False Sense of Security

It is very worrying to see so many ICT people being indifferent to the difference between AND/conjunction and OR/disjunction when talking about “two factors used together”.

Biometrics can theoretically be operated together with passwords in two ways, 

(1) by AND/conjunction or (2) by OR/disjunction.  Biometric products operated by (1) are unknown.  The users of such products must have been notified that, when falsely rejected by the biometric sensors with the devices finally locked, they would have to see the devices reset.　 It is the same with the biometrics operated without passwords altogether.

Biometric products like Apple's Touch ID are generally operated by (2) so that users can unlock the devices by passwords when falsely rejected by the biometric sensors.  This means that the overall vulnerability of the product is the sum of the vulnerability of biometrics (x) and that of a password (y).  The sum (x + y - xy) is necessarily larger than the vulnerability of a password (y), say, the devices with Touch ID and other biometric sensors are less secure than the devices protected only by the password.

What makes us nervous is the possibility of seeing such pictures that many of the consumers, who are trapped in the false sense of security, are piling up their assets and privacy in the cyber space while some of the criminal wolves, who are aware that those consumers are now less safe, are silently waiting for the pig to grow fat.

I would appreciate to hear different views, especially from the people who are professionally engaged in biometrics industries.

Password On Media #14

Below are some of the latest media articles about password problems and my comments on them.

- Thumbs Down on a Palm Recognition Experiment

http://www.americanbanker.com/news/bank-technology/thumbs-down-on-a-palm-recognition-experiment-1071339-1.html　

"Biometric authentication seems all the rage now that Apple uses fingerprint ID in its mobile wallet, but the Bitcoin ATM provider RoboCoin has concluded that biometrics can be more of a hassle than a help."

My comment:  The issue of “hassle” is probably a very minor problem if compared with the false sense of security as discussed in the foregoing.

- Turkey halts biometric healthcare registration

http://www.planetbiometrics.com/article-details/i/2415/

“Turkey’s Council of State has ruled that biometric registration of patients must stop as it is unconstitutional.”

My comment:  It is interesting to hear that Turkey is preceding the privacy-nervous West.


- Malware’s new target: your password manager’s password

http://arstechnica.com/security/2014/11/citadel-attackers-aim-to-steal-victims-master-passwords/

“Once the malware captures this master key, then they can use that master key to exercise complete control over the machine and any of the user’s online accounts,”

My comment:  What have long been anticipated are now happening as have been anticipated.  As I have repeatedly emphasized, password managers should be operated in a decentralized formation or should be considered mainly for low-security accounts.

- FBI Most Wanted Hacker Jeremy Hammond Used His Cat's Name for Password

http://abcnews.go.com/Technology/fbi-wanted-hacker-jeremy-hammond-cats-password/story?id=26884738

“Hammond said he still isn't sure how federal authorities were able to get into his encryption program and gather evidence that ultimately sent him to prison, however, he said he wonders if his weak password may have been the culprit.”

My comment:  This report ironically reconfirmed that sufficiently strong passwords are the key for the safe deployment of cryptography.

- Farmers shut out of online services by new identity scheme

http://www.computerworlduk.com/news/public-sector/3583666/farmers-shut-out-of-online-services-by-new-identity-scheme/

"I can’t remember the exact date that I moved to my current address in 1984! Is this all really necessary???"  

My comment:  This news may be giving us too plain a lesson that the shared secrets for identity proofing should be the ones that can be shared not just by machines but also by the very human users.