Below are
some of the latest media articles about password problems and my comments on
them.
- LG
UPlus Applies Graphical Authentication to Its Online Payment Solution
“As for
users, to be authenticated, they should be able to combine the pre-selected
four graphic images in a row. If the graphic images cannot be identified in a
constantly changing image, then the site is considered as an abnormal or fake
one so the users can completely keep it at bay from phishing or pharming.”
My
comment: I am reminded of the first
generation prototype of Mnemonic Guard that we developed 14 years ago.
Incidentally,
moving pictures around will certainly irritate criminals but it does not help
increase the security entropy or the mathematical strength. Turning characters into pictures might help
to discourage phishing and pharming, but it would obviously be an overstatement
to claim that it alone “can completely keep it at bay from phishing or
pharming.”
Anyway,
all the people who see some values in pictorial passwords are all welcomed as
our friends.
- WORLD-CHANGING
IDEAS| The secret to staying safe online
“OK, I’ve
done all that. Am I finally safe? Sadly, probably not. But you’ve certainly
made life more difficult for hackers. And there’s one final trick you can use
to add an extra layer of security. Many email and cloud services now offer
two-factor authentication.”
My
comment: 2 is larger than 1 on paper,
but a toughened guy may easily beat two weak boys in the real world. Physical tokens and phones are easily lost,
stolen and abused. Then the password would be the last resort. It should be strongly emphasized that a truly
reliable 2-factor solution requires the use of the most reliable password.
- Obama's
Cyber Czar Wants to Replace Passwords With Selfies
“Devices
could scan faces and give access only to the right people”
- Selfies could one day replace passwords
『Michael Daniel,
White House cybersecurity coordinator is ready to skim past the fingerprint
scanner system that exists on the newest smartphones and consider the security
selfie. “Frankly, I
would love to kill the password dead as a primary security method, because it’s
terrible,” he said during a recent discussion hosted by America’s Center for
National Policy. “You could use
the cameras on cell phones, which are now ubiquitous, so the selfies are used
for something besides posting on Facebook,” he added. It’s an interesting idea, although you’d need
to reset all your passwords if you’d had a facelift. But it could mean that one day we’ll all be
doing duckface pouts at our phones just in order to unlock them and send a
text.』
My
comment: It is nice for the cyber czar
to have noticed that mobile devices come with cameras.
However,
neither fingerprints nor selfies sound attractive. Biometrics like fingerprints and face
recognition operated together with a password by OR/disjunction (as in the case
of Apple’s Touch ID) would lower the security than when only a password is
used. As for selfies, how would it be
possible to use the selfies as an alternative to the password (shared secrets) when
our faces are very often exposed with our identity on the network?
- Revealed:
Super- Safe Online Password System
“Researchers
from Carnegie Mellon University
My
comment: This may appear similar to our
approach in that it involves “selection of objects”, but is not similar at all
to ours in that this can well be subject to the strong interference of memory
and it does not produce the level of entropy required to stand the persistent
attacks.
- The
real risk of using password managers
“A July
review by University of California at Berkeley researchers found that the five
popular password managers tested all had critical vulnerabilities, and in four
of the five an attacker would be able steal arbitrary credentials, at the
time..”
My comment: This news might hopefully help undo the hype
about password managers.
ID
federations (single-sign-on services and password managers) create a single
point of failure, not unlike putting all the eggs in a basket. It remembers all my passwords when un-hacked
and loses all my passwords to criminals when hacked. It should be operated in a decentralized
formation or should be considered mainly for low-security accounts, not for
high-security business
- Fort Knox
“a
four-factor authentication process resulting in the most comprehensive
transaction and communications security available”
My
comment: 2> 1. Then the natural landing spot would be 3 >
2, 4 > 3 and N+1 > N.
Whether
or not the security thus obtained can justify the convenience thus sacrificed may
well depend on where it is used.
No comments:
Post a Comment