Bill Gates Proclaims End of Passwords

KrazyK writes "Bill Gates has just proclaimed the end of passwords. There's only one drawback - you have to use .Net (well, what else would you expect?). However, the smart card that is at the centre of it - made by Axalto - is still a great bit of technology. How long before we can get an open-source version of this?"

Comments

hard and soft

[mirko]

So, years ago, Bill Gates proclaimed the software was better, now he gets back to some hardware key...
But what about biometrics ?

Re:hard and soft

[judmarc]

Think about this before assuming biometrics is the answer:

• If someone steals an impression or picture of your fingerprint
• If someone hacks the database linking your fingerprint or eyescan to your access authorizations for bank accounts, work, etc.

- then how do you get your identity back?

Re:hard and soft

[darth_linux]

Bill's right, though. He knows if you use M$ products you don't need passwords. You'll still get 0wn3d.

Re:hard and soft

[lukewarmfusion]

This has been discussed many times. Biometrics are not a reliable way of handling security. Once compromised (and they can be compromised!) you're left with a "password" you cannot change.

When used in conjunction with other security mechanisms, such as hardware smartcards, passwords, etc. then you've got a much better chance. For the basic user, biometric identification is probably OK. But you wouldn't want to rely on that for anything "secure."

Re:hard and soft

[mirko]

The same applies for a smartcard, doesn't it ?
And I thinka fingerprint could withstand the consequences of the EMP effect (if not, this means the user has been terminated so it's not a tragedy either... erm... ok, this is).

Re:hard and soft

[judmarc]

The same applies for a smartcard, doesn't it ?

Heh, absolutely. :-)

Until they learn to read your mind (or find that paper where you've written them all down), at least passwords force someone to take minor electronic trouble to crack your security.

Re:hard and soft

[cob666]

What about a combination of the two (Hardware AND passwords?) - much like the way an ATM card works. You have an ID card and a PIN, they only work in conjunction with each other.

I slip my card into the slot in the keyboard and then type in my PIN - voila - I have just logged in!

Re:hard and soft

[Anonymous Coward]

No no... Bill is right, we might as well stop using them because windows has so many sniffing and snorting exploits floating about that he has decided to invent the concept of freedom of information! All your base are now everyones!

Re:hard and soft

[platos_beard]

No it doesn't apply to a smart card. You can get a new smartcard and disable the old one a lot easier than you can get a new fingerprint or other biometric.

Re:hard and soft

[wertarbyte]

The same applies for a smartcard, doesn't it ?

No, it doesn't. If your smart card gets compromised, destroy it and get a new card with a new key. If someone manages to steal your fingerprint, you cannot change the media or key you authenticate with: The person did not only steal a material token that is linked to your identity, an unchangable characteristic that should be uniquely assigned to you now is not referring only to your person, someone literally stole your identity; To the ATM machine, he's not only the one in posession of your ATM card anymore: He is you.

Re:hard and soft

[swordboy]

Except, in many cases, "0wn3d" will mean that someone cuts off your thumb. That's a pleasant thought. But it is better than retinal theft, I guess.

Re:hard and soft

[Oddly_Drac]

"Think about this before assuming biometrics is the answer:"

Even simpler. Biometrics is a layer on top of authentication that simply authenticates the key supplied by the biometrics. Even keycard access can be backed by pin number to authenticate that the holder of the card is who the card proclaims them to be.

The actual authentication is going to be a communication of ID to a server on a challenge/response basis; sidestepping the biometric step and cracking directly is likely to be a lot easier because of the _ASSUMPTION_ of security.

Re:hard and soft

[Kjella]

I never figured out why you can't use the same system as you do with passwords. Password, hash and *drumroll* salt. No, not NaCl, crypthographic salt.

If compromised, get a new device with a new salt. It is basicly like a new identity (you'd have to revalidate with every authentication you had). If the perp just got your salted code, it is worthless. If he got your fingerprint, he still needs to get your new device to get a valid biometric/salt *pair*.

Now top it off with a PIN, and you have the holy grail. Something you are, something you have, something you know. Use any subset which is enough. In most cases, what you are/have (fingerprint/salt) should be enough. It'd certainly raise the bar another notch or two.

Kjella

Re:hard and soft

[xanadu-xtroot.com]

If someone steals an impression or picture of your fingerprint

OK, long story short, I'm a Network Administrator (sysop, Computer Geek, Asshole, and/or whatever else name(s) we get called in the office...). Currently I'm working in he Photo/Electronics department of the local K-Mart (again, long story... thanx W...). I process 80 or so rolls of film every day. I'm sure my finger print has ended up on some of those...

Just a word to the wise...

Re:hard and soft

[mikechant]

If someone manages to steal your fingerprint, you cannot change the media or key you authenticate with

Easy, just have your hands amputated and replaced with those from a fresh corpse, and have their identity record updated with your details.
But make sure the hands didn't belong to a strangling serial killer...

Re:hard and soft

[JavaLord]

Except, in many cases, "0wn3d" will mean that someone cuts off your thumb. That's a pleasant thought.

So in Saudi Arabia, if you are caught stealing you will lose your password too! Or do they let you keep your hands after they cut them off?

Re:hard and soft

[Badfysh]

or find that paper where you've written them all down

NEVER stick your password post-it on the monitor! It goes under the keyboard...

Re:hard and soft

[LemonFire]

So you're basically trying to tell me that Bill Gates are wrong about putting all of your eggs into one basket?
You can't make an omelette without cracking eggs!

You must be mistaken Sir, but how can that much money be wrong?

-- Access to this SIG requires a bio-metric scan!

Re:hard and soft

[Anonymous Coward]

Clearly, both smart cards and biometrics have disadvantages. If your smart card gets stolen by some thief reach into your back pocket, you're pretty much ownzored, end of story. Biometric data on the other hand is harder to steal (aka if you have to worry about the old cut off hands for the door scanner problem, you have bigger problems than just rotating passwords...), but once stolen STAY stolen.

Clearly, the solution is to combine elements of both. How about a combination unit that uses my biometric data to unlock stored, encrypted, highly random passwords? It doesn't make sense to use the same password on two different sites anyway-- for example, if Bob's Discount Electronics.com gets hacked, I don't want my password there to be the same as the password to my bank account. But it would be easier to have a device store a bunch of randomly generated passwords than to try to remember them myself. However, this device is now the weakest link, and if stolen can seriously compromise my security. A good idea is to have a biometric key encrypting all the random passwords on the smart card, so that if its stolen, it will take the thieves a little more time to unlock my old passwords. In the mean time, I can change all the passwords on my millions of websites, buy a new device, and have that store my new passwords. As long as the devices only accept local input, the security risk is minimized, even though the thief now has my biometrics, because the thief must still get physical access to the new card.

Is it a perfect system? No, but hey, security never is. Anything that has a door can be broken into, it's just a matter of how big a battering ram you want to make your opponent use.

Re:hard and soft

[Anonymous Coward]

If someone hacks the database linking your fingerprint or eyescan to your access authorizations for bank accounts, work, etc.

I'm not trying to be mean, and your first argument was quite valid, but this is one of the most ridiculous things I have seen here in a while. It's like saying that key locks aren't good because somebody could break into your house and replace the lock with one they had the key for.

If somebody finds a way around your key lock and gets in (say through a window), they are just going to take what they want and leave. They aren't going to replace the key lock and then go back in through the front door. In the same vein, if somebody is able to hack the machine that authenticates in such a way that they can actually replace biometric data and allow themselves to log in as you... wait, they are already logged in as superuser at this point. See what I'm saying?

You are arguing that if somebody could break in to the machine in a way that doesn't involve a flaw in biometrics, that they could then break the biometric authentication. That is not a flaw in biometrics.

Re:hard and soft

[sporty]

Or like me, someone who has a cut on their thumb that left a scar on their thumb. If this was during usage of a biometric system, I've just lost my password!

Re:hard and soft

[ThaReetLad]

I don't think so. It looks like the card has a built in MSIL interpreter and does encryption actually on the card. The point being that you can create an encrypted connection from the card to the verification server so the clear text is never available to the client PC. This makes it very difficult to read the information off the card and duplicate it, because the card will attempt to verify the server before giving up it secrets.

Re:hard and soft

[charleste]

Has anyone else made the association between biometrics and the Kurt Vonnegut story about the lady who is afraid of having her hands cut off, because she puts her prints on each official letter giving instructions for the Ramjack Corp? Or the retina of the "warden" in Demolition Man? Hmmmm. Perhaps I don't want biometric data associated as my "password"...

