Forgot your password?
typodupeerror
Google Security The Internet Hardware Technology

Google Declares War On the Password 480

Posted by Soulskill
from the united-nations-powerless-to-intervene dept.
An anonymous reader writes "Wired reports on a research paper from Google employees about the future of authentication on the web. 'Along with many in the industry, we feel passwords and simple bearer tokens such as cookies are no longer sufficient to keep users safe,' the authors write. Their plan involves authenticating just once, to a single device, and then using that to unlock all of your other accounts. "We'd like your smartphone or smartcard-embedded finger ring to authorize a new computer via a tap on the computer, even in situations in which your phone might be without cellular connectivity." Recognizing that this isn't something they can accomplish on their own, they've gone ahead and created a device-based authentication protocol that is 'independent of Google, requires no special software to work — aside from a web browser that supports the login standard — and which prevents web sites from using this technology to track users.'"
This discussion has been archived. No new comments can be posted.

Google Declares War On the Password

Comments Filter:
  • Brilliant idea (Score:5, Insightful)

    by 0123456 (636235) on Friday January 18, 2013 @02:04PM (#42627031)

    Because I totally want anyone who steals my phone to be able to access every other site I use.

    • Re:Brilliant idea (Score:5, Insightful)

      by Andrio (2580551) on Friday January 18, 2013 @02:06PM (#42627069)
      The best feature of the password is that it's in your head. You carry it around everywhere, and it can never be physically taken from you.

      This proposed plan just makes cellphones that much more attractive to steal.
      • Re:Brilliant idea (Score:5, Insightful)

        by Dexter Herbivore (1322345) on Friday January 18, 2013 @02:12PM (#42627151) Journal

        The best feature of the password is that it's in your head. You carry it around everywhere, and it can never be physically taken from you. This proposed plan just makes cellphones that much more attractive to steal.

        The WORST feature of the password is that it's in your head. I have 20+ login passwords between work and home, my security is lower because you have to simplify them to remember them. If we can find a way to escape the tyranny of passwords that can generally be cracked by anyone who's determined anyway it can only be progress. Not that I have any faith in any organisation to do it after many failed or barely passable attempts (biometrics, smart cards etc).

        • Re:Brilliant idea (Score:5, Informative)

          by terrab0t (559047) on Friday January 18, 2013 @02:27PM (#42627363)

          I use a password manager [keepass.info] to solve this problem. It stores all (or a large set of) my passwords in an encrypted database. I have one very strong password that lets me access the database. The passwords it stores are all strong (sometimes hard to remember) passwords that I do not have to store in my head.

          I still have all of my eggs in one basket, but that basket is sealed in a solid iron box.

          • Re:Brilliant idea (Score:5, Insightful)

            by kaiser423 (828989) on Friday January 18, 2013 @02:36PM (#42627489)

            True, but if that password manager gets compromised by, say, Red October via capturing your keystrokes, everything is compromised for all sites until you take the time individually change each one,.

            Currently, with Google Authenticator, I have it set up to authenticate me for a number of things, as if it gets compromised, simply telling it to re-sync again re-secures all of my credentials. Much, much better management. Single point control.

            • Re:Brilliant idea (Score:5, Informative)

              by Baloroth (2370816) on Friday January 18, 2013 @02:40PM (#42627541)

              True, but if that password manager gets compromised by, say, Red October via capturing your keystrokes, everything is compromised for all sites until you take the time individually change each one,.

              Currently, with Google Authenticator, I have it set up to authenticate me for a number of things, as if it gets compromised, simply telling it to re-sync again re-secures all of my credentials. Much, much better management. Single point control.

              LastPass offers Google Authenticator security over the vault, which means even if they get the master password they still wouldn't be able to access my vault. This does, however, mean the vault is technically not under my complete control (since I don't store it locally, although I do keep a semi-regular back of it). But, the advantage is worth it in my opinion.

