Fido Alliance to Replace Passwords

Seeking a secure Passwordless future, with ease of use?  Like the idea. 

A Big Bet to Kill the Password for Good

in ACM By Wired, March 22, 2022

After years of tantalizing hints that a passwordless future is just around the corner, you're probably still not feeling any closer to that digital unshackling. Ten years into working on the issue, though, the FIDO Alliance, an industry association that specifically works on secure authentication, thinks it has finally identified the missing piece of the puzzle. 

On Thursday, the organization published a white paper that lays out FIDO's vision for solving the usability issues that have dogged passwordless features and, seemingly, kept them from achieving broad adoption. FIDO's members collaborated to produce the paper, and they span chipmakers like Intel and Qualcomm, prominent platform developers like Amazon and Meta, financial institutions like American Express and Bank of America, and the developers of all major operating systems—Google, Microsoft, and Apple. 

The paper is conceptual, not technical, but after years of investment to integrate what are known as the FIDO2 and WebAuthn passwordless standards into Windows, Android, iOS, and more, everything is now riding on the success of this next step.

"The key to being successful for FIDO is being readily available—we need to be as ubiquitous as passwords," says Andrew Shikiar, executive director of the FIDO Alliance. "Passwords are part of the DNA of the web itself, and we're trying supplant that. Not using a password should be easier than using a password."

View Full Article  

Fingerprint Cloning?

I recall  this came up when we set up our innovation labs.    Retails suggested it was much discussed at the time.  It was ultimately discounted because it was too hard to do.   Seems things have changed.  Via the Cisco blog 

Fingerprint cloning: Myth or reality?
Phone, computer fingerprint scanners can be defeated with 3-D printing
By Paul Rascagneres and Vitor Ventura.

EXECUTIVE SUMMARY

Passwords are the traditional authentication methods for computers and networks. But passwords can be stolen. Biometric authentication seems the perfect solution for that problem. There are several kinds of biometric authentication, including retina scanning, facial recognition and fingerprint authentication, the most common one. Everyone's fingerprints are unique, and it is commonly accepted that they can identify a person without being reproduced.

Technological evolution expanded fingerprint authentication to all kinds of devices, from laptops to mobile phones, to padlocks and encrypted USB drives. Fingerprint authentication became commonly available on phones with the launch of Apple TouchID in the iPhone 5 in 2013. That technology was bypassed shortly after being released. Since then, the technology evolved into three main kinds of sensors: optic, capacitance and ultrasonic.

Our tests showed that — on average — we achieved an ~80 percent success rate while using the fake fingerprints, where the sensors were bypassed at least once. Reaching this success rate was difficult and tedious work. We found several obstacles and limitations related to scaling and material physical properties. Even so, this level of success rate means that we have a very high probability of unlocking any of the tested devices before it falls back into the pin unlocking. The results show fingerprints are good enough to protect the average person's privacy if they lose their phone. However, a person that is likely to be targeted by a well-funded and motivated actor should not use fingerprint authentication.  ... " 

Project Zenkey to Use Phones to Authenticate

The idea is that your phone and phone number will act as a secure identifier.     I like the general idea, but expect general mistrust in large carriers will emerge.

The four big US carriers want to help you get rid of passwords, but you’ll have to wait

Project Verify is now ZenKey   By Jay Peters in theVerge

Last September, AT&T, Sprint, T-Mobile, and Verizon announced Project Verify, a way to log into apps without making a new account or password by instead relying on your smartphone to authenticate your identity. Think of it like the buttons you’ve likely seen that let you sign into apps and websites using your Facebook or Google account. Now, Project Verify has an official name — ZenKey — and it’s starting to roll out, albeit very slowly.  ... " 

Chinese vs English Language Password Security

Fascinating that language could strongly  change the ability to crack passwords.  Note also the Markov solving engine used in the test.