Re:hard and soft

[bushidocoder]

You can't perform challenge response algorythms with biometrics. At the end of the day, the secret has to be processed on the machine and is subject to being intercepted or sniffed using that technology.

Smart cards are great because there is no secret sharing. Once an encrypted connection is set up, the challenge is sent to the smart card, which returns the response. Malware on the machine can pick out the exact response to the specific challenge, but the challenge should be unique, and therefor storing the response is useless. Malware would be completely unable to ever retrieve the secret private key neccesary for generating valid responses.

Re:hard and soft

[Anonymous Coward]

Under? I pulled my keyboard apart and put it inside.

Re:hard and soft

[Martigan80]

If someone steals an impression or picture of your fingerprint

Hey don't forget that many of the finger print machines also detect if the right body temp is there too.

Re:hard and soft

[Anonymous Coward]

bypassing fingerprint biometrics is easy. Hasn't anybody ever watched macgyver?

Re:hard and soft

[Raptor CK]

1) Good luck. Any decent biometric scanners fail if there's no bloodflow through the finger.
2) What if someone hacks the database with your password in it right now?

Biometrics, key cards, or password, they all suck, but in different ways. That's what two factor authentication is for.

Insert keycard, then scan your thumb. I'd still include a password as a third mechanism to update either of the other two as needed, assuming you scar your thumb, or lose your keycard.

Or keep a master keycard and a secondary scan, like an iris scan for that purpose. Suffice it to say, it's fairly complicated to do these things right.

Re:hard and soft

[citog]

This is just an idea that occurred to me (so don't flame too hard!). I use some systems where I have a 6 digit numerical pin and the login process asks for 3 numerical digits randomly. How about taking your 10 digits during the signup process and asking for a selection of finger swipes when authenticating? The number could be varied and you could opt to exclude an injured finger. Maybe that last part introduces some weakness so that you need an additional challenge in the process.

Re:hard and soft

[qw(name)]

That's the way I set up Sun smart cards. The user inserts the smart card, types a password for the card and then authenticates as a user on the network. No big deal.

Re:hard and soft

[Marxist Hacker 42]

So the key is to steal the smart card, kill the owner, hide the body, and then infiltrate with no problem because nobody has reported the smart card to be missing.

Without a pin number, all this means is that Bill Gates has now offered open season on Microsoft Employees.

Re:hard and soft

[petersam]

The real benefit from Biometrics come not from storing your retina template on some authentication server but rather from using them to protect the secrets on your smart card. Now I don't think the Axalto system has it, but you could probably cobble one together that uses your fingerprint or retina scan or something else to unlock your smart card and give you access to your private key and certificate that's used for secure authentication (Kerberos or SSL style) onto the network. So you can use a fingerprint in a secure manner to enhance the security of a smart card. It's better than a PIN.

Re:hard and soft

[CrackHappy]

I think it's stupid to rely on a single method of authentication.

Multiple and concurrent authentication systems can be used.

i.e.
1) Biometrics + smartcards
2) Biometrics + passwords
3) smartcards + passwords

Any of those three should provide a good level of security without too much extra effort.

Re:hard and soft

[SamSim]

"Now, nobody goes away empty-handed, because we're gonna cut your hands off!" ~ Eddie Izzard

Re:hard and soft

[JoshNorton]

So in Saudi Arabia, if you are caught stealing you will lose your password too! Or do they let you keep your hands after they cut them off?

And you'd carry them back ... how?

Re:hard and soft

[cHALiTO]

No need, serious biometric solutions aren't affected by scars, as they rely on minutiae, not image comparison. And scars are easily recognized during the minutiae extraction.
Normally access control systmes ask for two fingers (ie. both indexes) for authentication/identification, so problems about bandaged/amputated fingers are reduced.

It's kind of hard to fool fingerprint recognition systems. Yeah, we all heard about the guy with the jelly made print, but i have yet to see that work in any real case. For instance, you can't leave a false print on a crime scene with that (experts can tell easily if it comes from a live finger or a bit of plastic), and it won't be easy to put the jelly finger on the print scanner without anyone noticing. And even then that doesn't mean you lost your identity. Your print is yours, you just need to show your finger to prove it, and you're the only person who can do that.

Re:hard and soft

[MHobbit]

Exactly. With passwords, you can change them when someone figures it out, but with biometrics, you'd have to alter your own fingerprint to change the passcode used!

Re:hard and soft

[Anonymous Coward]

The problem is not about what cryptography is used, it is about *where* it is used. As long as the scanner is an intrinsic part of the authentication device (eg. smart card) then this can be done. If the scanner is 'untrusted' then it's all over before it starts and no amount of cryptography is going to help.

Re:hard and soft

[judmarc]

this is one of the most ridiculous things I have seen here in a while. It's like saying that key locks aren't good because somebody could break into your house and replace the lock with one they had the key for.

Errm, no. It's more like someone breaking in to your house and stealing all your ID documents, then replacing any photos, height and weight data, etc., with their own, and then not leaving, but instead proceeding to live in your house, drive your car, etc., and there's nothing you can do to convince anyone to help you, because as far as the world is concerned, they are you.

wait, they are already logged in as superuser at this point. See what I'm saying?

Yes, I know exactly what you're saying. Your imagination is too limited. This is no electronic equivalent of a purse-snatching we're talking about. Google for stories under "identity theft" and extrapolate....

Re:hard and soft

[Anonymous Coward]

He said:
"Moving to biometric[s]... is a wave that is coming, and we see our leading customers doing this."
You don't have to use .Net to get rid of all of yuor passwords. You could buy biometric devices from zillions of vendors, not just Micro$oft.

Re:hard and soft

[mdfst13]

"How about a combination unit that uses my biometric data to unlock stored, encrypted, highly random passwords?"

This was my thought as well. Have the *smart card* data locked to your biometrics. Then, you are the only one who can use your smart card, even if stolen. If they steal your biometrics (which you may not know), they can only use them to unlock your smart card. If your smart card is stolen (you should be able to miss it), cancel it.

You can even increase security by adding a single access password to this. Then, they need to steal smart card, biometrics, *and* password. So long as the password and biometric are entered directly into the smart card, this should be very secure. Plus cancellable in the case of compromise.

Re:hard and soft

[TheMeddler]

I always put mine on the sun-visor, next to my car keys. Makes it easier for the action heros to find when they steal my car...

Re:hard and soft

[mdfst13]

"Your print is yours, you just need to show your finger to prove it, and you're the only person who can do that."

This is why biometrics are fine as a second level defense at places where the primary defense is a guard standing there (who should be able to recognize you). However, it is useless at places where authentication is anonymous otherwise: for example, at an ATM or a gas station (stolen credit cards are often used for the purchase of fuel for exactly this reason). Yes, you would still be able to go in to the bank or to the attendant (if the gas station has one; I've used corporate stations that did not; further, I've heard that they are common in high minimum wage countries) to authenticate, but you would lose the convenience of the ATM or pay at the pump fueling.

Re:hard and soft

[cHALiTO]

The best way to implement biometrics in those cases is as you say, as a second level defense. That is, to authenticate your fingerprint with the one encoded in the credit card. Of course, there will be ways to fool this (there is always a way, /.ers should know that by now), but itd make it even harder than it is now, which is the goal.

Re:hard and soft

[wertarbyte]

So you can use a fingerprint in a secure manner to enhance the security of a smart card. It's better than a PIN.

So when my retina scan or fingerprint is compromised, I can no longer lock a smartcard with it?

Re:hard and soft

[petersam]

So when my retina scan or fingerprint is compromised, I can no longer lock a smartcard with it?

Ugh! I guess I needed to be clearer. While the technology on the smart cards is still maturing, generally you're depending on a trusted path between the biometric reader to the smart card. Implemented correctly with appropriately sensitive hardware, there's nothing to "compromise". For example, the better fingerprint readers are not susceptible to the gelatin mold trick, etc. So with a tamper resistant device that combines the reader with the smart card, you can be assured that only "something you are" unlocks the "something you have" smart card.

That said, the Axalto solution at Microsoft is not protected with biometrics but rather with a PIN. But that's not the tangent we're on here, is it. :-)

Re:hard and soft

[jbfields3]

Some fingerprint readers use ultra sound to read the ridges inside the skin. Iris scan is probably a better biometric, anyway. It is based on 3D samples of the iris and the iris deteriates within seconds of death. Addition of a PIN pretty much makes the smark card unusable to others, anyway.