              • by Nerdfest (867930)

                Thanks for the tip, I didn't realize that they had this. That was always the weak point of that service, I thought. Two factor is pretty much required for a central repository

              • Re:Brilliant idea (Score:5, Informative)

                by DMUTPeregrine (612791) on Friday January 18, 2013 @03:32PM (#42628127) Journal
                KeePass allows the use of key files on USB drives (or any drive.) This allows you to control the password safe, and the key file needed for authentication forms the second (something you have) factor.
              • Re:Brilliant idea (Score:5, Informative)

                by Anonymous Coward on Friday January 18, 2013 @04:06PM (#42628533)

                I stopped using LastPass and switched to hiding keepass in SpiderOak when last year and someone downloaded LastPass' entire, albeit encrypted, password database. I was burned bad by that break in, because I had to sit there and changed dozens of passwords just in case. I migrated to keepass and generated very strong long random passwords for each website with it. I can't login to any sites now without it. I'd also recommend locking your keepass with a key file that you keep hidden elsewhere in addition to a password just in case your main password is stolen. Oh, and if you use webmail like gmail, make sure to use two-factor authentication that they provide to give some added security. It is far too easy to reset an account with very little knowledge of the person who owns the account, e.g. Wired's editor. I have a personal example of this myself, a coworker didn't know the password to a gmail account that we had set up for sending out continuous build integration emails (I.T. has lots of ports blocked and won't configure exchange for us) and we needed to reconfigure it. I simply guessed the location he had logged in at (he's in another country) but that didn't work, and then I tried his various known email addresses and one of them was accepted. Google gave me full access to the account, it was ridiculously easy. But, I digress. However, we still need at least a second part of the equation to protect a scheme like the one they're recommending. What they're offering is only one-factor and is just as poor if not more poor than using a password alone, it's only together that they're strongest.

              • Re:Brilliant idea (Score:5, Informative)

                by kevmeister (979231) on Friday January 18, 2013 @05:30PM (#42629389)

                +1 for LastPass.

                LastPass keeps an AES encrypted vault on my system, so I can use it when their vault is unreachable. AES is important as too many password "vaults" use undefined or obsolete and possibly vulnerable encryption. Works with Google Authenticator, too. Runs on Windows, MacOS, Linux and even my FreeBSD systems as well as iOS and Android. I'll admit that the mobile version is sub-optimal, but it does work. (A few apps don't allow a paste into the password field, so it won't work properly with them.)

                Oh.It is commercial and not free for mobile devices. It is subscription based, costs about USD 1 a month for all mobile devices sharing a single vault and is paid annually. It is free for desktop devices. LastPass also owns XMarks, the multi-browser bookmark and history sync service that I also use.

                I have no association with LastPass other than as a generally happy user.

            • Re: (Score:3, Interesting)

              by Anonymous Coward

              True, but if that password manager gets compromised by, say, Red October via capturing your keystrokes, everything is compromised for all sites until you take the time individually change each one,.

              Currently, with Google Authenticator, I have it set up to authenticate me for a number of things, as if it gets compromised, simply telling it to re-sync again re-secures all of my credentials. Much, much better management. Single point control.

              Actually, keepass can defeat most keyloggers as it uses a different function to put the password into a webform. Yes, you can copy the password to the clipboard, but allowing keepass to log you in is safer. Is it proof against all keyloggers? Hard to say, but it can defeat most at present.

              Now if you are speaking specifically about the keypass database, the keylogger would have to have physical access to that file and as with anything physical access trumps all.

          • by Algae_94 (2017070)
            I have a password manager in my head. I have one strong password that gets modified by my own algorithm. The modification is based on the site or service the password applies to. You only need to remember two things, the strong password and the algorithm to apply the modification to get the real password. For a simple example: If your strong password was "kittens" (obviously "kittens" is not strong, but it works for an example) and your algorithm was to simply concatenate the password and the name of t
        • I have 20+ login passwords between work and home, my security is lower because you have to simplify them to remember them

          Have you tried using LastPass? You only have to remember 1 secure password (as complex as you want it to be) and LastPass remembers the rest for you. It also significantly reduces time logging into sites by filling the logins for you. I use this every day and don't want to remember what life was like without it.

