Skip to main content

Passwords May Soon Be Passé


The early January theft of more than 320,000 user emails and passwords from cable giant Time Warner gave validation to the argument that simple password authentication is becoming less and less reliable.
But the Time Warner Cable hack is far from being the worst case of identity theft.
In fact, it’s quite insignificant compared to some of the more severe cases we’ve seen in the past year, including the five million user records stolen from toy manufacturer VTech, the 21 million federal employee records stolenfrom the Office of Personnel Management and the 80 million customer records stolen from healthcare service provider Anthem.
When it comes to stealing identities, hackers seem to have an unlimited stash of weapons, including brute-force attacks, dictionary attacks, phishing, social engineering, man-in-the-middle, key-loggers, password resets from recovery emails and wholesale theft of passwords from databases.
And when hackers gain access to our credentials, they can virtually ruin our entire lives by stealing our information or money, or by defaming us through doxing our secrets or posting profanity and obscenities in our names.
On the other hand, when it comes to protecting passwords, there seems to be no end to the pitfalls that one has to avoid, including weak passwords, shared passwords, unchanged passwords, default passwords… And even if you stay true to all the security best practices, some things remain out of your control, including how committed your provider is to encrypt and protect your credentials on its server.
The password dilemma isn’t new, and has been raised on numerous occasions inprevious years. However, the solutions offered have often proven to be frustratingly complex and expensive, or flawed in their own way.
Whatever’s destined to substitute passwords will have to be simple, robust, affordable and flexible.
For the most part, we prefer to continue relying on plain passwords for our online accounts. In light of the continuing rise of data-breaches and identity fraud cases, tech firms are addressing this issue in earnest, and are focusing on ways to strengthen and facilitate the password paradigm, or to have it replaced altogether. Here are some of the newer trends that might change our authentication habits in the near future.

PIN and software token

While classic two-factor authentication methods have proven to be fraught with frustrating user experience or hardware complexities, the PIN and software token combines the simplicity of password entry with the added security of two-factor authentication.
This is the method adopted by British tech firm MIRACL through its new technology, the M-Pin crypto application, a two-factor authentication protocol that involves a user-selected four-n length PIN and a related software token to create a unique key that runs a zero-knowledge proof authentication protocol against its server.
The token is stored on the user’s browser or mobile device, and the PIN is only known to the user. The fact that M-Pin stores no passwords on the server “will make password smash n’ grab attacks a thing of the past,” says Brian Spector, the company’s CEO.
The technology adds further safeguards by distributing its master keys between two D-TAs (Distributed Trust Authorities), one being the customer server, where the server application resides, and the other being the central MIRACL D-TA. This further complicates identity theft by requiring attackers to breach four different sources for each account they wish to hack.
MIRACL offers M-Pin in two flavors, a JavaScript code snippet and library embedded within websites, or a mobile version that allows users to control browser access to their accounts through a mobile app.
M-Pin will get its shot at delivering on its promise of improving both simplicity and security, as it was recently selected by certified identity assurance provider Experian to provide highly secure authentication to millions of U.K. citizens in a government-led project aimed at providing in a safe, secure and straightforward manner services such as driving license renewal and tax-form filing.

NFC two-factor authentication

Two-factor authentication through physical USB keys has been around for a while on desktop computers, but mobile devices have been slow to catch up. That has changed, as tech company Yubico launched a physical device that allows you to log in to your online accounts through Near Field Communication (NFC) technology.
Dubbed YubiKey NEO, the device is meant to be held against the back of an NFC-enabled phone and tapped to confirm user authenticity during login. The key generates a login code specific to the user and service at hand each time it’s pressed. After account access has been confirmed through YubiKey, that account can remain authenticated for a period of time (depending on the service), unless the service provider detects unusual activity, in which case the user will be prompted for YubiKey authentication again.
YubiKey NEO also offers the same multiple protocol support (OTP, U2F, PIV, OpenPGP) as the YubiKey 4, which means the device can be plugged into desktop computer USB ports to be used as a normal physical USB key during logins. YubiKey has been well received by some of the leading names in the tech industry, including Google, Dropbox and GitHub.
The YubiKey stores no personal details and is linked to an account, meaning that anyone with your credentials will also need the key to log in to your account. The only catch is that you’ll have one more device that you have to avoid losing.

Fingerprint authentication as a service

With more mobile devices sporting fingerprint scanners and cloud computing becoming cheaper, Qondado, a Puerto Rican tech startup, is trying to ease the way for developers to integrate biometric authentication into their web applications through a flagship platform it calls KodeKey.
The system, which is composed of a mobile app and a web service, ties users to their phone numbers via biometrics and allows clients to use that number and a PIN for authentication. The authentication platform can be integrated into any client site via an API or plug-ins (there’s currently a WordPress plug-in available).
When it comes to stealing identities, hackers seem to have an unlimited stash of weapons.
Registered users enter their phone number plus the associated PIN in the log-in page; they subsequently receive a notification on the KeyKode app which prompts them to scan their fingerprint. The web service will only allow access to the account if the mobile’s fingerprint scanner authenticates the user. The app is available on both Android and iOS, but will only function on newer handsets that have fingerprint scanners.
The company hopes to provide enterprise-level security for banks, credit card companies, cable providers, wireless providers and cloud services, and plans to develop plug-ins for a wide range of platforms in the future.