Re:hard and soft

[Anonymous Coward]

*Decent* thumb scanners actually check the density of your finger, so they'd have to do some pretty fancy stuff to copy that, too.

Hmmmm....

[keeleysam]

This has been in Mac OS for awhile... as Keychains... mine is on my USB thumb drive...

Re:Hmmmm....

[Anonymous Coward]

Smart cards have been everywhere for a while. And a thumb drive is a pretty dumb smart card.

What they seem to be talking about that makes this special, or news, is the degree of abstraction possible. Where eventually you can apply security policies to physical objects as easily as you can apply them to objects in a network.

Re:Hmmmm....

[Anonymous Coward]

What they seem to be talking about that makes this special, or news, is the degree of abstraction possible. Where eventually you can apply security policies to physical objects as easily as you can apply them to objects in a network.

So it's just a Java Card then?

Re:Hmmmm....

[isaaccp]

Also available in Linux, check the USB PAM module: http://lists.debian.org/debian-mentors/2004/02/msg 00143.html

Re:Hmmmm....

[peterprior]

Aye. pam-usb and a gpg key on a usb stick is always a nice way to authenticate in Linux

Re:Hmmmm....

[Anonymous Coward]

Same idea, but those aren't built with "active directory" in mind. Not that they couldn't be made to function with it, and Sun's java card enterprise product may well do such a thing (one could certainly read it that way). Given the time lines for the various products, I'd say the hullaballoo isn't a coincidence.

Re:Hmmmm....

[bojanb]

If I understood the article correctly, it runs an embedded version of .Net, whatever that means. So I guess it would make it just the opposite of JavaCard - a .NetCard.

Microsoft is actually the only customer they have so far, according to the article.

Re:Hmmmm....

[Naikrovek]

yeah, i thought that's why they were called usb KEYs... I think they were originally designed just for this purpose. my first USB key was 64kb (kilobytes) and held only an encryption key.

Smart cards provide the exact same functionality as my very first usb key.

Re:Hmmmm....

[pesc]

This has been in Mac OS for awhile... as Keychains... mine is on my USB thumb drive...

Absolutely not. A smart card is nothing like an USB drive where you store a password or cryptographic key.

A smart card contains a closed microprocessor and a small memory. The point is that you cannot get at the contents of the memory at all (unless you have a silicon lab). The microprocessor has a private key that it never shows outside the silicon and a public key that the PC knows about. The smart card can prove its identity by signing stuff the PC sends to it using the secret private key.

Smart cards have been around for a long time. They are not a M$ invention and I'm sure that there are open-source drivers that can talk to smart cards.

Re:Hmmmm....

[Sesticulus]

You mean you actually got keychains to work in OSX? Everytime I go to the same resource on my network I check the little remember in keychain option...and everytime, it forgets. As far as I can tell keychain doesn't actually work.

Re:Hmmmm....

[goatan]

Is it me or has just about everything new MS have announced recently already been in Mac OS or Linux?

Re:Hmmmm....

[freeweed]

I just figured it was because almost all models are designed to be attached to keychains...

Re:Hmmmm....

[Tony Hoyle]

Hey cool...

I know this is probably the wrong place to ask, but has anyone developed a Windows version of this? (the cheapest Win compatibile smartcard I've seen on sale is around the $500 mark, which is way more than I'm prepared to spend).

Re:Hmmmm....

[Stevyn]

64 kb is all you really need anyway. What do people do with 1Gb drives?

Re:Hmmmm....

[Anonymous Coward]

Java version is available. Worked on a project using smartcards for payments on traintickets.

Re:Hmmmm....

[SmegTheLight]

The point is that you cannot get at the contents of the memory at all (unless you have a silicon lab)

Yeah, that's the theory, but not the practice

Mess with the voltage, current flow, etc. and sooner or later you will be able to get it to glitch, and before you know it your walking around the memory map.

Since this is based on MS Code, their sleep deprived contract slave programmers have probably fscked something up, and you will be able to get in just by sending a carefully crafted datastream to sign.

Steal your USB Stick, steal your Smart Card, steal your thumb.. Pfft..

The only worthwhile info from this newsbyte is the plethora of things you probably can't do with .NET anymore because of the numerous bogus patents filed related to this device.

Re:Hmmmm....

[Anonymous Coward]

I don't know about you, but I store 16,777,216 encryption keys on my 1GB keychain.

Hitchhikers?

[forgotten_my_nick]

Wasn't there a system in hitchhikers that meant you didn't require a password?

I'm so happy!

[beaststwo]

I always had trouble remembering the damn thing anyway. Now that I don't have to type it anymore, my life is complete.

Re:I'm so happy!

[beaststwo]

Another point: Since the smart card will obviously be able to absolutely identify my as myself, and since obviously nobody else could impersonate me, I'll always be myself.

What a relief! I'm always concerned about whether or not I'm myself on any given day.

So now instead of torturing me...

[SoTuA]

... to get me to confess my password, all they have to do is get my wallet?

Nice!

Re:So now instead of torturing me...

[Trurl's Machine]

... to get me to confess my password, all they have to do is get my wallet?

Enjoy before you upgrade to biometricks. Then all they have to do is to cut your finger or your eyeballs.

Re:So now instead of torturing me...

[spuke4000]

I don't know about this implementation, but typically the key on the smart card is password protected. Thus you have to have the card AND know the password. This is why they call it two-factor authentication.

Re:So now instead of torturing me...

[Xpilot]

Ha! I'll use something nonobvious...like penis length. Oh wait, then they'd cut of....NOOOOO...

That's brilliant. It doesn't work when cut off :)

Re:So now instead of torturing me...

[afd8856]

Yeah, but imagine the login screen :)

Re:So now instead of torturing me...

[Brandan]

"I'll use something nonobvious...like penis length."

I would use that but, you see, I just replied to this message in my inbox and in 90 days guaranteed my penis will increase by 3 - 6 inches and I will be locked out.

Re:So now instead of torturing me...

[GreyPoopon]

Ha! I'll use something nonobvious...like penis length. Oh wait, then they'd cut of....NOOOOO...

That's brilliant. It doesn't work when cut off :)

I could just see the cartoon on this one. The caption would read: "Bill discovers that since the new secretary started, he is no longer able to log in to his account."

Re:So now instead of torturing me...

[maxwell demon]

But how will women log in?

Re:So now instead of torturing me...

[Anonymous Coward]

Enjoy before you upgrade to biometricks. Then all they have to do is to cut your finger or your eyeballs.

I see no problem with that. We have ten fingers and two eyeballs. You only have to start making more dramatic sacrifices when you start running out of fingers and eyeballs.

Re:So now instead of torturing me...

[wertarbyte]

But how will women log in?

Make the variable signed.

Re:So now instead of torturing me...

[Taladar]

That's brilliant. Authentication and the death of one of the most "popular" types of spam all at the same time. You just have to tell them they can't enlarge their penis for security reasons and thus can't answer to this type of spam.

Re:So now instead of torturing me...

[AviLazar]

hehe, computers are MAN's best friend :D

Re:So now instead of torturing me...

[swordboy]

So "hacking" biometrics might truly involve "hacking".

Re:So now instead of torturing me...

[Anonymous Coward]

I'll use something nonobvious...like penis length.

So now you have to work on getting it up not only for sex but also when you want to check email?! Poor willy!

Re:So now instead of torturing me...

[Red Alastor]

And instead of remembering what my password is, I will have to remember where I left my smart card.

Re:So now instead of torturing me...

[Anonymous Coward]

Of course they do... as many as they want.

Re:So now instead of torturing me...

[izomiac]

Yeah, but but what do you do when your computer complains that your "password" isn't long enough? Ask this guy for help?

Re:So now instead of torturing me...

[goatan]

the clit is just a very very small underdeveloped penis.

Re:So now instead of torturing me...

[tbmaddux]

... to get me to confess my password, all they have to do is get my wallet?

How about a nice piece of chocolate instead?

Re:So now instead of torturing me...

[cduffy]

GPG keys can be password-protected.

Re:So now instead of torturing me...

[bobsledbob]

bah hah hah. thanks... ;)

Re:So now instead of torturing me...

[SoTuA]

This is why they call it two-factor authentication.

Of course, a good secutiry practice would be to require the card AND a password.

But, as it reads in TFA, Gates is trumpeting "death of the password", so I somehow don't see them using passwords with the cards. An alternative could be that Gates was using marketingspeak :)

Re:So now instead of torturing me...

[Zangief]

What? no more torture!!! What happened to the classics!

