Below are
some of the latest media articles about password problems and my comments on
them.
- Passé
words
“PIN—a solution that borders on password
territory, but that is more easily remembered”
My Comment:
It seems that there are some misperceptions with either The Economist’s
article or what FIDO says
1. PIN vs Password: Many people take it for granted that PIN is
easier to remember than an alphanumeric password because it is simpler. The fact is, however, that PIN, a numbers-only
short password, is even more subject to the interference of memory exactly
because it is simpler, say, it contains less information, which gets the user
confused more easily and more badly than a longer alphanumeric password. It is, therefore, more difficult for us to
eliminate the reuse across many accounts. You could listen to yourself for your
own experience.
2. PKI:
The PKI software and the private key stored on a token or phone can
effectively proves the identity of the token or phone, but not the identity of
a person who is holding the token or phone.
The tokens and phones are easily left behind, lost, stolen and abused.
Then the password would be the last resort.
A truly reliable 2/multi-factor solution
needed for important accounts requires the use of the most reliable password.
3. BIOMETRICS: The sort of threats that can be thwarted by
biometric products operated together with fallback/backup passwords as in the
case of Apple's TouchID and most of the biometric products on the market can be
thwarted more securely by passwords only.
What biometrics operated this way can achieve is better convenience, not
better security.
4. Password’s Death: Some people shout that the password is dead
or should be killed dead. The password could be killed, however, only when
there is an alternative to the password. Something belonging to the password（PIN, passphrase, etc）and something dependent on the password (ID
federations, 2/multi-factor, etc) cannot be the alternative to the password. Neither can be something that has to be used
together with the password for either convenience or security (biometrics,
auto-login, etc).
Anyway, it is too obvious,that the
conventional alphanumeric password alone can no longer sustain the demand and
we urgently need a successor to it, which should be found from among the
broader family of the passwords and the likes.
At the root of the password headache is the
cognitive phenomena called “interference of memory”, by which we cannot firmly
remember more than 5 text passwords on average. What worries us is not the
password, but the textual password. The textual memory is just a small part of
what we remember. We could think of
making use of the larger part of our memory that is less subject to
interference of memory. More attention
could be paid to the efforts of expanding the password system to include images
in addition to characters.
