Below are
some of the latest media articles about password problems and my comments on
them.
- Has the
flawed password system finally had its day?
“One
low-cost option, according to Dr Ant Allan, an authentication expert at Gartner
Research, could be biometrics, making use of the microphones, cameras and web
cams most computers and mobiles devices are equipped with.” (1)
“while
biometrics may not be as secure as long random passwords, they are probably
more secure than the simple, easy-to-remember passwords that many people use.”
(2)
My
comment: It is a great pity to see such
globally reputed media spread insufficient information and the false sense of
security.
(1) Biometrics,
whether static or behavioral or electromagnetic, cannot be claimed to be an
alternative to passwords UNTIL it stops relying on a password for self-rescue
against the false rejection altogether while retaining the near-zero false
acceptance in the real outdoor environment.
A dog which depends on a man cannot be an alternative to the man.
(2) I
wonder how many people are aware that biometrics operated with a password in
the OR/disjunction way (as in the case of iPhone) offers a lower security than
when only the password is used. For its
overall vulnerability is the sum of that of the biometrics and that of the
password. Media should let this fact
known to the public lest consumers should be misguided,
- Why Your Passwords Should be at Least 24
Characters Long
“We
recommend a 24-character or more password. Sounds crazy, but here are some
examples to decrease the stress of it all: HarleyDavidsonStarbucks!!!,
FireEarthWindWater4Life!#!. Long passwords with a combination of uppercase and
special characters increases possible combinations exponentially, therefore
taking a super computer upwards to 40 years to run all possible combinations.”
My
comment: Another case of reputed media spreading
nonsensical argument.
It may be
somehow possible to remember one or two of such long passwords. However, we are everyday being told that we
should not reuse the same password across many accounts and therefore we need
the solutions that enable us to manage dozens of accounts, not just one or two,
without excessively depending ID federations like SSO and password managers
which involve the single point of failure.
- Unlock
your smartphone with a digital tattoo
My comment:
Auto (unconscious)-Authentication is what we cannot achieve with the
passwords but we can so easily achieve with the likes of electronic tattoos and
hypodermic microchips.
We know that the function of having someone
else login to our phone/tablet/PC on our behalf while we are unconscious is
already realized by biometrics as shown in
But with the likes of electronic tattoos
and hypodermic or swallowed microchips, we can expect the third persons to
login to our accounts on our behalf a bit more gently and silently. The third persons would not have to behave
very carefully not to wake us up. All
that they have to do is just placing our PC/tablet/phone in the vicinity of our
unconscious bodies. Then they would have
a freehand over our accounts on our behalf.
For some people for whom convenience is the
top priority for identity authentication, this might mean that the passwords
have the fatal drawbacks. I am, however,
of the view that this tells us how critical it is to involve the confirmation
of the users’ volition to make the login, except for the lowest-security
accounts.
- In
2015, it won’t matter if hackers steal your password
New
technologies could replace passwords next year
“By 2015,
a large portion of Internet users will say goodbye to the old-school username
and password in favor of methods such as biometrics and one-time secure keys,
especially after the big players in the group begin to adopt the new standards,
says FIDO Alliance president and co-founder Michael Barret”
My
comment: They could claim to be able to
kill the password only when they have an alternative to the password: Something belonging to the password and
something dependent on the password cannot be the alternative. Neither can be something that has to be used
together with the password.
The same
applies to
- Seven
ways DARPA is trying to kill the password
No comments:
Post a Comment