Thinking beyond passwords

Question

I was having a discussion with a co-worker earlier this morning related to passwords and the future of computing. One of the topics we discussed was whether passwords could be replaced with visual or interactive security measures and whether users would adopt this kind of security.

Take cellphones for example: the iPhone uses a 4 digit numeric passcode and the T-Mobile G1 uses a specific finger swipe to access the phone when locked.

I've heard and read about security tools that rely on someone visually identifying something and picking it out of a group to authentic who they are; PassFaces is a great example of this, but how safe is it? There are 9 options to chose from; either they are constantly changing (with the exception of the correct answer) which would eventual single out of the correct choice or they are always same but in that case only 8 wrong answers would be necessary to determine the correct selection. (This is definitely a simplification of their tool.)

SO is a collection of bright minds and I've love to hear your views on visual passcodes.

Do you think users would be willing to accept visual passcodes in a web environment? What do you feel are some of the Pros and Cons?

Answer 1

Multi-factor authentication provides more secuity than any single replacement for passwords. By combining multiple authentication methods (login name, password, token, pass phrase, biometrics), you increase the security exponentially.

An example is PhoneFactor, whcih uses tokenless two-factor authentication by calling a predetermined phone number (as in your cell phone) when you have successfully passed credentials. This way, if your password is compromised, the attacker still needs to physically possess your phone (which could be behind your locked office door) in order to complete the authentication.

Phone factor can also be set up to use a pin, so when they call you you must also enter the pin to confirm.

Answer 2

Biometrics have potential but can be defeated and don't work in some environments. For example we tried fingerprint authentication for a timesheet system in a fast food joint only to discover that greasy fingers had trouble with the scanner. Maybe facial recognition and retinal scans however...

Certificate authentication works good if you exclusively use a computer and need to authenticate to others. As long as the private key remains on just your computer that can work too...

Passfaces in my opinion is no better than a combination lock, given enough time and patience I'll brute force it by myself and crack you....either that or if I have access to the password store I can make it even quicker with a computer assisted brute-force crack. Overall I'm unimpressed....

EDIT: To respond to comment, I don't see how a visual system such as passfaces could be more secure short of tandeming with another method (password, certificate, etc.). In fact it worries me because of the human element granted granted an illicit user may know the same faces you do (for example you picked celebrities or you picked family members and the thief knows you, etc.).

Answer 3

Well, my person experience is that the technology isn't really ready yet...

I got a laptop with a fingerprint sensor a while back. I installed the software for the sensor and tried to use it. The result was that 75% of the time the sensor didn't start when I started the computer, so to log in I had to click several times, then type my user name and password to log in.

It was so irritating that the login that was supposed to be simpler most of the time just got more complicated instead, so when I reinstalled the laptop recently I didn't install the fingerprint sensor software again.

I might try it again later on when the software and hardware is more reliable...

Answer 4

Maybe webcam facial recognition? Most laptops have them pointed right at your face anyway, might as well make some use out of it. Also this could be used to lock the computer when your face is no longer detected for x minutes. When registering for a new site they could ask you for a snapshot of your face from your webcam, store that in the database rather than a password, and check against it for logging in. Im sure the cameras in laptops need to get far better before this could work seamlessly, and hopefully be able to differentiate between your face and a piece of paper with a picture of your face on it, perhaps include a facial jesture of some sort.

Although i do think it would be far better if coupled with a certificate of some sort. Maybe have one government CA, or each ISP has a CA, that hands out a certificate and key's to everyone who wants to use the internet, and your computer is tied to those keys and then to you. If you wanted to surf the internet form another computer you would have to recover your keys from said CA (so you would need one super strong password you would have to remember). Although we should all have our own computer some time soon, so this may not be that big a problem. Each site would then verify and tie your online identity to the ceritifacate or private key on your computer. (this would also make encrypting and sending documents to people much easier as everyone would have a public and private key).

Answer 5

Some systems today rely on smart cards for authorizations. They basically has a RFID tag embedded in them that can be read by the computer.

At some point we will end up with the RFID, or its successor, embedded in us. We already do it with dogs and cats. I also read about a resort in Europe where people can op to have a tag implanted in their forearm with credit card info. It seemed that the skimpy swimwear most people wore didn't have a pocket large enough for a credit card.

Answer 6

Biometrics are certainly one way of doing security, but I'm always concerned about this. For instance if your password is compromised you can change it, but if your fingerprint is compromised what do you do?

I like the secureId approach (number on a token changes every 30 seconds) or perhaps using a cellphone (like CallVerified, phones you when you want to log in), or perhaps using a small RFID either in your pocket or under your skin.