Ximinez [with a cruel leer]: Now -- you will stay in the Comfy Chair until lunch time, with only a cup of coffee at eleven. [aside, to Biggles] Is that really all it is?
Biggles: Yes, lord.
Ximinez: I see. I suppose we make it worse by shouting a lot, do we? Confess, woman. Confess! Confess! Confess! Confess
Biggles: I confess!
Ximinez: Not you!
--
Wiki de Ciencia Ficcion y Fantasia

Re:So now instead of torturing me...

[sadiklis]

all they have to do is get my wallet

As if 90% of users do not keep notes with their passwords in their wallets.

Notice that pulling out passwords out of cards is a bit more difficult than taking a look to the said notes.

Re:So now instead of torturing me...

[Anonymous Coward]

You just made my day. :D :D

Re:So now instead of torturing me...

[brad3378]

I heard that Mrs. Bobbit got caught using her husband's password.

wooo

[Anonymous Coward]

Smart cards aren't new

News?

[tuomasr]

This doesn't sound like anything really new to me, I remember logging on to my W2K workstation with a smart card in 2001 if I remember correctly, what's new here (the techworld article didn't want to respond to me so I can't RTFA)?

Re:News?

[tb3]

That's nothing. I had to use a smartcard to get into my place of work in 1987! The damn things have been around for years, They're a solution in search of a problem.

Re:News?

[bgat]

The "new" bit is that the smart card has a .NET interpreter, rather than an 8051/PIC/AVR/? microprocessor running a documented, proprietary, standards-based, stable OS or even Java. Embrace and extend.

Re:News?

[dagur]

And whats the difference between microsofts great new smart card technology and sunray cards ?

Re:News?

[khrtt]

standards-based, stable OS

What OS? Smartcard doesn't need an OS, or an interpreter, or any shit like that. All it needs is an implementation of the authentication and communications protocols, nothing more, nothing less. Then again, Billy's shop has been known to overdesign stuff before. By, like, a factor of 10, maybe. I've written some Windows drivers where for 500 lines of functional code there is 5000 lines of code that has the single function of coping with the API. Now they've stuck a CLR on a smart card - what a great achievement of technology - it would be more appropriate stuck up their arse.

Re:News?

[Seft]

You can log on to Win 2k and XP Pro workstations using a smart card.

Re:News?

[shotfeel]

Answer: The names on the royalty/licensing checks.

Re:News?

[Ytsejam-03]

That's nothing. I had to use a smartcard to get into my place of work in 1987! The damn things have been around for years, They're a solution in search of a problem.

Smart Cards are not the same as proximity cards. Prox cards are very simple devices that are constantly brodcasting an ID number. With the right software, anyone can wave a prox card in front of a card reader and see which number the card is broadcasting.

Smart carts actually contain a microprocessor, and typically store an X.509 certificate and private key, which can be used for authentication and encryption. In order to retrieve data from the smart card, you need to provide some form of authentication, such as a biometric or password.

Almost every company that I've worked for has used prox cards for building access, but I've never heard of anyplace using smart cards for this purpose. Unless you also had to provide a password to get into the building, you probably were not using a smart card.

Re:News?

[tb3]

I know. These were smart cards. They had their own CPU, and something like 8K of EEPROM. You had to place them in a contact reader for authentication. Ours were made by a subsidiary of Groupe Bull based in Texas, I think.

Re:News?

[fluce]

It seems that a CSIL interpreter is not embedded on the card: article says that a tool allow the transformation from CSIL to card-specific binary. It's a kind of compiler isn't it ?

The same way is used with Javacard.

In fact, it's only a card programmed in C# instead of C or assembly language.

Nothing really new, except maybe a pretty dotNet style API.

Re:News?

[Kazin]

No.

Proximity cards don't broadcast anything "constantly". They don't even power on until within range of the reader, which acts as a power source.

Otherwise, you're right, they're pretty easy to read with some simple hardware.

Re:News?

[fluce]

All Smartcards have an OS. Smartcards have a file system, application management, customized code, it's not only communication and authentication.

One of the most common OS for smartcard is MULTOS.

ISO norm ISO 7816-4 defines a standard for the basic functions of a smartcard OS.

end of passwords - not

[martin]

So how do you 'unlock' the smart card to prove its you (and still you) at the keyboard...???

an PIN number...
a fingerprint...

Authentication is based around something you have (userid/smartcard/finger...) and something you know (password/PIN/....)

No change since the Secuure Single Sign On days of the mid 1990's. All they are doing is bringing it upto date using .NET to quickly build applications.

Re:end of passwords - not

[AndroidCat]

In terms of security, a card is something you have, a biometric like a fingerprint is something you are. (Unless you have fashion accessories that I don't want to know about! :)

Re:end of passwords - not

[Anonymous Coward]

Actually, it's 1) something you have (a "token"), or 2) something you know (e.g., pass{word,phrase}, pin), or 3) something you are (biometrics).

In general, strong authentication requires two of the above.

Re:end of passwords - not

[Anonymous Coward]

You get a card. It could come with Windows, or you might get mailed one, or they might sell them at your local store. Doesn't matter. It's a card.

When you sign up for the .net card service, you tell them who you are. You could tell them you are Anus McScrotum for all they care, it does not matter. You may use this card to login to participating .net services where they may ask you who you are, they may ask for credit card info for billing purposes. They in use the card for authentication and remember data associated with you.

Re:end of passwords - not

[Anonymous Coward]

an PIN number...

a PIN number, and second of all it is not a PIN NUMBER

Please refrain from saying this, please, please, please. Just call it a PIN, or, if you like, personal identification number, but please not what the last words states.

Thankyou

Re:end of passwords - not

[Anonymous Coward]

But that's what the ATM machine tells me to enter.

Re:end of passwords - not

[jamonterrell]

I've long argued for a similar solution for Credit Cards. I want a credit card that is a smart card, has a numeric keypad and a small LCD display. you insert the card into the reader, the reader asks for $X.XX dollars for XYZ, Inc. from the central credit card computing system, which responds to the reader with a unique transaction ID. The Price/Company promptly appears on your screen, you press "YES" or "NO" and key your pin. The unique transaction ID, your secret key (unlcoked from smartcard using pin), $ amount, and billing company ID or name are all MD5'd together ON THE SMARTCARD, and the result is sent to the reader. The reader sends this back to the central credit card computing computers who verify it (they also have your secret key), and voila, you have a transaction that is safe for both sides and fully verified. Seems like the amount of money it would take to roll this out could be recovered in 5 or so years from the amount of credit card fraud it would cut down... but then again, i guess everyone is just doing identity theft and applying for the credit card under someone else's name these days.

Re:end of passwords - not

[martin]

something similar being rolled out in Europe and esp UK right now...

card read/PIN entry on a separate box and the public key on the host system not the private key. Apart from that pretty much what you describe.

All the thing is doing is moving the problem to internet/phone shopping where the card isn't present at the shop.....

Re:end of passwords - not

[quantum bit]

card read/PIN entry on a separate box and the public key on the host system not the private key. Apart from that pretty much what you describe.

Yes, but you still have to trust the box at the store not to steal your PIN.

The cool thing about smart cards is that you enter the PIN on the card itself, which you carry with you, so it's much less likely to be compromised. The whole transaction is encrypted, so the hardware at the point of sale only sees a one-time key that will never work again.

It also conveniently solves the shop-at-home problem too (but does require that you have a smart card reader connected to your computer).

Re:end of passwords - not

[Anonymous Coward]

No, no,no - the central idea of smartcards is to get away from having to access any central key repository online. The way Mondex (& other electronic cash cards) work is to carry the hash with the card in a non-repudiation framework, so that the transfer is between your card and the "card" (actually usually just the chip) in the reader. No fuss, no muss, no connection to Big Brother. When the retailer wants to turn his electronic money into "real" money, he does the same sort of transaction with his bank.

Re:end of passwords - not

[DHam]

It also conveniently solves the shop-at-home problem too (but does require that you have a smart card reader connected to your computer).

We already have this for net banking. My debit card has a chip on it (which is also used for stored value smart card stuff) and to authenticate to the banks website, I use a reader supplied by the bank.

The process works like this:

1. The bank sends me a challenge (number).
   
2. I authenticate to my card by keying my in in the smart card widget.
   
3. I key the challenge into the widget and get a response.
   
4. I send the response back to the bank.
   
   1. 
      

      Using basic public key signing, the bank now knows that it's me. In accordance with good crypto practice, all the security is in the key so I can use anyone's widget for the operation. Since it's a separate widget, I don't even have to trust my computer not to steal the pin - the computer only gets to see the one time challenges and responses
      

Re:end of passwords - not

[martin]

correct - same with all smart cards - the key input isn't on the card. The only non-standard over the normal CC is the chip.

