- Here's what will replace the 'dying'
password
Biometrics are touted as a candidate for
displacing ‘dying’ and ‘silly’ passwords.
My comment:
Biometrics are dependent on a password for self-rescue, which is
indispensable in case of false rejection (unless the threshold is so set as to see
very high false acceptance). Passwords could be labeled as ‘dying’ or ‘silly’ only by those
people who have the means to eliminate the password altogether.
- Passwords no more? UAB researchers
develop mechanisms that enable users to log in securely without passwords
The article talks about “Zero-interaction
authentication” that reportedly enables a user to access a terminal, such as a
laptop or a car, without interacting with the device, by which access is
granted when the verifying system can detect the user’s security token.
My comment:
Those who were impressed by the zero-interaction authentication would
find the following cartoon very amusing.
This relay-attack-proof approach would be
fine if used together with a password, although it could be no longer called ‘zero-interaction’.
- Help for getting passwords under control
Password manager products are recommended,
as if it were a silver bullet, in the article.
My comment:
The convenience of password managers is obtained by sacrificing the
security. Password managers or ID
federations in general create a single point of failure that, once the
master-password is broken or the software hacked, the outcome would be just disastrous. It should be noted that password managers
should be operated in a decentralized formation with a particularly strong
password used as the master-password.
- Are squiggly lines the future of password
security?
My comment:
This approach belongs to behavioral biometrics in that there is a
trade-off between false rejection and false acceptance. When a password is required for self-rescue
in case of the false rejection, it would be difficult to call this the future
of password security.
- Strong Passwords: Motor Memory Passphrase
Recommended in the article is “motor
generated string” that is a series of characters generated solely by repetition
of a finger pattern.
My comment:
This concept, now exposed to criminals, may well have already been
incorporated in the attackers’ dictionaries.
No comments:
Post a Comment