        • Re:Brilliant idea (Score:4, Interesting)

          by h4rr4r (612664) on Friday January 18, 2013 @02:35PM (#42627481)

          You have to simplify them?

          Use sentences. Easy to remember and very strong due to length.

        • I just use a mental algorithm to generate passwords based on time and thing. That way I can have new passwords at will that are consistent with a standard that only I know (and no, it's not just simple +1 number stepping). The only time I have problems is when my system is too long, like with classic VNC...
        • Re:Brilliant idea (Score:5, Insightful)

          by Anonymous Coward on Friday January 18, 2013 @02:48PM (#42627633)

          There sure are a lot of people responding to you to explain the convoluted acrobatics they do to manage their passwords.

          If nerds have to do a bunch of tricks just to give themselves a little faith in their passwords, what hope does everyone else have?

      • Re: (Score:2, Interesting)

        by bgarcia (33222)
        The worst feature of a password is that it can be obtained from you from someone located anywhere in the world, and you wouldn't necessarily realize it. Fishing websites and social engineering make passwords by themselves too easy to get around.

        You would still have a screen lock on your phone to prevent someone from using it to authenticate into all of your other accounts.

        • by Anonymous Coward
          Does Google want one authentication for everything, so that easier to identify everyone?

          Or, is the idea just some out-of-control childish thinkers at Google?
          • by 0123456 (636235)

            Does Google want one authentication for everything, so that easier to identify everyone?

            That was my assumption. Like Microsoft before them, they want to become the One Authentication System To Rule Them All.

            Because it certainly doesn't make sense if you actually care about security.

        • Re:Brilliant idea (Score:5, Interesting)

          by dkleinsc (563838) on Friday January 18, 2013 @02:26PM (#42627355) Homepage

          As you hint, passwords are both necessary and insufficient for real security. For anything important, you really ought to have 2/3 of the ID triangle: something you know (like a password), something you have (like an RSA token), or something you are (like fingerprints).

          • Re:Brilliant idea (Score:5, Interesting)

            by SirGarlon (845873) on Friday January 18, 2013 @02:39PM (#42627525)
            From the point of view of a digital stream of data, something you have is indistinguishable from something you are. (Fingerprint scanners are vulnerable to replay attacks.)
            • by dkleinsc (563838)

              Typically not, actually. Among other things, fingerprints are immutable, whereas the outputs from RSA tokens are constantly changing.

              In addition, generally speaking in order for biometrics to be relevant you need to be physically in the same location as the scanner. Which means you've already walked by human guards and a bunch of other people to get to whatever you're after. You're right that I can send any string of bits I want to your Ethernet port. Your USB port connected directly to whatever's controlli

    • Re:Brilliant idea (Score:4, Informative)

      by aahzmandius (52806) on Friday January 18, 2013 @02:07PM (#42627093)

      So have the phone de-auth after a certain amount of time without you entering your credentials. You'd still only have to remember credentials to one device, and then *it* does all of the 'heavy lifting' of authenticating everywhere else.

    • Your phone would be protected with a password silly! Oh wait, this seems like it would add complexity, and probably add passwords. It would also require all sites to majorly overhaul their authentication protocols. I'm guessing this is about as likely as happening as all websites accepting a fingerprint in raw form as a password.
      • Having a password manager which can automatically fill in your passwords, and which is protected by a fingerprint, is quite doable with modern hardware, however. Many laptops now have fingerprint readers built into them, and USB devices are readily available.

        In fact, software like that already exists... it's one of the options in the fingerprint software on my mother's laptop.

        • by 0123456 (636235)

          Having a password manager which can automatically fill in your passwords, and which is protected by a fingerprint, is quite doable with modern hardware, however.

          Because it would be so difficult for a thief to get my fingerprints, considering they'll be smeared all over the touchscreen. And the fingerprint scanner has to be lax to ensure it has a very low rate of false negatives. And, if the phone has effectively become worth many thousands of dollars because it provides access to my bank account, credit cards, etc, the bad guys can't just hack the Flash inside the phone to change the fingerprint data.

