“Assured Identity” hinges on “Shared
Secrets” in cyberspace. The text
password has been the shared secrets for many decades. Now its successor is wanted.
It is known that humans can firmly remember
and correctly recall only 5 text passwords on average, whilst the number of
services requiring password protection is now thought to be over 20 and ever
increasing for most of us, with urges to change them more frequently in the
aftermath of recurring password leakage incidents. The passwords to be registered have to
satisfy following requirements:
- The password should be strong enough.
- The same password should not be reused
across multiple accounts.
- The memo on which passwords are written
could be used indoor but should not be brought outdoor.
It is possible to satisfy one of them. But
it is not possible to satisfy all of them.
It is not what average humans can do. In response to this perplexing
situation, biometrics, multi-factor solutions and ID federations
(single-sign-on services & password management tools) are often advocated
as an alternative to the password.
If wisely operated all those solutions
could certainly help alleviate the pains of difficult-to-manage passwords,
either by the better convenience obtained by sacrificing the confidentiality
(biometrics & ID federations) or by the enhanced confidentiality obtained
by sacrificing the convenience (multi-factors).
But it would be inappropriate to call them an alternative to the
password when biometric solutions are usually operated together with a password
for self-rescue in case of false rejection, when one of the multi-factors is
usually a password and when the ID federation usually needs the password called
a master-password. When a horse is dependent
on a man, it is not possible for a horse to be an alternative to a man. The password cannot die until there is a true
alternative to it.
We can remember and recall only 5 text
passwords on average, not due to our silliness or laziness, but due to the
cognitive phenomenon called "Interference of Memory". Memories of numbers and alphabets, which
contain very limited information, are subject to the severe interference of
memory which causes terrible confusions in what we remember, whereas the
memories of images and pictures, particularly those of episodic/autobiographic
memories that contain a great deal of information with emotional feeling, are
not. This
indicates that we can easily manage passwords well beyond 5 or 10 when we make
good use of the episodic image memories.
It could thus make the optimal alternative to the textual passwords when
we make sure that confidentiality is not lost.
Our Expanded
Password System “Mnemonic Guard” with which we can make use of episodic image
memory in addition to textual memory can be viewed as an enhanced successor to
text-only password systems on its own.
Furthermore, the Expanded Password System will enable us to see truly
powerful multi-factor authentications with a strong unique password being used
as one of the factors for all different accounts, whether indoor or outdoor.
With the Expanded
Password System used as a rescue-password in case of false rejection, biometric
solutions will offer good convenience without sacrificing the
confidentiality. We would also be able
to see truly reliable decentralized ID federations with a strong unique
password being used as the master-password for each of single-sign-on services
and password management tools. The
outcome will be the most highly assured identity achieved through the most
reliable “shared secrets”
Given that all the
other technology resources are available to all the IPV (Identity Proofing
& Verification) service providers, it is the difference in the reliability
of the shared secrets that decisively differentiates the level of
assurance. We are of the view that those
who offer the Expanded Password System are more relevant to achieving the most
reliable Assured Identity than those who offer only the conventional textual
password systems.
Identity verification which has been
represented by seals and handwritten signatures is not just one of the many
factors for cyber security, but is the very foundation of the social
infrastructure without which no social life can exist. This relation between
the society and the identity verification will not change so long as humans
live social lives. Mnemonic Guard,
pioneer of the Expanded Password System., can well be a legitimate successor to
seals and handwritten signatures so long as humans need cyberspace.
Remark 1: “Assured Identity”, “shared secrets” and “IPV” are defined in “Good
Practice Guide No.45 Identity Proofing and Verification of an Individual”
issued by UK Cabinet Office.
Remark 2:
The idea of using pictures for passwords is not new. It has been around for more than two decades
but the simple forms of pictorial passwords were not as useful as had been
expected. For the UNKNOWN pictures that
we manage to remember afresh are still easy to forget or get confused, if not
as badly as random alphanumeric characters.
Mnemonic Guard is new in that we make good
use of KNOWN images that are associated with our episodic/autobiographic
memory. Since these pictures are the
least subject to the interference of memory, it enables us to manage dozens of
unique strong passwords without reusing the same password across many accounts
or carrying around a memo with passwords on it.
Furthermore, we no longer need to manage to remember the relations
betweens accounts and passwords because each account shows its own picture
matrix.
The merits of Expanded Password System are
closely discussed at
The outline of Mnemonic Guard is available
at
The operation of Mnemonic Guard on a smart
phone is posted at
No comments:
Post a Comment