Password On Media #13

Below are some of the latest media articles about password problems and my comments on them.

- Forgotten Passwords Cost Companies $200,000 a Year

http://www.esecurityplanet.com/network-security/forgotten-passwords-cost-companies-200000-a-year.html

“A recent survey of 2,000 people in the U.S. and the U.K. has found that companies lose over $420 in productivity per employee per year due to workers struggling with passwords -- for a 500-person company, that's a loss of more than $200,000 per year.”

My comment:  On top of the damages caused by forgotten passwords we could add the damages by broken and stolen passwords.

- Passage Replaces Your Passwords With Images

http://techcrunch.com/2014/10/19/passage-replaces-your-passwords-with-images/

“From the users’ perspective, here is how it works when you end up on a site that uses Passage: you register with your email and then, instead of entering a password (twice), you hold up your image in front of your camera to register it”

My comment:  The title of the report first led me to wonder if another pictorial password is being reinvented, but it soon turned out to be possibly an alternative to biometric facial recognition.  Pattern matching of the images used in the video may well be much easier than that of faces because there are much more feature points.  A snag is that, although the objects to be used as images to be photographed may not be as publicly exposed as our faces, those image objects can be left behind or lost a bit more easily than our faces. 

- What the cybersecurity executive order means for authentication

http://secureidnews.com/news-item/what-the-cybersecurity-executive-order-means-for-authentication/

“The focus of the announcement was on the move to EMV and the more secure chip and PIN technology. “-

My comment:  "Chip & PIN" is no doubt better than "Chip Only" or "PIN Only", but obviously not as good as “Chip & Strongest Password”.

Using a strong password does help a lot even against the attack of cracking the stolen hashed passwords back to the original passwords. The problem is that few of us can firmly remember many such strong passwords.　 We cannot run as fast and far as horses however strongly urged we may be. We are not built like horses.  At the root of the password headache is the cognitive phenomena called “interference of memory”, by which we cannot firmly remember more than 5 text passwords on average. What worries us is not the password, but the textual password.

Multi-factor authentications are also referred to in the article.  Security could certainly be raised by putting a 2nd factor, a 3rd and so on.  But the piling up inconveniences thus caused could in turn drive users away and ruin the whole scheme altogether.

*************************************************************************************

About Me

http://www.linkedin.com/pub/hitoshi-kokumai/3b/483/4b2

About Expanded Password System "Mnemonic Guard"

http://mneme.blog.eonet.jp/default/files/outline_of_mnemonic_security.pdf

*************************************************************************************

Password On Media #12

Below are some of the latest media articles about password problems and my comments on them.

- LG UPlus Applies Graphical Authentication to Its Online Payment Solution

http://koreabizwire.com/lg-uplus-applies-graphical-authentication-to-its-online-payment-solution/21691#comment-22890

“As for users, to be authenticated, they should be able to combine the pre-selected four graphic images in a row. If the graphic images cannot be identified in a constantly changing image, then the site is considered as an abnormal or fake one so the users can completely keep it at bay from phishing or pharming.”

My comment:  I am reminded of the first generation prototype of Mnemonic Guard that we developed 14 years ago. 

Incidentally, moving pictures around will certainly irritate criminals but it does not help increase the security entropy or the mathematical strength.  Turning characters into pictures might help to discourage phishing and pharming, but it would obviously be an overstatement to claim that it alone “can completely keep it at bay from phishing or pharming.”

Anyway, all the people who see some values in pictorial passwords are all welcomed as our friends.

- WORLD-CHANGING IDEAS| The secret to staying safe online

http://www.bbc.com/future/story/20141010-the-secret-to-staying-safe-online

“OK, I’ve done all that. Am I finally safe? Sadly, probably not. But you’ve certainly made life more difficult for hackers. And there’s one final trick you can use to add an extra layer of security. Many email and cloud services now offer two-factor authentication.”

My comment:  2 is larger than 1 on paper, but a toughened guy may easily beat two weak boys in the real world.  Physical tokens and phones are easily lost, stolen and abused. Then the password would be the last resort.  It should be strongly emphasized that a truly reliable 2-factor solution requires the use of the most reliable password. 

- Obama's Cyber Czar Wants to Replace Passwords With Selfies

http://www.nationaljournal.com/tech/obama-s-cyber-czar-wants-to-replace-passwords-with-selfies-20141009

“Devices could scan faces and give access only to the right people”

- Selfies could one day replace passwords

http://www.mirror.co.uk/news/technology-science/technology/selfies-could-one-day-replace-4415683

『Michael Daniel, White House cybersecurity coordinator is ready to skim past the fingerprint scanner system that exists on the newest smartphones and consider the security selfie.　“Frankly, I would love to kill the password dead as a primary security method, because it’s terrible,” he said during a recent discussion hosted by America’s Center for National Policy. “You could use the cameras on cell phones, which are now ubiquitous, so the selfies are used for something besides posting on Facebook,” he added.　It’s an interesting idea, although you’d need to reset all your passwords if you’d had a facelift.　But it could mean that one day we’ll all be doing duckface pouts at our phones just in order to unlock them and send a text.』

My comment:  It is nice for the cyber czar to have noticed that mobile devices come with cameras.

However, neither fingerprints nor selfies sound attractive.  Biometrics like fingerprints and face recognition operated together with a password by OR/disjunction (as in the case of Apple’s Touch ID) would lower the security than when only a password is used.  As for selfies, how would it be possible to use the selfies as an alternative to the password (shared secrets) when our faces are very often exposed with our identity on the network?

- Revealed: Super- Safe Online Password System

http://news.sky.com/story/1350006/revealed-super-safe-online-password-system

“Researchers from Carnegie Mellon University asked subjects to memorise four person-action-object stories by choosing a random famous person from a drop-down list and being given random action-object pairs”

My comment:  This may appear similar to our approach in that it involves “selection of objects”, but is not similar at all to ours in that this can well be subject to the strong interference of memory and it does not produce the level of entropy required to stand the persistent attacks.

- The real risk of using password managers

http://techpageone.dell.com/technology/real-risk-using-password-managers/#.VCNcdZSSxhc

“A July review by University of California at Berkeley researchers found that the five popular password managers tested all had critical vulnerabilities, and in four of the five an attacker would be able steal arbitrary credentials, at the time..”

My comment:  This news might hopefully help undo the hype about password managers.

ID federations (single-sign-on services and password managers) create a single point of failure, not unlike putting all the eggs in a basket.  It remembers all my passwords when un-hacked and loses all my passwords to criminals when hacked.  It should be operated in a decentralized formation or should be considered mainly for low-security accounts, not for high-security business 　

- Fort Knox Digital Introduces Guardog: Four-Factor Authentication for Ultimate Internet Transaction and Communication Security

http://www.prweb.com/releases/2014/10/prweb12209595.htm

“a four-factor authentication process resulting in the most comprehensive transaction and communications security available”

My comment:  2> 1.  Then the natural landing spot would be 3 > 2, 4 > 3 and N+1 > N.

Whether or not the security thus obtained can justify the convenience thus sacrificed may well depend on where it is used.