        • Having a password reader on your laptop that unlocks your other passwords is a security risk. The Feds can require you to input your fingerprint; ala taking your fingerprints. So they can make you unlock your device and everything else associated with it, no 4th/5th amendment issues at all.
      • by AmiMoJo (196126) *

        Fingerprints are a bad idea because they can't be revoked (well, okay, maybe they can 9 times, but then you are SOL unless you want to authenticate with a toe). A smartphone with a password, or better yet a ring like the describe, seems like a reasonable option and can easily be revoked.

        The same thing applies to your wallet and credit cards. A pain if you lose them and you need to act quickly to stop them being abused, but it is a reasonable trade off between convenience and security.

      • by blueg3 (192743)

        ...websites accepting a fingerprint in raw form as a password

        How would that even work? Put your finger on an ink pad, press it to a piece of paper, and mail it to them? Because otherwise it's not in its "raw" form.

    • Because I totally want anyone who steals my phone to be able to access every other site I use.

      Well given the popularity of the "remember by password" "feature" that is sort of where we are today on computers and mobile devices.

    • by zAPPzAPP (1207370)

      Just lock the phone with a password.

    • Re:Brilliant idea (Score:5, Informative)

      by kaiser423 (828989) on Friday January 18, 2013 @02:33PM (#42627447)

      It really is. I love their current implementation. It's actually security done right. I use Google Authenticator on my phone. If I login from an unknown computer, it asks me for a pass code also, which I just bring up on my phone. I only need to remember the password to my phone/tablet. It's easily the most seamless and secure two-factor authentication I've ever used, and I've used a lot of them....

      I also use it as a token to access a couple of other sites. I believe that Apache has a module that can sync to Authenticator. It's great two-factor.

      It also comes with a list of one time codes that I can carry around for when I don't have access to my phone or tablet.

      It's like a permanent key/password manager for all of Google. It'd be great to turn it into my whole life. Much easier to just de-sync the Authenticator, then re-sync rather than blow away passwords for all sites, then re-create them for all sites if something gets compromised.

      TL;DR I trust Google to do this right because they're already miles ahead of everyone else.

    • Common sense, FTW (Score:5, Informative)

      by Okian Warrior (537106) on Friday January 18, 2013 @02:44PM (#42627591) Homepage Journal

      Suppose you have a "smart" credit card in the form of one of those "credit card" calculators. Keypad + simple LCD display.

      When you use the card, you type a pin/password on the card, which then generates a new single-use credit card number which attaches to your account, encrypts it with your personal key, and sends it off when the card is swiped.

      If you lose your card, no one else has access since they don't have your PIN(*). No one can snoop the data since it's encrypted en-route. No one can copy your card since the information never leaves the card and anyway the number is single-use only.

      Suppose this same card is in the form of a thumb drive. It identifies as a security token, and will encode and decode on request, but will not under any circumstance let the keys out. All calculations are done on the device, the code is fixed and cannot be changed, and requires a PIN once when the computer boots.

      You don't have to worry about viruses or data leaks.

      Since it is a thumb drive, you can add public keys with abandon. To do business with any company, you send them a token encoded with your private key and their public key, they send you information using their private key and your public key. The card will require the operator to enter the PIN to store a new corporate key (for convenience). All the public keys for your credit cards, store cards, bank access, &c are stored in one place.

      Suppose the device is blue-tooth enabled. Now you don't need to hunt around for a USB port - you can enter your pin and hit "accept" when you want to make a purchase at a store - after the LCD display shows you the purchase price.

      If you lose your device you get a new one. Go to the bank, show identification, get a new card with the bank's keys on it. If the bank keeps a backup of your stored corporate keys, they can download the keys along with your new private key at their secure site.

      The important bit for all of this is a) the calculations are done on the device not an external computer, and b) storage for multiple corporate keys (visa, MC, Pennys, Wal-Mart, &c) in one device.

      This has been obvious for years, it's just one of those cases where the entrenched monopoly has no incentive to fix the problem.