How Language Shapes Password Security
IEEE Spectrum   By Jeremy Hsu

Researchers at China's Peking University and the University of Virginia compared Chinese and English passwords, analyzing 106 million passwords from nine Web services, including 73 million from six Chinese-language services and 33 million from three English-language services. The team learned a supposedly strong password based on English-language precepts could actually be weak and easily guessed from a Chinese-language perspective. A key distinction is that many Chinese-language users prefer passwords composed entirely of numbers, and more often use mobile phone numbers or certain dates in passwords than English users. The researchers attempted to decrypt the passwords with the Markov-Chain algorithm, which assigns certain likelihoods to characters based on their interrelationships, and the probabilistic context-free grammars (PCFG) algorithm, which parses passwords into letter segments, digit segments, and symbol segments before guessing in order of the most probable combinations. ... " 

Password Inventor Dies

Had not known of this particular invention claim. But when we first used using time sharing computers they were not password protected.   I remember using a form of non-digital key which acted as a password.

Computer password inventor dies aged 93

Share this with Facebook Share this with Messenger Share this with Twitter Share this with  

Dr Corbato became interested in computers while studying physics
Computer pioneer Fernando Corbato, who first used passwords to protect user accounts, has died aged 93.

Dr Corbato introduced the basic security measure while developing methods that let more people use a computer at the same time.

He developed a technique, called time-sharing, that divided up the processing power of a computer so it could serve more than one person at once.  .... " 

Killing the Password

When we traveled in the enterprise we always took a key generating device with us as a means to replace the password, which was then combined with the use of a pin  Nice to see this is becoming more broadly used.

Your New Yubikey will help kill the password  By Lily Hay Newman in Wired

 BY NOW IT'S hopefully been drilled into you to enable two-factor authentication on your online accounts, giving you more protection than a password alone. And while the most ubiquitous second factor is a numeric code sent to your smartphone via an app, physical tokens that you plug into your computer have become increasingly popular. And now they're angling to make passwords obsolete.

On Monday, the hardware authentication company Yubico is announcing a new generation of its physical YubiKey tokens that support password-less login. The Series 5 YubiKeys get this streamlined mojo from FIDO2, a new version of an open source standard that facilitates secure authentication. As companies like Microsoft adopt the standard over the next few months, all you'll need for a secure log-in is to plug in and tap your new YubiKey. That's it.   ... " 

Reactions to Images, Packaging as Password?

So could we use this differently?  Could your reaction to a product change its price,  or be a kind of loyalty connection?  Integrated with product detection in an automated checkout, 'Amazon Go' type interaction?

Your Reaction to Pics of Leonardo DiCaprio, Animals Could Unlock Your Next Smartphone   University of Buffalo   By Cory Nealon

Researchers at the University at Buffalo (UB) School of Engineering and Applied Sciences are developing a new type of password that "measures your brainwaves" in response to a series of pictures. The "brain password" would require users to wear a headset and could have potential applications in banking, law enforcement, airport security, and other areas. Says UB's Zhanpeng Jin, "To the best of our knowledge, this is the first in-depth research study on a truly cancelable brain biometric system." The group refers to the technology as "hard cancellation," meaning the original brain password can be reset without divulging the user's identity. The work is described in a study that will be presented next week at ACM SIGMOBILE’s MobiSys 2018 mobile computing conference in Germany. ... " 

Hacking Phone Pins with Sensor Data

Disturbing Situation ... You have to think about what data is being gathered by sensors, and if that new data can be used to predict other data ... and beyond.  A whole stream of inference to check.  Note the prediction does not necessarily have to be precise, just approximate. 

Hackers can guess your phone's PIN using 'harmless' sensor information
Six key sensors have no permission requirements, leaving their stored data open to any app that wants it .... " 

Choosing Better Passwords

Just started to rethink the effective use of passwords here ....

Choose Better Passwords With the Help of Science 

in The Conversation
Lorrie Cranor; Blase Ur; Lujo Bauer, et al

A team of researchers has been conducting experiments into improving password security, using scientific methods so that such passwords are difficult for computers to guess. The researchers found many users often subscribe to misconceptions, such as thinking that adding a number or punctuation mark to the end of their password will strengthen it. They also say their findings indicate it is more important for passwords to be longer instead of more complicated, while long passwords still tend to be predictable. The researchers note providing feedback while people are creating new passwords can help significantly, and their password meter uses an artificial neural network to rate password strength based on analysis of other passwords. Among the team's recommendations are making passwords at least 12 characters long, and mixing in at least two or three different types of characters in unpredictable places. They also advise against reusing existing passwords for multiple, sensitive accounts. .... " 

Keep Your Home Devices from Being Hacked

Apparently yesterday's denial of service attack that brought down a number of key services on the Internet was caused by a distributed denial of services (DDOS) attack.  Some are saying this was launched from hijacked home devices.

