Password On Media #14

Below are some of the latest media articles about password problems and my comments on them.

- Thumbs Down on a Palm Recognition Experiment

http://www.americanbanker.com/news/bank-technology/thumbs-down-on-a-palm-recognition-experiment-1071339-1.html　

"Biometric authentication seems all the rage now that Apple uses fingerprint ID in its mobile wallet, but the Bitcoin ATM provider RoboCoin has concluded that biometrics can be more of a hassle than a help."

My comment:  The issue of “hassle” is probably a very minor problem if compared with the false sense of security as discussed in the foregoing.

- Turkey halts biometric healthcare registration

http://www.planetbiometrics.com/article-details/i/2415/

“Turkey’s Council of State has ruled that biometric registration of patients must stop as it is unconstitutional.”

My comment:  It is interesting to hear that Turkey is preceding the privacy-nervous West.


- Malware’s new target: your password manager’s password

http://arstechnica.com/security/2014/11/citadel-attackers-aim-to-steal-victims-master-passwords/

“Once the malware captures this master key, then they can use that master key to exercise complete control over the machine and any of the user’s online accounts,”

My comment:  What have long been anticipated are now happening as have been anticipated.  As I have repeatedly emphasized, password managers should be operated in a decentralized formation or should be considered mainly for low-security accounts.

- FBI Most Wanted Hacker Jeremy Hammond Used His Cat's Name for Password

http://abcnews.go.com/Technology/fbi-wanted-hacker-jeremy-hammond-cats-password/story?id=26884738

“Hammond said he still isn't sure how federal authorities were able to get into his encryption program and gather evidence that ultimately sent him to prison, however, he said he wonders if his weak password may have been the culprit.”

My comment:  This report ironically reconfirmed that sufficiently strong passwords are the key for the safe deployment of cryptography.

- Farmers shut out of online services by new identity scheme

http://www.computerworlduk.com/news/public-sector/3583666/farmers-shut-out-of-online-services-by-new-identity-scheme/

"I can’t remember the exact date that I moved to my current address in 1984! Is this all really necessary???"  

My comment:  This news may be giving us too plain a lesson that the shared secrets for identity proofing should be the ones that can be shared not just by machines but also by the very human users.