Below are
some of the latest media articles about password problems and my comments on
them.
- Authentication
Advances May Finally Kill Passwords and PINs
“banks
are finally replacing old and not-so-reliable methods of authenticating
customers —
passwords
and security questions — with sophisticated alternatives.”
My
comment: In a world where we live
without passwords or PINs, say, where our identity is
established
without our volitional participation, we would be able to have a safe sleep
only
when we
are alone in a firmly locked room. Is
this what we want?
Posted
below relating to this topic is a slide “Death to Password?”
- NTT
DoCoMo offering password replacement on some services
“NTT
DoCoMo said it plans to be the first mobile operator to integrate online
services and smartphones that
support biometric authentication based on protocols developed by the FIDO
Alliance.”
My
comment: FIDO is sadly promoting
biometrics in a wrong manner.
Biometric
authentication could be a candidate for displacing the password if/when (only
if/when)
it has
stopped depending on a password to be registered in case of false rejection
while keeping
the
near-zero false acceptance.
We could
be certain that biometrics would help for better security only when it is
operated together with another
factor by AND/Conjunction (we need to go through both of the two), not when operated
with another factor by OR/Disjunction (we need only to go through either one of
the two) as in the
cases of Touch ID and many other biometric products on the market that require
a backup/fallback
password, which only increase the convenience by bringing down the security.
In short,
biometric solutions could be recommended to the people who want convenience but
should
not be recommended to those who need security.
Below is a brief slide titled “Password-Dependent
Password-Killer” posted with respect to this theme.
No comments:
Post a Comment