Re:end of passwords - not

[Qzukk]

Then we need to fix this.

When I was a little kid, I had a solar powered calculator that was about the same size as a credit card. The touch sensitive surface from that could be used on the surface of the smartcard.

In fact, if I was developing this, I'd use a fake magnetic strip and work it like those fake cassete tapes you use to plug in a cd player into your car tape deck. When you don't type the pin in, theres nothing on the strip. When you type the pin in, you get 30 seconds to swipe the card.

Re:end of passwords - not

[martin]

Go on then...

have you any idea how lon it's taken for Europe to standardise on a single chip & pin standard (well over 15 years). If you want to have a go at introducing the inbuilt keyboard you are most welcome.. :-)

Re:end of passwords - not

[cpeikert]

We already have this for net banking. My debit card has a chip on it (which is also used for stored value smart card stuff) and to authenticate to the banks website, I use a reader supplied by the bank.

These are really cool and I wish they were more widespread, because they don't need any special software or drivers on your PC.

Using basic public key signing, the bank now knows that it's me.

One quibble: it is probably not a signing algorithm (which is asymmetric-key) in the widget, but a pseudorandom function. A PRF has a secret key (which your bank also knows) inside it, and returns a fresh "random-looking" string for every different input, even though the function is actually deterministic. Even given lots of PRF values at several points of its choosing, an adversary shouldn't be able to compute the PRF value at an unseen point (better than by random guessing). It's really an amazing primitive.

PRFs are perfect for this kind of authentication because they can be computed quickly, need no on-line randomness, and fresh challenges yield fresh authenticators.

Re:end of passwords - not

[Qzukk]

Well, my idea would be specifically for a credit card type replacement, not for a general purpose credit card. I could make up my own stuff, as long as it was able to magnetize the stripe surface correctly on demand, it would work with any CC reader.

Re:end of passwords - not

[martin]

Part of the problem they are trying to solve with chip n pin was the ability of the crims to make their own cards easily.

It's alot harder to forge a chip n pin card than the mag stripe kind. Hence wny alot of the cards (and pins) are now disappearing in the post, rather than getting copied at the gas station! Again they've just moved the goal posts rather then solved the problem.

Will be interesting to see how the fraud numbers match uop with the roll out costs os chip n pin. BTW its the retailers who are having to pay for the new card readers, not the banks!

Re:end of passwords - not

[Tony Hoyle]

It has the same problem as C&P though.

It's far more likely that someone will see you enter your pin, than the machine will steal it.

So instead of only entering the pin at an ATM (which is easy to secure as it's designed so you can't see it from many angles), you're typing it on a keypad in a busy store, surrounded by dozens of people watching you type it. ..and they reckon this is *more* secure. Hah.

Re:end of passwords - not

[raile]

The cool thing about smart cards is that you enter the PIN on the card itself...

So if I find your lost card, I can reduce the number of digit combinations that I have to try just by looking at the keys that are dirty and/or the ink is wearing off?

Re:end of passwords - not

[mdielmann]

I heard someone on /. say once that true security is based on three things: Something you have (smartcard, etc.), something you know (password, etc.), and something you are (biometrics, DNA, etc.). I think the separation of have and are, as listed in your post, is significant.

Re:end of passwords - not

[jamonterrell]

all good passwords are changed often, which could be enforced by the smartcard.

How long before we can get an open-source version?

[beders]

Depends on how many patents Microsoft have quietly filed on the technology behind it

The first words that come to mind

[Anonymous Coward]

Being "technology's ultimate triumph over both itself and common sense".

So we are meant to trust ALL of our security-- on any system that would have previously required a password-- to a single point of failure which
1. Is maintained by Microsoft
2. Can be stolen
Riiiight.

ok Bill

[Anonymous Coward]

#passwd
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully
#

The beast wants to place a mark on each of us

[Anonymous Coward]

Next thing you know, he is going to want to only allow access if we have a chip in our hand or our forhead. Hmmm, it's almost biblical...

cue the memory joke

[Anonymous Coward]

Bill Gates Proclaims that 650k will be enough for anyone.

yeah i know its not true.

Re:cue the memory joke

[Anonymous Coward]

650k? You better cue your memory...

Re:cue the memory joke

[ThJ]

650?! AARGH! *dies of internal hemmorhaging* Error, error! Number is not an exponent of 2. 2^6 * 10 = 640

How long till open source.... Read...

[Fallen Kell]

Well, considering Sun has been using smart cards for user identification for YEARS, when Solaris 10's source is released under an open source license, open source will have the same capability (well, no need for .NET though).

Re:How long till open source.... Read...

[CortoMaltese]

There's also the MUSCLE project at http://www.linuxnet.com/index.html. MUSCLE stands for Movement for the Use of Smart Cards in a Linux Environment.

Haven't tried it, but there's at least work in progress towards being able to login using a smart card - among a lot of other components.

Re:How long till open source.... Read...

[Anonymous Coward]

Interesting how acronyms always "coincidentally" form a word in itself.

I'll wait till someone comes up with an acronym for something really useful that's something like F.U.C.K. O.F.F. or N.O. A.C.R.O.N.Y.M. H.E.R.E. D.I.M.W.I.T.

Re:How long till open source.... Read...

[Megane]

Solaris 10's source is released under an open source license, open source will have the same capability (well, no need for .NET though).

What makes you think Sun is going to release everthing that goes with the Solaris 10 distribution as open source? Sure, they're going to open source the kernel and core utilities, but Apple has been doing that for years already. And you're not likely to see an open source licensed version of Quartz graphics any time soon.

Re:How long till open source.... Read...

[Fallen Kell]

That is true. Although, the functionality involved in the way this works would almost have to be driven by kernel modules/modifications. At least hardware I/O interupts must be created to handle the event. The kernel must at least interpret the insertion/removal of the smart card and then call the appropriate authorization calls, login calls, and session re-attachment calls for this system to work properly. Since it is an I/O event, (i.e. detect/read from a specific piece of hardware), it would only have made sense to have at least a portion of it as a kernel module, especially when on a workstation, this would be one of the most important activities that it would need to process and act upon. But, you could be correct, and Sun does not open source this part of their operating system, but it has been a basic part for several years now (Solaris 8).

Re:How long till open source.... Read...

[fugspit]

What makes you think Sun is going to release everthing that goes with the Solaris 10 distribution as open source?

During yesterdays product launch Sun's COO Jonathon Schwartz said "We are going to open source ALL of Solaris. We are not going to opensource bits of it and keep other bits private."

That seems like a pretty good reason for believing Sun will opensource it all.

A better question would be

[Rogerborg]

How come there isn't an open source solution already?

Re:A better question would be

[JohnFluxx]

KDE's Kwallet is pretty close. It stores all your passwords (web page, msn/icq, irc and so on) in a single file. Then on websites when they want a password, you just type in any giberish, and let kwallet store it.

Then put the kwallet file on a usb stick, and you're all set!

It's best, of course, to have a password for the kwallet file, but you just type that in once when you log in, and it stays open until you log out again.

Re:A better question would be

[jrumney]

How come there isn't an open source solution already?

There is. It is perfectly possible to use an SSH or kerberos key with no password to go with it. Its not a good idea though, and having the key stored on a smartcard does not make it one.

Re:A better question would be

[NatasRevol]

Sounds just like OS X's Keychain.

Keychain includes a tool that lets you determine how strong your password is. And it lets you know if it's too simplistic, too short, or based on a dictionary word.

Re:A better question would be

[JohnFluxx]

There's talk about adding that feature to kpasswordbox or whatever it is.

.NET?

[w.p.richardson]

Nah, biometrics would be more likely to end passwords.

Tough to hax0r a retinal scan, or a thumbprint.

Re:.NET?

[Yaa 101]

You just cut off the finger and tear out the eyeball...

This is just a proclamation towards harder violence in this world...

Re:.NET?

[Patrik_AKA_RedX]

Actually, it's pretty easy to hack a thumbprint. All you need is a meat cleaver and something to stop the bleeding...

Re:.NET?

[Anonymous Coward]

Actually, so far all biometrics have proven to be easily fooled when you remove the external human control. The computer can't tell if you're wearing special gloves or contact lenses.

On the other hand MICROS~1 can probably afford to include a human controller with every copy of longhorn.

Re:.NET?

