Below are
some of the latest media articles about password problems and my comments on
them.
- Popular password protection programs p0wnable
“LastPass,
RoboForm, My1Login, PasswordBox and NeedMyPassword all flawed”
My
comment: The maxim is reminded that we
should not put many eggs in a basket.
Password managers should be considered only for low-security
applications.
- The way
you type can be your new password!
“IBM's
system monitors behaviour only after a person has logged in using their
password. This can prevent a fraudster making transactions, pretending to be an
authenticated user who has, for example, gone to make coffee without logging
out. When behaviours are detected that are out of character, the software will
ask them to log in again with some extra security questions”
My
comment: IBM is wise to be using the biometric
solution for complementing a password, not claiming it to be an alternative to
the password. Incidentally, the title of
this article is simply a hype.
The same also
applies to other behavioral biometrics such as heartbeat monitoring.
- How to
use speech for your dual-authentication login - Two-factor authentication soon
required for access to criminal information databases
“Biometric
authentication tokens have a big advantage over RFID chips, NFC transponders,
card keys, or flash drives: you can’t lose them. You can misplace or have
stolen any piece of hardware your agency gives you to access your computer, but
you’ll always have your face or your voice with you.”
My
comment: Biometrics could be one of the
multiple factors if the biometrics stopped relying on a self-rescue password or
backup password in case of false rejection while retaining the near-zero false
acceptance.
- How a
password changed one man's life for the better
“Forgive@her,
Quit@smoking4ever, Save4trip@thailand”
My
comment: There may be therapeutic
effects. But those ideas may well have
been or will soon be incorporated in the attackers’ dictionaries. Better than
the likes of abcd1234 and asdf;lkj, though.
- Despite
Privacy Concerns, It's Time to Kill the Password
“It(NSTIC)’s
designed to protect internet users by providing authentication far stronger
than can be accomplished by passwords alone.”
My
comment: If you use something (probably
PKI-based physical tokens) in addition to a password, would it mean that the
password has been killed dead? Then, when a man is assisted by a dog, the man would have to be declared dead.
- Microsoft
tells users to stop using strong passwords everywhere
“Weak
passwords have their place, argues new research from Microsoft, and they help
users conserve brainpower for where it is needed”
- Microsoft:
'You're better off reusing old passwords than creating new ones'
My comment: I have no objection to the view that
difficult-to-remember passwords and easy-to-remember passwords have the role to
play of their own. That is what I have
long been practicing.
However,
at the top of the technology list should be “chip & the strongest password”
rather than “chip & pin” (both are an expanded use of passwords not an
alternative to the password), since PIN is a password (the weakest form of
numerical passwords.) Incidentally, "password"
being replaced by "password & something" sounds really odd like
"a man" replaced by "a man and his dog".
No comments:
Post a Comment