Below are
some of the latest media articles about password problems and my comments on
them.
- FIDO
Alliance releases 1.0 specifications for passwordless authentication
My Comment: Many
people shout that the password is dead or should be killed dead. The password
could be killed, however, only when there is an alternative to the password. Something belonging to the password (PIN,
passphrase, etc）and something dependent on the password (ID federations, 2/multi-factor,
etc) cannot be the alternative to the password. Neither can be something that has to be used
together with the password (biometrics, auto-login, etc). What could be killed is the text password, not
the password.
FIDO is expected to make it sure that the
vendors of biometric products operated together with passwords by
OR/Disjunction (as against AND/Conjunction that is common for 2-factor
authentication) should explicitly publicize that
(A)
The biometric product raises the convenience at the sacrifice of
security when the user keeps using the same password.
&
(B)
The biometric product could raise the convenience without sacrificing
security when the user changed the password to a largely-harder-to-break
password (with a footnote that the password should be remembered, not carried
around on a memo and that the password should not be reused across other
accounts.)
It should be noted that it is not possible
to compare the strength of biometrics with that of passwords. There are no objective data about the overall
vulnerability of biometric solutions (not just false acceptance rate when false
rejection is sufficiently low but also the risk of forgery of body features and
the risk of use when the user is unconscious/sleep) and that of the passwords
(not only that it may be as low as 10 bits or as high as 100 bits but also that
it can be stolen and leaked.)
It will hopefully not take long before FIDO people will be aware that at
the root of the password headache is the cognitive phenomena called
“interference of memory”, by which we cannot firmly remember more than 5 text
passwords on average.
What worries us
is not the password, but the textual password. The textual memory is only a small
part of what we remember. We could think of making use of the larger part of
our memory that is less subject to interference of memory. More attention could
be paid to the efforts of expanding the password system to include images,
particularly KNOWN images, as well as conventional texts.
Most of
the humans are thousands times better at dealing with image memories than text
memories. The former dates back to hundreds of millions of years ago while the
latter's history is less than a fraction of it.
I wonder what merits we have in confining ourselves in the narrow
corridor of text memories when CPUs are fast enough, bandwidth broad enough,
memory storage cheap enough, and cameras built in mobile devices.