[CortoMaltese]

Don't remember this?

http://www.theregister.co.uk/2002/05/16/gummi_bear s_defeat_fingerprint_sensors/: "A Japanese cryptographer has demonstrated how fingerprint recognition devices can be fooled using a combination of low cunning, cheap kitchen supplies and a digital camera."

Re:.NET?

[rokzy]

you, like many others, assume that all criminals are psychos and will stop at nothing to commit a crime.

that is bullshit. a large ammount of crime is opprtunistic. if you leave your window open, they'll climb in. if you close it, they might smash it IF the house is empty and secluded. but it's not an arms race. if you install CCTV and alarms, they don't come back dressed in black with night vision goggles and a set of expensive tools to disable your security, they just go next door to the guy who HAS left his window open.

Re:.NET?

[Alioth]

The thing is, much of the (widespread, zombie style) hax0ring hasn't involved passwords at all - but exploiting vulnerabilities.

Having said that, we demonstrated a smart-card based authentication system using biometrics to the UK Government in 1994. So what Gates is on about is hardly new (ours included a smart card reader - and they are cheap - a serial read/writer cost £35 in 1994) based on a smartcard. The biometrics we encoded was a photograph and a fingerprint. We also demonstrated automatic signature recognition (which was VERY accurate). All of these things could be kept on the smart cards of the day.

Re:.NET?

[TCM]

Yeah, I'll really have to keep an eye on biometrics.

Re:.NET?

[Anonymous Writer]

All you need is a meat cleaver and something to stop the bleeding

I don't think someone who is going to cut a finger off with a meat cleaver is going to bother with stopping the bleeding.

Re:.NET?

[ComaVN]

So it is an arms race. Just not with the criminal, but with your neighbour.

Re:.NET?

[Taladar]

You might have a point in systems needing a grade of security that they don't use regular (read long-term) passwords anymore today like Nuclear Weapons Storage or things like that. Nobody would tear out an eyeball to break into your home and steal your stereo or to get onto your work-pc.

Re:.NET?

[melandy]

Exactly. You don't have to outrun the bear. You just have to outrun the slowest camper.

Re:.NET?

[tbone1]

you, like many others, assume that all criminals are psychos and will stop at nothing to commit a crime.

Good point. It is the lawyers who fall under this description.

Re:.NET?

[Anonymous Coward]

You don't have to run faster than the grizzly, just faster than your friends.

In Related News...

[Spencerian]

Orville Redenbacher, speaking through an interpreter for the dead, announces an end to those pesky husks that end up between your teeth after a movie at the theater.

Announcing: Seedless corn.

Sony gave me a Smart Card

[Moonlapse]

Being a member of MySony, they sent me an email and had me take a short survey, then decided to give me a free "wavecard" which is a Smart card with Felica technology. This is the contactless tech mentioned in the article. It requires software provided by Sony, and since I had the .NET runtimes installed already, I can't tell if .NET is really needed , I can say MS wasn't the first.

BSOD

[dauthur]

This, coming from Captain BSOD? I'll stick with my superduper random passwords.

I wonder how long it would take to crack these "smart cards", proving their worthlessness, just as the $20 bills were when those were rolled out?

Re:BSOD

[kurzweilfreak]

I wonder how long it would take to crack these "smart cards", proving their worthlessness, just as the $20 bills were when those were rolled out?

In that case, why don't you just send me all those worthless $20 bills you have laying around?

get an open-source version of this?

[D4MO]

"Secure and reliable cryptographic operations, such as symmetric (DES, AES) and asymmetric (RSA) algorithms are accessible via an implementation of the standard Cryptographic Services architecture of the .NET Framework. This empowers existing solutions that use .NET cryptographic services to be easily modified to use smart cards"

Thanks to Mono, you can implement it now. http://www.go-mono.com/crypto.html

Re:get an open-source version of this?

[Taladar]

You could also just use PAM (which is already a few years old) and basically allows you to use any authentication with any PAM-capable software without any changes to the software at all.

a bunch of marketing speak

[geighaus]

and no details about its security. have they not learnt anything from pay-TV industry, which opted for security by obscurity in their smart card design and as results suffered from consequences? I have a feeling this whole thing will go terribly wrong.

Re:a bunch of marketing speak

[harriet nyborg]

1 billion GSM subscribers are using smart cards.

Re:a bunch of marketing speak

[geighaus]

they are from secure though. secure enough for casual end-user, but hardly for mission critical operations. two-tier security sounds fine, but getting rid of passwords completely would be a bad move.

Re:a bunch of marketing speak

[harriet nyborg]

marketing speak? firstly, it is simply a fact that there are 1 billion GSM SIM cards in use. secondly, while early versions of the GSM SIM where theoretically capable of being cloned you had to have physical possession of the SIM card to do it. as a practical matter fraud in GSM is virtually unheard of and the system as a whole is very much secure. even without passwords.

Richard Stallman n Hackers already saw this dream!

[Jimmy The Tulip]

I think BillG recently saw the movie Revolution OS http://www.imdb.com/title/tt0308808/ *ing Richard Stallman.

Long Ago Hackers in MIT saw this dream of havinf no passwords with the philosophy that they didnt want to be in control of any admin assigned.

It worked for sometime, RMS used to have no password of his unix account. All other too!, they had to just press the enter to login! but later they had to change themselves...

BillG will *not* succeed in his dream plan! Amen!

Passwords? What for ?

[yogikoudou]

Seriously, who cares about passwords when you can exploit all the flaws MS systems have ?
They'd better fix their software first.

Re:Passwords? What for ?

[servoled]

Seriously, who cares about passwords when you can exploit all the flaws LINUX systems have ?
They'd better fix their software first.

Re:Passwords? What for ?

[schuster]

I'm not able to get into the site to read the article right now, but if Gates is proclaiming that the end of passwords will make things completly secure, he's out of his mind. Gates is the one proclaiming the end of passwords, not Linux/Unix users/developers. This idea sounds like it comes from the thoughts of a man in denial. Regardless, in all things security, there's no on-off switch. Where there's a system that someone can log into, someone else will always be able to log into it as well. That's just the way it is.

Re:Passwords? What for ?

[petersam]

If you RTFA, this is for access to the Microsoft corporate network. It has (almost) nothing to do with their products' development. They need to fix their software, but they also need a strong authentication mechanism for their employees. There's nothing wrong with this "article" (aka Axalto press release).

Linux is missing an opportunity

[PrvtBurrito]

Linux is missing an opportunity. Instead of writing software that insists that passwords be uncrackable, they should be innovating new technologies that make machines insensitive to dictionary attacks, or new technologies like the one described here that does away with the need for having passwords everywhere. Hmm, maybe Bill has some innovation in him afterall....

Re:Linux is missing an opportunity

[Anonymous Coward]

Linux has had this for OVER 5 years now.

Cripes. just because gates says it's new certianly does not mean it is true.

http://www.strongsec.com/smartcards/howto/html/S ma rtCard-Login-HOWTO-1.html

start here you clueless fool

Re:Linux is missing an opportunity

[Taladar]

Ever heard of PAM? http://www.kernel.org/pub/linux/libs/pam/whatispam .html/

Re:Linux is missing an opportunity

[IBeatUpNerds]

I really don't see this as a worthwhile technology. Select a good password, and get on with the show. No need to introduce authentication mechanisms that require you to purchase more hardware. As far as dictionary attacks go, if they have your shadow/master.passwd against which they're performing the dictionary attack, then odds are they have root access, in which case you're screwed anyway. How did they acheive root access in the first place? Probably via some small stupid bug related to bounds checking in a process running as root.

Not a password replacement

[Albanach]

Reading the Axalto press release they talk about their cards as an additional form of security, not a password replacement. I've used smart cards for a few things and each of them has been protected by a password too. You enter the smart card and are then asked for a PIN to ensure you have the right to be using that smart card. As another poster said, if there's no password all they have to do is get to your wallet if they want to Get Root. Hopefully if we do see an open source implimentation it won't be passwordless!

Correct me if I'm wrong, but. . .

[UFNinja]

Isn't the best way to secure data *both* something you have (e.g. key) and something you know (e.g. password)? Something I know is also less likely to get stolen, so long as noone has a keylogger installed on my computer. Last time I checked, it's also a whole lot easier to change my password than it is to change the locks on my doors.

Re:Correct me if I'm wrong, but. . .

[yorugua]

Many cyrpto devices such as the ones to be used by persons for logging-in into networks and applications do need a password to "open" the "token" or crypto device first and then log-on to the application. Then, you have a two factor authentiation : something you know (to open the crytpo token, such as a Smart-card from Gemplus, Schlumberger, or USB token such as the ones from http://www.ealaddin.com/) and then the something you have (the token itself).

