Password On Media

Below are some of the latest media articles over password issues and my comments on them.

I. Password breaches: End-user carnage is unspoken heartache

http://www.zdnet.com/end-user-carnage-unspoken-heartache-in-password-breach-conversation-7000030014/

This article starts with “Hear the chorus: Digital life must evolve beyond passwords” and ends with “What additional steps do you think are needed to address or limit the password problem?

My comment: No disagreement about the oval situation.  This situation can well be called “Password Predicament”.

II.  Microsoft cybersecurity expert declares the password dead (Albuquerque Business First)

https://www.google.com/url?rct=j&sa=t&url=http://www.bizjournals.com/albuquerque/blog/morning-edition/2014/05/microsoft-cybersecurity-exec-declares-the-password.html&ct=ga&cd=CAEYAioUMTc0NTM4MjM2NjgwMjU5NTY3MzgyHGQ0ZWVhZTlmYTMwOWM1YTI6Y28uanA6ZW46SlA&usg=AFQjCNFgNGZBM_J9uBlp3StnhGSW53yUZQ

Multi-factor solutions with biometrics included are recommended in the article.

My comment: When biometrics are operated together with a password by AND/conjunction, it would theoretically raise the security but fatally damage the availability in practice because there would be no means for self-rescue when the user is falsely rejected in the outdoor environment where there is no manager who takes care of the falsely rejected user.  When operated by OR/disjunction, the convenience would be high but the security would necessarily be lower than when a “dead” password alone was used since the overall vulnerability is the sum of the vulnerability of a biometrics and that of a password.

III. OTP 101: The ins and outs of one-time passwords (SecureIDNews)

https://www.google.com/url?rct=j&sa=t&url=http://secureidnews.com/news-item/otp-101-the-ins-and-outs-of-one-time-passwords/&ct=ga&cd=CAEYBioUMTc0NTM4MjM2NjgwMjU5NTY3MzgyHGQ0ZWVhZTlmYTMwOWM1YTI6Y28uanA6ZW46SlA&usg=AFQjCNH3_iguH6v0ytS9zzJFONDPeWbFUg

The advantage of onetime password is closely discussed in the article.

My comment: The conventional onetime password (OTP) proves the genuineness of the token that generates the OTP but does not tell anything about whether the said token is in the hand of the legitimate user or a criminal.  It will have to stay dependent on the “dead” password in practice for the latter purpose

IV. Your Favorite Website Is Probably Terrible At Passwords

https://www.google.com/url?rct=j&sa=t&url=http://www.huffingtonpost.com/2014/05/28/website-passwords_n_5374932.html&ct=ga&cd=CAEYAyoUMTc2MDA0MjcwODQ5ODgzMzIwNzIyHGQ0ZWVhZTlmYTMwOWM1YTI6Y28uanA6ZW46SlA&usg=AFQjCNEvrTPptmlf6jmyrHShQ17hP-QozQ

Recommended in the article are

- Don't use extremely common passwords 

- Don't use the same passwords for multiple websites

- Don't use words you can find in a dictionary as pass phrases

- Make sure your passphrases are long, ideally over eight characters

My comment: The following should be added:

- When writing passwords on a memo, the memo could be held in a safe place indoor but should not be carried around outdoor where there is no such safe place.

- ID federations (single-sign-on services and password manager software) should be used in a decentralised formation in view of the single point of failure that it creates.

V. The Password Problem

http://www.forbes.com/sites/kashmirhill/2014/05/22/the-password-problem/

A weak point of 2-factor solutions are highlighted that we can do nothing when we do not possess a phone or physical token.

My comment: A biometric combined with Mnemonic Guard for self-rescue against false rejection could help.

The author’s remark that “the only thing people seem to hate more than extra effort is actually shelling out dollars to protect something that hasn’t been violated yet” might be true for individual consumers, but should not be relevant to corporations.

VI. Could our behaviour be turned into a password?

http://www.bbc.com/news/technology-27627119

Behavioral biometrics are touted as an alternative to the password in this news report.

My comment: The reporter appears to be unaware of the trade-off between false rejection and false acceptance.  If the threshold is so set as to bring down the false acceptance rate close to zero, the false rejection rate will necessarily jump up, which forces us to use a password for self-rescue.