      (*) Even assuming a thief can hack the physical card, it takes credit card theft away from "millions of cards were exposed by computer hack" to "lots of work required to hack a single card". And your bank will invalidate your old private key when the new card is issued.

  • by s.petry (762400) on Friday January 18, 2013 @02:07PM (#42627073)

    Every big company at some point has declared war on the password. We have smart cards, biometrics, RSA tokens, and finger paintings to prove it. None of those things work any better than a password when used alone. In conjunction with a password, we can achieve "better" security.

    The logic of a password-less world is what's broken. Period, end of statement. If the logic is broken, no matter who implements the password-less solution we still end up with a broken solution.

    • by ColdWetDog (752185) on Friday January 18, 2013 @02:10PM (#42627133) Homepage

      One phone to rule them all, One phone to find them,
      One phone to bring them all and in the darkness bind them
      In the Land of Google where the Shadows lie.

      Don't be evil!

      • by markdavis (642305)

        +1

        And of course it would be Google. Because, you know, we haven't handed enough of our information to Google (and other companies) already...

        Access to all your Email, all your contacts, your location, your calls, the apps you install, all your searches, all your comments on Google+, your research on Google Maps, your shopping, all your purchases with Google Wallet, tracking you with Adsense from millions of sites, storing your passwords in Google's browsers, recording your network passwords in your Android

      • by Nerdfest (867930)

        So , "a device-based authentication protocol that is 'independent of Google, requires no special software to work — aside from a web browser that supports the login standard — and which prevents web sites from using this technology to track users" is evil? Are you guys being paid for the anti-Google FUD, or did they kill your dog?

        • Sir, are you actually suggesting that we should read the fine article? If so, I'm ashamed of you.

          Not that I would believe Google (or anyone else for that matter) when something says they are 'independent'.

          • And further, now that I've been arsed to actually RTFA, your quotation, although clearly from TFA, is still at the handwavy, vapor stage.

            I will be very suspicious of Google's motives (and, for that matter anyone elses') until I can see the fine print and / or code.

      • I hope he's careful who he shows it to. It's his brother's birthday.

  • Tracking (Score:5, Insightful)

    by QuietLagoon (813062) on Friday January 18, 2013 @02:07PM (#42627083)

    ... Their plan involves authenticating just once, to a single device, and then using that to unlock all of your other accounts. ...

    That certainly makes it much, much easier for google to track you as you go around the web.

    • Re:Tracking (Score:5, Funny)

      by TheGratefulNet (143330) on Friday January 18, 2013 @02:21PM (#42627285)

      security principles for authentication:

      1) what you have
      2) what you are
      3) what you know

      for google:

      1) what you have: you have a tracking device that we'd like you to always have on and always transmit your location and other info to us.

      2) what you are: you are a source of marketing info to us, as well as other info we can give/sell to others.

      3) what you know: you are told that we are 'not evil' and we've repeated that so many time, you just KNOW its true.

    • "flamebait" - looks like I hit a nerve.
  • If repeated authentication through passwords, by their own words, "isn't sufficient to keep users safe", then why on earth do they figure that a SINGLE authentication would be sufficient?
    • Re: (Score:2, Interesting)

      Think of OpenID. You have one method of authentication, and you pay lots of attention to it to keep it safe! (Don't spread your eggs around different baskets, keep them all in one, and look after that basket!)

      Personally I already have a single device for all my passwords. It's called my computer. Most of my often used passwords are stored by Firefox (and protected by a master password), others are in a TrueCrypt file, less worthy of concern passwords are just stored in a note or two and saved.

  • Isn't there already biometrics for this? You cant forget your finger in the car, and nobody can discretely steal it. They could steal it with a pair of bolt cutters, but then you have much bigger issues.
    • Re:Biometrics (Score:5, Interesting)

      by Nerdfest (867930) on Friday January 18, 2013 @02:21PM (#42627267)

      You should always use 2 factor authentication, with biometrics and with what is being suggested here. You know, both something you can lose, and something you can forget.

