some
extra security questions”
My comment:
IBM is wise to use the biometric solution for complementing a password,
not as an alternative to the password.
The title of this article is simply a hype.
The same applies to the likes of heartbeat
monitoring.
*********************************************************************************************
*********************************************************************************************
About Me
About Expanded
Password System "Mnemonic Guard"
*********************************************************************************************