Those tokens usually let you try a predetermined/configurable number of password before locking themselves up. Then, you might need and administrator password to be able to open the devices, which it might itself have a number of tries to actually open. There are many implementation of these things...

On the other hand, these tamper-resistant devices such as smart-cards have been violated (ask Dave@direc....:-), but then again, we have seen this before in the tech area...

Re:Correct me if I'm wrong, but. . .

[mdfst13]

"Something I know is also less likely to get stolen, so long as noone has a keylogger installed on my computer."

It makes more sense to enter the password directly into the smart card (think keypad, like a wallet calculator). Then you are secure even if there is a key logger on the computer.

back to windows 98?

[y86]

i know on windows 98 that if you just clicked cancel you didnt need a password to log on..... high security

No passwords

[Anonymous Coward]

No passwords. Sure beats clicking on cancel to get in!

Re:How long before we can get an open-source versi

[Fallen Kell]

None. Or if they did, Sun Microsystems has been using a similar system for years. Smart card readers are standard equipment on all currently available Sun workstations, and have been for the last 3-4 generations of workstations as well. Sun "deployed" this system at least 4 years ago when it introduced "Sun Rays" back in 2000-2001 timeframe. If MS tried to patent this, Sun is clearly prior art, and if it isn't, it should be construed as simply a logical progression of Sun's system, which means it should not be patentable, but then again, we are talking about people who have let though patents on the wheel in recent years...

I think this is the wrong approach

[auzy]

Its similar to the national identity card.. What if your card gets stolen. Any idiot can probably use it to connect to all of your accounts, without effort. Even worse, its a very poor idea to base your systems on a completely centralised system like passport authentication. It only takes 1 person at microsoft to trip on a cable then for all of your logins to fail.

Finally, it offers no protection still. Bill gates is assuming you cant capture the password in memory. It is in fact even easier with .net because unlike a keylogger, the answer wont be obfuscated, you can just monitor the smartcard port, capture all the details sent, and you dont even need the smartcard.. You just emulate the smartcard hardware and fake the connection to the card, easy.

This system offers much less security then now, and the last few drops of respect I had for .NET are now mostly gone. This is nothing more then a publicity act that only stops people who tell others their passwords, and even then, they will just be able to borrow the smartcard.

Smartcards and MS passport also make a great way of tracking people. No one can tell me that Microsoft wont abuse this to improve their search engine

It will take only 1 more DNS mess-up for everything to fall apart, and is nothing more then a marketting Act. I beg of the mono people to offer a proper decentralised authentication system instead, like one based on jabber where any login method is possible anyway if the server supports the authentication type. PLEASE.. Do not use .NET authentication, or you are putting yourself in a terrible position (it costs money anyway, so I think its time us as a programming community should get together and get jabber up to the point the same thing is possible in a decentralised way).

Re:I think this is the wrong approach

[Peyna]

Its similar to the national identity card..

Or a credit card, bank card, driver's license, passport, etc.

Obviously there will be fail-safes in case you lose your card.

It is no more like a "national identity card" than anything else I listed, because the government won't be running it, and they won't be able to demand to see it from everyone walking down the street.

Re:I think this is the wrong approach

[auzy]

passports and drivers licenses have a photo though, so you cant pretend to be the owner of the item.

Credit cards have a pin number, contain no customer details, and the ATM eats your card after 5 bad entries.. Many ATM's also take your photo, so its harder to use it. Finally, the ATM's generally only let you extract a small amount each transaction, so it isn't that easy.

Internet doesn't have a photo or restrictions, so you can log into a .NET enabled shares site, and with the .net key, suddenly, they might sell all their stocks, trash their emails, pretend to be them on the internet, hack their site, etc.. The best way to think of this is imagine the extreme. Imagine if all sites ran .NET, because thats EXACTLY what MS wants. Every site, 1 password for 1 user.

Re:I think this is the wrong approach

[hbackert]

Wow...so many things wrong.

What if your card gets stolen. Any idiot can probably use it to connect to all of your accounts, without effort

Of course you'd need a PIN/password to use the card.

It only takes 1 person at microsoft to trip on a cable then for all of your logins to fail.

They invented redundancy some time ago. Look at DNS: one server down, many still available and the whole DNS system works without a hickup

unlike a keylogger, the answer wont be obfuscated, you can just monitor the smartcard port, capture all the details sent, and you dont even need the smartcard.. You just emulate the smartcard hardware and fake the connection to the card, easy.

Of course the communication is encrypted. With the private key on the card. Where it stays and there's (hopefully) no way to get it out. Thus the card signs a message (a random message) and there you go. Only the card can sign something with its private key. And sniffing the ports will not help as it's always different.

I do agree that Microsoft controlling my identity is something I will not like. Nor any other commercially working company. But then I do not see why this is needed. I 'd like to have a private key (generated myself) put into hardware I can trust (that's a difficult part), I put my public key somewhere at some sites I trust (not just one, not just .NET) and then I can sign anything I like and everyone can verify it's me. Logging on computers is then pretty simple: people get my public key and allow the owner of the private key to log in on a certain computer/network.

The programming part is IMHO simple. Building the hardware in a useable way (trustable, cheap, secure, no backdoors) is difficult. Especially if you cannot afford a custom made SmartCard.

Re:I think this is the wrong approach

[Phleg]

Who modded this insightful?

The advantage of a smartcard is that you *can't* just copy the contents of the smartcard and replay it; most good ones use asymmetric encryption, and the private key is inaccessible. You need to actually *have* the card in order to access the services, which eliminates the threat of a password being sniffed (think SSH public-key authentication).

Re:I think this is the wrong approach

[Megane]

What if your card gets stolen. Any idiot can probably use it to connect to all of your accounts, without effort. Even worse, its a very poor idea to base your systems on a completely centralised system like passport authentication.

What happens if your building key card badge gets lost or stolen? They unregister it from your entry in the the card key database, give you a new one, then register it under your name.

Re:I think this is the wrong approach

[auzy]

umm, remember when Microsoft lost their domain passport.com domain and some guy bought it because they forgot to pay for it.. that was more of what I was referring to. Even with 1 server down, there would still be disruptions too, just not as bad.. I'd find it very unlikely if there wasn't a way to copy the cards either. That was more of what I was referring to at that point, or like keygening, staying connected to the computer and offloading it to their card. And yes, I am aware that while there is no easy way now with most algorithms, all encryption algorithms will eventually be broken. After testing enough keys too, when a algotithm is broken, the private key can be guesstimated (I'd imagine many algorithms have been completely broken).

I find it fishy no ones asked who gets the money for these cards too (Microsoft I'm guessing makes a decent profit).

Of course you'd need a PIN/password to use the card.
Doesn't it make it pointless then if you need to memorise a password anyway?? At the end nothing would be gained, except you'd just need a shorter PIN to access the account. Maybe a bit more extra security, but nothing better then using a properly decentralised solution similar to passport with only password anyway. The best thing is using a jabber based system, you'd be able to host the authentication server yourself.

Re:I think this is the wrong approach

[Taladar]

Via the Internet it is also possible to do much more damage in the short timeframe it takes to disable the card than with any of the examples above. Another problem would be your identification for the process of disabling the card/account. If everyone uses this cards to identify you online how would MS identify the authorized person for this failsafe?

Re:I think this is the wrong approach

[Peyna]

Credit cards have a pin number

I've never heard of a credit card with a pin number; and the only time I've been asked for ID when using a credit card is at the liquor store. If they were really that secure, how come they get stolen so often? I've had my check card number and information stolen and used, while the card was still in my possession (cashiers almost always have full access to this if they want it).

I just like how everyone assumes that this system wouldn't have any fraud protections, especially with all the talk about "identify theft" lately.

Re:I think this is the wrong approach

[petersam]

To add to the correction of the previous post - which is NOT insightful in the least:

Even worse, its a very poor idea to base your systems on a completely centralised system like passport authentication

This is not based on Passport authentication. It is based on Kerberos. It, using smart card based certificates, is the built-in and not-new strong authentication method for Windows.

It only takes 1 person at microsoft to trip on a cable then for all of your logins to fail.

Even for employees at Microsoft that will use this solution, cable cuts and DNS outages will not affect this since you can do smart card based logon without the domain controller using cached credentials.