Mobile authentication

As the use of mobile devices is becoming increasingly widespread, users have an ever-present and personal tool to store and present their digital identity. This is becoming especially more feasible as newer mobile operating systems are offering trusted execution environments and hardware-secure elements to store sensitive data, such as cryptographic credentials.
This is a trend being embraced by two

Comments

Popular posts from this blog

Shatterproof screens to protect smartphones

Polymer scientists at the University of Akron in Ohio have developed a transparent electrode that could change the face of smartphones, literally, by making their displays shatterproof. In a recently published paper, researchers show how a transparent layer of nanowire-based electrodes on a polymer surface could be extraordinarily tough and flexible, withstanding repeated scotch tape peeling and bending tests. This could revolutionise and replace conventional touchscreens, according to Yu Zhu, UA assistant professor of polymer science. Currently used coatings made of indium tin oxide (ITO) are more brittle, most likely to shatter, and increasingly costly to manufacture. “These two pronounced factors drive the need to substitute ITO with a cost-effective and flexible conductive transparent film,” Zhu says, adding that the new film provides the same degree of transparency as ITO, yet offers greater conductivity. The novel film retains its shape and functionality after tests i...

Get 56GB of free cloud storage in one folder!

Bring Your Box, Dropbox, Google Drive, & OneDrive All Together In One Folder With odrive! Dropbox gives you up to 16GB free.  Google Drive & Gmail give you 15GB. OneDrive gives you 15GB. Box gives you 10GB. odrive brings all your cloud storage apps together in one folder right on your desktop. Just link your Dropbox, Google Drive, Gmail, Box, and OneDrive accounts to odrive and instantly get all your files scattered everywhere in one place! You can even link multiple accounts from each app to get even more! 1. Install odrive. DOWNLOAD It's free! And available for Windows & Mac :) 3.Get all your stuff! 2. Link all your cloud storage accounts. Note:  This gives odrive permission to download your files for you. odrive doesn't store anything, we promise! OXYGEN CLOUD, INC., 1600 SEAPORT BLVD, REDWOOD CITY, CA, 94063, UNITED  ...

So, when will your device actually get Android Oreo?

Google officially just took the wraps off of Android Oreo, but there are still some questions left to be answered — most notably, precisely when each device will be getting the latest version of the mobile operating system. Due to Android’s openness and a variety of different factors on the manufacturing side, it’s not an easy question to answer, but we’ll break it down best we can. First the good news: If your device was enrolled in the Android Beta Program, you’ll be getting your hands on the final version of the software “soon,” according to Google. Exactly what that means remains to be seen, but rest assured that you’ll be one of of the first people outside of Google to take advantage of picture-in-picture, notification dots and the like. No big surprise, Google handsets will be the first non-beta phones to get the update. The Pixel, Nexus 5X and 6P are at the top of the list, alongside Pixel C tablet and ASUS’s Nexus Player set-top box, which will be receiving the upgrade i...

The Withings Go Is A Cheap Little Activity Tracker

Withings  has one more thing up its sleeve, a new activity tracker. This isn’t a new version of the  Pulse  or Activité. This is a brand new activity tracker. And the best part is that it only costs $69. The Withings Go uses an always-on E Ink display like the one on your Kindle or original Pebble. It’s very power efficient but it’s also a black and white display. But the good thing about this kind of display is that the Withings Go uses a button cell battery and the battery lasts 8 months. This new device tracks your steps, distance, running activity and swimming activity. You can also use it to track your sleep cycles. Compared to other entry-level activity trackers, you can do quite a lot. You don’t have to switch between activities — the device switches automatically. And of course, you can get your data in the Withings Health Mate app on iOS and Android. The Withings Go will be available in Q1 2016. Now the question is whether people want ...

Where does Blue Apron go after Amazon wraps up its Whole Foods deal?

Last week, Amazon said that its massive $13.7 billion deal to acquire Whole Foods is wrapping up on Monday — giving it access to one of the strongest food brands in the United States, as well as hundreds of grocery stores in metropolitan areas. That means it’s going to be easier and easier for people to get access to great ingredients, and there’s been a continued trickle of suggestions that Amazon will be gunning for a massive business that helped Blue Apron go public — a trickle that has since tempered Wall Street’s appetite for that business. All this raises a ton of questions as to what the future of Blue Apron is as Amazon looks primed to bulldoze into its territory in a very Amazon move. But as the specter of Amazon getting into meal-kit delivery looms, let’s review really quickly what Blue Apron has going for it: It has a strong brand in meal-kit delivery. The company wouldn’t have been able to go public, much less sustain unicorn status even as its stock continues to plumme...