      • by Daetrin (576516)
        For _real_ security you need three factor authentication. something you can forget, something you can lose (a finger, an eye) and something you can set on fire (keycard, phone, etc.)

        (Though if you're hardcore enough to set yourself on fire to prove a point we'll let you get away with two factor authentication. Mainly because if you're that crazy we'll agree to anything you say just to get you to go away quickly.)
  • by fredprado (2569351) on Friday January 18, 2013 @02:09PM (#42627117)
    Now I will have to give my full identity to any site that today requires just an e-mail account to register. An identity that will be the same I will use to make payments. What could go wrong with that?
    • Now I will have to give my full identity to any site that today requires just an e-mail account to register. An identity that will be the same I will use to make payments. What could go wrong with that?

      It wouldn't have to. As long as the device can verify that you really are the same Bozo123 today that they talked to yesterday, and verify to you that the clowncollage.com that you are logged into today is the same that you used yesterday, it would be sufficient. The device could easily allow Bozo123, Bozo222, and Bozo666 to have independent authentications.

      Of course if you link you Bozo123 account to your johnsmith@gmail.com account, then they can follow you.

  • Anonimity (Score:4, Insightful)

    by Anonymous Coward on Friday January 18, 2013 @02:09PM (#42627125)

    Passwords are bad because they allow any individual to create as many distinct accounts as he or she wants. Require a hardware device per account and you now need an investment for every distinct account. Google wants every user to be identifiable across all sites/services using the same ID.

  • The device would have to alert the use to each authentication and give the option to *not* authenticate to a particular site. I'm not sure relying on the host computer would be sufficient. The device may need it's own display and a few keys.
    And of course, it would have to have open software with open standards so that anyone could verify that it it working.
  • by Sydin (2598829) on Friday January 18, 2013 @02:19PM (#42627241)
    I really mean it: I don't want to have to login to the internet. You keep trying to get me to do it with Chrome, so I switched from that, but now you're going to badger me about this for my phone, too? Sometimes I want to surf anonymously. Sometimes I don't want Site X and Site Y knowing that I'm the same person logging into both. And I can say for certain that all the time, I don't want to be tracked by you so you can present me with more "targeted ads" to give me a better user experience. Let's not even get into what happens if my phone gets stolen, and suddenly all my consolidated information is at some stranger's fingertips. There are far, FAR too many problems with centralized authentication, and I'm really getting sick of Google trying to force it down my throat.
    • by nuggz (69912) on Friday January 18, 2013 @02:41PM (#42627553) Homepage

      Yeah those bastards should work on implementing some sort of incognito mode when you're on the internet.

    • You sound a bit suspicious to me, Citizen.

      May I see your passport, please?

    • Re: (Score:3, Insightful)

      So stop using Google Products. Seriously, if you don't like it change or stop complaining. You don't have to use Google, Chrome, Android or any other Google Product. You choose it.
    • Re: (Score:3, Informative)

      by AmiMoJo (196126) *

      I really mean it: I don't want to have to login to the internet. You keep trying to get me to do it with Chrome, so I switched from that

      You know it is literally one click and it won't bug you again, right?

      Sometimes I want to surf anonymously.

      And sometimes you want to authenticate yourself. Just don't authorize sites you don't trust to use your authentication, or enable private browsing mode.

      Sometimes I don't want Site X and Site Y knowing that I'm the same person logging into both.

      TFS mentions that Google's system makes this impossible.

      Let's not even get into what happens if my phone gets stolen, and suddenly all my consolidated information is at some stranger's fingertips.

      Just password protect the phone. That is the point - you have a single password for the phone that you don't use anywhere else. The unlocked phone is used for authentication, which is anonymous. The site doesn't get to track you with i

    • by brkello (642429)

      Ok, then google stops being viable as a company. You get all this stuff, for free, because google is an ad company and can make enough money doing that they don't need to charge you for its applications of services.

      Don't like it, don't use it.

