- Kevan Furbank on the torturous task of
remembering ALL of our online passwords
“There is one saving grace. The torture we
have endured on earth thanks to the tyranny of passwords will surely have
earned us a place in heaven. St Peter will be there, ready to open the pearly
gates and welcome us to paradise. All we'll need is our password...”
My comment:
The torture could well be largely mitigated when we realize that this is
not the problem of “passwords”, but that of “text passwords” which is subject
to the immense “interference of memory.”
- It’s official: Malicious hackers have
crappy password hygiene, too
“Analysis uncovers short, predictable
words, plaintext storage”
My comment:
It is probably because shrewd hackers also suffer the strong
interference of memory when using text passwords.
- Exterminating the password
The writer shouts “The American public may
not agree upon much in 2014 but one thing that people can get behind is an
unadulterated disdain for passwords. They are either too numerous, too hard to
remember or too easily stolen. Passwords pretty much suck. --- They
are the cockroaches of the authentication and identity world, annoying, dirty
and ever present.
My comment:
I could agree to some extent if alphanumeric passwords are
concerned. Textual memories, however,
are only a small part of what we remember.
- For Better Security, Keep Password
Policies Simple
“The solution for XL Group comes in the
form of federated single sign-on for many of the company's systems.”
My comment:
Federated single-sign-on systems would certainly help if operated in a
decentralized formation for different levels of security requirements for
different segments with a very strong master-password for each of them. Should it be operated in an excessively
centralized formation with a fragile password as the master-password, the worst
should be expected in view of the single point of failure that the ID
federations necessarily create. When
planning the deployments, we should not forget the fact that humans cannot keep
remembering more than 5 text passwords on average irrespective of whether for business
use or for private use.
- Take a Peek: Biometric Security Offers
Relief from Passwords
"It actually is equal to a
50-character complicated password - which obviously no human would ever use or
remember," said Chris Barnett, the EVP of Sales and Marketing for
EyeVerify.
My comment:
It would be so if the biometrics were run without a password for
self-rescue in case of false rejection.
When, however, a 4-digit PIN is used for the self-rescue, the overall
security of the system is less than 4-digit numbers, not the 50-characters. Should the biometrics be used without a
rescue password altogether, the false rejection should be close to zero, which
means the false acceptance must be very high, say, security would collapse. How can we be relieved from passwords?
The same can be applied to the next article
as well.
Best security is the user, not a password
○ D/Dataweb adds Kaje Picture
Password to AXN Identity Platform
“After
one year of testing and evaluation, ID/Dataweb has added the Kaje ™ “Picture
Passwords for the Web” service by Bright Plaza, Inc., to its National Institute
of Standards (NIST) NSTIC pilot program to test innovative solutions for a
seamless, more secure online identity system for the web.”
My
comment: I am of the view that this is a
kind of “pattern-memory” password rather than a picture password. Such patterns are still subject to the
interference of memory, if not as bad as the alphanumeric.
- Report: Cybercrime and espionage costs
$445 billion annually
“CSIS used several methods to arrive at a
range of estimates, from $375 billion to as much as $575 billion.”
My comment:
I am very interested to know how much of that figure is related to the
passwords broken and stolen.
No comments:
Post a Comment