Below are
some of the latest media articles about password problems and my comments on
them.
- Apple
opens Touch ID to third-party applications with iOS 8
“iPhone
security and convenience have both been greatly enhanced by Apple's iOS 8,
giving third-party developers the ability for the first time to utilize the
secure Touch ID fingerprint sensor.”
My
comment: I am really surprised to see so
many people being indifferent to the difference between AND/conjunction and
OR/disjunction when talking about "using 2-factors together". I would
like to talk a bit more about it.
Biometrics
can theoretically be operated together with passwords in two ways, (1) by
AND/conjunctiion or (2) by OR/disjunction.
I would
appreciate to hear if someone knows of a biometric product operated by (1). The
users must have been notified that, when falsely rejected with the device
finally locked, they would have to see the device get reset.
Like
other biometric products, Apple's iPhones are operated by (2) so that users can
unlock the phones by passwords when falsely rejected, which means that the
overall vulnerability is the sum of the vulnerability of biometrics and the
vulnerability of a password. It is necessarily larger than the vulnerability of
a password.
As for an
additional vulnerability unique to biometrics, we could refer to
Needless
to say, so-called 2-factor systems with a password remembered as the first
factor and something possessed as the second factor are generally operated by
(1), providing raised security at the sacrifice of lowered convenience.
- A List
of 5 Million 'Gmail Passwords' Leaked, But There's No Need to Panic
“the
issue is always the same: password reuse” “Password managers can help you keep
track of your accounts.”
My
comment: The password managers create a
single point of failure, not unlike putting all the eggs in a basket. It loses all the managed passwords to
criminals when hacked. It should be emphasized
that the password managers should be operated in a decentralized formation or
should be considered mainly for low-security accounts, not for high-security
business, and also that the strength of the master-password is crucially
important.
- Use
multi-factor authentication, urges CIA veteran
““If people want to be secure, they should be
using some sort of multi-factor authentication. (Also) creating strong
passwords and making sure you don’t use the same password for your Facebook
account as you do for your bank accounts. If consumers do that, I don’t find
the consumers to be at fault when problems occur,” Mr Flores said.”
My
comment: The two-factor authentication
could be relied upon when it comes with a reliable password.
2 is
larger than 1 on paper, but two boys in the real world may well be weaker than
a toughened guy. Physical tokens and
phones are easily lost, stolen and abused. Then the password would be the last
resort. It should be strongly emphasized
that a truly reliable 2-factor solution requires the use of the most reliable
password.
A
sufficiently strong password does help a lot against the attack of cracking the
stolen hashed passwords back to the original passwords. Such a high-entropy
password alone could well be more effective than the combination of a weak
password and a vulnerable second factor.
It would
be easily possible to safely manage many of such high-entropy passwords with
the Expanded Password System that handles images as well as characters. Each image/character is identified by the
image identifier data which can be any long.
Assume that your password is “ABC123” and that those characters are
identified as X4s&, eI0w, and so on.
When you input ABC123, the authentication data that the server receives
is not the easy-to-break “ABC123”, but something like
“X4s&eIwdoex7RVb%9Ub3mJvk”, which might be automatically altered
periodically or at each access if required.
When such
high-entropy data are hashed, it would be next to impossible to quickly crack
the hashed data back to the original password.
Give different sets of identifier data to “ABC123” and the different
servers will receive all different high-entropy authentication data.
Brute-force
attacking of “ABC123” and other similarly silly passwords would perhaps take
less than a few seconds with dictionary and automatic attack programs but it
could be an exhausting job when criminals have to manually touch/click on the
display with their fingers. The outcome
would be the 2/multi-factor authentication systems that, though not a silver
bullet, are significantly more reliable than the conventional ones even when
textual passwords are used.