  • Do not RTFA (Score:5, Informative)

    by Night64 (1175319) on Friday January 18, 2013 @02:20PM (#42627263)
    Would you all PLEASE do not RTFA this time? I cannot, for the love of God, read another whiny story about "I'm Matt Honan and I was fucked in the ass (metaforically speaking) by a 15 year old". And if this post get slashdotted, Wired will post another 100 stories about that. So please DNTRFA!
  • ...for the half or two thirds of us that don't carry, or want, a "smart" phone.

                      mark, not being tracked

  • Everything has a camera on it these days. Why not authenticate with your retina? Authenticate everything from an authenticate device as Google proposes but don't make the Android phone the centerpiece of authenticating everything.
    • Re:retina? (Score:4, Insightful)

      by jones_supa (887896) on Friday January 18, 2013 @04:11PM (#42628599)

      I'm not sure if the quality of many cameras is high enough for retina authentication*. Someone might also show a picture of your eye in front of the camera and thus gain access. I still find your idea interesting and would like to subscribe to your newsletter.

      *) Unless Apple comes up with Retina Camera ;)

  • From: Overlordian Technology Think Tank Staff Re: "embedded finger ring technology" Maybe now we have the right combination of convenience and social climate to get those sheep to consent to being chipped or at least bar-code-tattooed.
    • by dkleinsc (563838)

      It's not supposed to go in your finger, silly. The correct place for a bar code tattoo is on the right hand or on the forehead, as is described quite clearly in Revelations 14:9 [skepticsan...dbible.com].

  • We'd like your smartphone or smartcard-embedded finger ring to authorize a new computer via a tap on the computer, even in situations in which your phone might be without cellular connectivity."

    The smartcard can be embedded in the finger itself, instead of a ring on the finger. In fact it could be embedded anywhere in the body and it could be used identify you uniquely and track you. For your own safety and to provide for the completely unbreakable security, you would not be able to find the embedded smartcard yourself. (no, not even your ten year old son, who could build protocol droids from scrap parts, could build a scanner to find it). This is what the future is going to bring to us, it is a

  • Didn't RTFA, but it seems like Kerberos has solved a big chunk of this problem. Authenticate to your device once, pass encrypted tickets around that a) don't contain any portion of your password, and b) are cryptographically verifiable in an offline manner. A big problem I see with it is, who wants to manage that KDC and who would trust them?
  • by Umuri (897961) on Friday January 18, 2013 @02:29PM (#42627395)

    Relevant xkcd [xkcd.com]
    But seriously, how many times have you seen minimum (ok, can see a point here) or maximum (WTF) limits on a password length? Or requirements of what it can or cannot contain.

    Is there any reasonable excuse for why a password must not contain certain characters, besides breaking poorly made scripts? I mean password security 101 says they'll hash it anyway, so why should it matter?

    • by codemaster2b (901536) on Friday January 18, 2013 @03:05PM (#42627837)

      Yes there is a reasonable excuse why it must contain certain minimum lengths and characters. It has to do with exponents. For fun I've written several types of password hash crackers in the past. The best way to defeat a brute-force password cracker is to expand the keyspace.

      A good password today at a minimum 8 characters, and can consist of any one of 95 keypresses on the keyboard. 95^8 = 6.6e15 combinations.
      If you don't use special characters, that 8 character password is only 62^8 = 2.2^14 combinations.
      If you don't use numbers, that 8 character password is only 52^8 = 5.3^13 combinations.
      And If you don't even bother to change cases, that 8 character password is 26^8 = 2.1e11 combinations.

      Those numbers don't tell the real story. Old Windows XP passwords could be cracked on average 2011 hardware at about 10 million (1e7) combinations / second. The "good" password above would be cracked in 21 years (max). No special characters would be cracked in 8 months. No numbers in 2 months. And single-case only in 6 hours.

      But today we have GPU password cracking, and much better hardware. A Radeon 5770 could crack the "good password", 8 characters long in a mere 28 hours. That was hardware from 2 years ago.

  • Suppose we use our phones instead of individual passwords.

    From a technical side, what is to stop somebody from getting their own phone running numerous passwords through it while intercepting the key that comes out to determine the algorithm used. Once you have the algorithm, you can spoof other systems, can you not?