Keep your home IOT devices from becoming zombies on the internet.

Change default passwords.
Change passwords, use 2 factor authentication, or services like Lastpass
Accept all security updates.

But as long as there are enough people/things out there that are not doing this,  you can still lose access to crucial services.  All this points to the continued fragility of the internet.  Considering how many ways we and businesses depend on the Internet, this is worrisome.

More in Mashable.

A Disturbing Loss of Linkedin Security Most of You Should Still Care About

A few days ago I got a message from Linkedin.  You know them, the near-monopoly of professional credential information for many millions of people?   They said that they had known since 2012 that our passwords and related information had been stolen.

They then forced me to change my password. And I did. And I felt good, never thought much more about it. I was secure, and we all were.  Right?  And they don't sell things that can be pawned anyway.

That is,  until I read my correspondent Evan Schuman's article in CW.  There he lays out very exactly why it is disturbing that thieves were holding onto this information for over four years before we were told about it.  And dangerous, even after we change our password.      It also shows you why other aspects of controlling your passwords are more important than you think.  Read his article,

And what do we do now?  Move all that carefully edited information to another location?  Who else has as many members?  Write a letter to someone?   Trust?  Seems negligent at least.   Pass it on.

Long Range Iris Scanning

We examined iris scanning for security applications.  You had to place your face on the reader, and it thus created a sanitary issue.  Also, some people could not be scanned because of face-eye structure. Now in the Atlantic:  " ...   Long-Range Iris Scanning Is Here ... An engineering professor at Carnegie Mellon says he’s invented technology that can identify someone from across the room with the precision of a fingerprint. ... "

Use Two Factor Authentication

JP Morgan was burned by not implementing it everywhere.  So it is a good time to enable two factor authentication security for passwords.  It is not perfect security, but it is a necessary first step.  Just did it myself.   It is very easy to do for many systems.

Are Fingerprints Pins?

Good piece by Evan Schuman on the physical elements of security.  " ... A judge’s ruling that a person can be forced to open his phone with his fingerprint ignores the fact that the fingerprint scan is just a substitute PIN, which can’t be required by law enforcement ... " 

Limits of Fingerprint Security

The reported inclusion of fingerprint authentication in new iPhones means we will see this approach being used commonly.  It is very convenient, but has its limitations.  Bruce Schneier, security expert provides details about the issues with its use.   Most importantly: " ... Biometric systems are seductive, but the reality isn't that simple. They have complicated security properties. For example, they are not keys. Your fingerprint isn't a secret; you leave it everywhere you touch. ... " 

Time to Retire the Password

Hard to not get agreement on this, soon please:

" ... A group of Silicon Valley tech companies is lobbying the industry to do away with one of the most ubiquitous expressions of networked life: the computer password. According to the coalition, which is behind the Petition Against Passwords campaign, in today's heightened threat environment, the standard network password is no longer an adequate measure for protecting critical data because it is too easily breached. The group is calling for new "passwordless" authentication methods that put less responsibility in the hands of end users. .... 

Google Password Ring

A USB device meant to replace a password.  Simple idea to use the form of a ring.  We do need something new.  " ... As part of research into doing away with typed passwords, Google has built rings that not only adorn a finger but also can be used to log in to a computer or online account. The search and ad company first revealed its plans to put an end to passwords in an academic paper published online in January (see “Google’s Alternative to the Password”). The effort focused on having people plug a small USB key that provides their credentials into a computer. The possibility of using special jewelry in a similar manner was mentioned in that paper.... " 

A Cloud Intrusion

An example of a cloud security issue with the popular package Evernote, which I have used for some time.  Good example which led me to refresh my understanding of hashing and salting,  as applied to Password security.  And a reminder that security is always a compromise with convenience.