    From a user side, how is having a single password for my phone any more secure than using the same password on all the sites I visit?

    Finally, from a paranoid side, the US courts have already r

  • This amounts to a very standard issue these days. In the last of giant corporations worth spending millions of dollars and minutes to hack into, a password is insufficient. Good for you. For the rest of the world, you know, like when I'm accessing my registration to a telecom conference in June, a password is plenty fine. If anyone really wants to hack that conference's web-site, then they can change the name that appears on my badge, and could even cancel my registration -- something that the conferenc

  • DEAD finger ring.
  • by fahrbot-bot (874524) on Friday January 18, 2013 @02:52PM (#42627685)

    Once you're automatically logged into ALL your accounts at the same time, Google (and other sites) have a much wider pool of available data upon which to link and troll information about you. For example, have you checked your Twitter account settings recently? Twitter automatically tries to connect to your Facebook account - even if you don't have one, which I don't (that I know of anyway). (Damn Twitter panel just sits there with its icon swirling.)

    Personally, I prefer to only logon to sites as-needed.

  • by superdave80 (1226592) on Friday January 18, 2013 @02:54PM (#42627715)

    The article links to an example of a guy (Mat Honan) who had his accounts hacked into:

    http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ [wired.com]

    But as far as I can tell from reading that article, no password was every compromised. Most of the passwords were reset using other information (credit card numbers, billing address, etc.), and tricking clueless phone support people. So why use this example as a reason to get rid of passwords, when the passwords weren't really the problem in the first place?

  • by webdog314 (960286) on Friday January 18, 2013 @03:13PM (#42627929)

    I'm certainly no expert in the security of GPS/spoofing, but since so many of our devices have location services built in, couldn't we add *where* we are trying to gain access as a relevant factor? Perhaps the security system could ask for a mere simple password if it sees that you are currently at home, and requires secondary authentication (RSA fob, Goggle Auth, etc.) someplace you haven't been before. Most people who have stolen your credentials aren't going to log in from your house (short of your own kids, but if that happens, you have bigger problems).

  • 1998 called... (Score:4, Interesting)

    by mmontour (2208) <mail@mmontour.net> on Friday January 18, 2013 @04:13PM (#42628619)

    Dallas Semiconductor once had a product called the "Crypto iButton", a small Java CPU + a hardware RSA engine and tamper-resistant memory. With appropriate plugins you could set it up as a security device in your browser and then authenticate remotely using SSL client certificates (with the private key never leaving the iButton).

    http://people.cs.uchicago.edu/~dinoj/smartcard/javaring.html [uchicago.edu]

  • by pezpunk (205653) on Friday January 18, 2013 @06:30PM (#42629953) Homepage

    "It was an Ident-i-Eeze, and was a very naughty and silly thing for Harl to have lying around in his wallet, though it was perfectly understandable. There were so many different ways in which you were required to provide absolute proof of your identity these days that life could easily become extremely tiresome just from that factor alone, never mind the deeper existential problems of trying to function as a coherent consciousness in an epistemologically ambiguous physical universe. Just look at cash point machines, for instance. Queues of people standing around waiting to have their fingerprints read, their retinas scanned, bits of skin scraped from the nape of the neck and undergoing instant (or nearly instant --- a good six or seven seconds in tedious reality) genetic analysis, then having to answer trick questions about members of their family they didn't even remember they had, and about their recorded preferences for tablecloth colours. And that was just to get a bit of spare cash for the weekend. If you were trying to raise a loan for a jetcar, sign a missile treaty or pay an entire restaurant bill things could get really trying.

    Hence the Ident-i-Eeze. This encoded every single piece of information about you, your body and your life into one all- purpose machine-readable card that you could then carry around in your wallet, and therefore represented technology's greatest triumph to date over both itself and plain common sense."

    Ford promptly knocks Harl unconscious and steals his ident-i-eeze, which he then uses to gain access to the Hitchhiker's main corporate accounts computer system.

The shortest distance between two points is under construction. -- Noelie Alito

Working...