It is in fact even easier with .net because unlike a keylogger, the answer wont be obfuscated, you can just monitor the smartcard port, capture all the details sent, and you dont even need the smartcard

As another poster corrected, the private key never leaves the smart card. There's nothing to monitor - the only thing you could get with a keyboard or memory monitor is the PIN for the smart card. But it is the smart card that creates the encrypted kerberos messages based on your private key. This is much better than a password-only system because the attacker will still need to steal your card. You can't emulate it because you don't know the private key.

Again, this is not ".NET authentication". It is the .NET framework running on the smart card. Microsoft is happy because their tech is being used by non-Windows vendors like Axalto. Axalto is happy because they just sold tens of thousands of smart cards to Micrsoft.

Passwords proclaim the end of Bill Gates

[cwebb1977]

Dyslexia finally made sense to me...

Re:Passwords proclaim the end of Bill Gates

[GigsVT]

Wait, your password is "killbill" too?

Re:Passwords proclaim the end of Bill Gates

[turgid]

Dyslexia finally made sense to me...

Well, it seems to me that Windows NT and derivatives have security through apathy. After all, who wants to type in "administrator"?

Re:Passwords proclaim the end of Bill Gates

[Adam9]

In Soviet Russia.. YOU make sense of dyslexia!

Re:Passwords proclaim the end of Bill Gates

[pchan-]

if this is like Dos is Dead, which is what they were advertising when windown 95 came out, then i guess passwords are not going anywhere for a while.

First spam, now this!

[AndroidCat]

Is there no limit to Bill's powers of proclaimations of endings? (Okay, he still has a year to go on the spam, but it'll be ending any moment .. now. Now. Now! Any moment...)

Re:First spam, now this!

[imr]

spam will be over when his prediction that the internet wont get popular comme into reality.

LOL

[JediTrainer]

In other words, Bill Gates gives up on security. "You win. You hackers always seem to find a way to break into our OS, well fine. From now on, we're taking the ball back. NO SECURITY FOR YOU!". Or, perhaps "In the interest of customer service and ease of use, we will now automatically grant administrator access to anyone who can turn the machine on. Down with restrictions!"

In all seriousness, is anyone stupid enough to trust any security initiative put forth by Microsoft after the last few years have been so disastrous for them on that front?

Re:LOL

[Anonymous Coward]

In all seriousness, is anyone stupid enough to trust any security initiative put forth by Microsoft after the last few years have been so disastrous for them on that front?

It worked for George Bush.

Re:LOL

[Blitzenn]

you might have gotten a zero score for the comment, but you hit the nail on the head. We don't want smarter faster, we want do it again even if it's wrong.

Re:LOL

[Taladar]

Even if you ignore MS for a moment it is never a good idea to trust all your security to a single vendor/system.

640 should be enough...

[Progman3K]

I can't wait for the inevitable exploits and bugs that will cause cracker to be able to amass the personal information of everyone who is dumb enough to believe this man.

Can I get indemnisation from Microsoft for the problems this scheme will bring? No?

A little black book containing all your passwords that you keep on your person is the ONLY way to be safe.

Great another card to lose.

[LabRat007]

I actually like my password encrusted life. If I lose it all I have to do request another be emailed. If I forget my email password I just call my provider and anwser a slew of questions to prove my identity. Things are quick. Now, if my wife gets hold of a password "key" of any kind she will just lose it like she loses her ATM card 2-3 times per year. No thanks.

Re:Great another card to lose.

[Anonymous Coward]

Noticed the flaw?
I could be the operator checking your identity to give you a new password for your email, and later use the answers to the questions to prove to someone else that I am you.
As someone said, security is based on something only you know (and the system), don't tell others how to steal your identity.

Re:Great another card to lose.

[multipartmixed]

> Now, if my wife gets hold of a password "key" of any kind she will just lose it
> like she loses her ATM card 2-3 times per year.

You have one of those too, huh?

Mine lost her VISA not once but TWICE during a one-week trip to the Dominican Republic. Once in the ocean, the other time she threw in the garbage with an empty pack of smokes.

Re:Great another card to lose.

[Anonymous Coward]

Capitol punishment makes the state into a murderer.

Capital.

Capitol punishment is forcing people to sit in on parliamentary debates.

Re:Great another card to lose.

[LabRat007]

We purchased our first home this summer. I hand her one of the 2 garage door openers. 2 hours later its on its way to the land fill.

Does yours also do that thing were every pair of earings becomes a caltrop?

walk walk walk stab "oh jesus oh jesus!!" hop hop "honey I found the other earing."

Re:Great another card to lose.

[SnprBoB86]

2-3 times per year?!?!

Wow I can see 2-3 times per lifetime, but that even that often is unreasonable.

Something tells me that you shouldn't worry about not losing your key card, but rather how to go about losing your wife.

Just In From Heaven

[Spencerian]

After the 40th day where the D.A.M.N. Windows-based soul tracking system was offline due to spyware, God, CIO/CEO/Ruler of All You Know, has proclaimed the end of Bill Gates.

HA! RMS was there first!

[dbIII]

You may recall that RMS was strongly against passwords. We don't have to agree with everything he say or does - just the good stuff.

Re:HA! RMS was there first!

[AndroidCat]

So? I still think he was an idiot about no passwords. (In fact, he was a jerk by insisting that other people shouldn't use passwords.) That was not some of his "good stuff".

Re:HA! RMS was there first!

[Anonymous Coward]

His motive is that you shouldnt have to keep secrets from each other or something along those lines, very idealistic.

Re:HA! RMS was there first!

[dbIII]

That was not some of his "good stuff".

My point entirely, we can like the GPL but we can take his opinions on other things on their merits (like the stupidity over no passwords in a setting where student are marked on what is in their files - so they should not be world readable).

Re:HA! RMS was there first!

[AndroidCat]

Ah, sorry. Lost the ironic message that a security system using a cryptokey device is in any way close to what Richard Stallman would want. :)

The answer

[CastrTroy]

The answer, although everybody is recommending it is not biometrics. Lets say company A has your thumbprint/iris print on file for access to their system. Now, company B uses the same method. What's to stop company A from using that print to get information from company A. What if they use some iris scanning thing to get a key to encrypt your data. What if your eye gets messed up. Is your data lost, because it's going to take 5000 years to decrypt by some other hacking it? Compared the the alternative, passwords are nice. It's nice to be able to have different passwords for different companies, and to be able to choose passwords of differing levels of security for different things which require more or less security. I like to be in control of my own security. I'd rather not have one central organization, Microsoft or not, that's in control of my access to everything.

Um... no?

[warrax_666]

The same applies for a smartcard, doesn't it ?

You can always get a new smartcard, you can't get new fingerprints (or retinas, or whatever).

Re:Um... no?

[lee7guy]

Also, you don't leave your smartcard at every place you visit, which is the case with fingerprints. You can easily make a gelatine film with fingerprints collected on everyday objects. No fancy equipment required either. When researches tested the technique at a recent show, every fingerprint reading device they were allowed to test, were fooled.

Retinas at least doesn't leave traces everywhere, but then you still run the risk of data theft.

Re:Um... no?

[Taladar]

If and when it is possible to copy a biometric feature of your body the whole biometric system is compromised not only your account. The strong point for biometrics is the difference with copying them.

Re:Um... no?

[isecore]

You can always get a new smartcard, you can't get new fingerprints (or retinas, or whatever) ... Unless you're Tom Cruise playing a part in a movie called Minority Report, where you get your eyes switched by a creepy swedish doctor.

Re:Um... no?

[JavaLord]

You can easily make a gelatine film with fingerprints collected on everyday objects. No fancy equipment required either. When researches tested the technique at a recent show, every fingerprint reading device they were allowed to test, were fooled.

Hmm, so we are going to end up with 13 year olds War-Fingerprinting?

Re:Um... no?

[ballpoint]

How long before high-resolution eyeball-tracking cameras stealthily look down into a main city street making iris snapshots ?

Iris pictures are even easier to obtain than fingerprints; no material contact is necessary.

Re:Um... no?

[honestmonkey]

You can always get a new smartcard, you can't get new fingerprints

Well, not YET anyway...

Re:Um... no?

[joe_w_henry]

No new retinas? Unless we live in the world of "Minority Report."

Re:Um... no?

[nyekulturniy]

If some organization could do this, wouldn't its management be worried the operators would be wasting their time at work looking up women's skirts?

Re:Um... no?

[nadadogg]

That brings us to a far better idea.
Genital-prints! Everyone hoo-ha and wingwang are unique, like snowflakes. The wrinkles, bumps, and lumps we all love so much can protect us from identity thieves!

Re:Um... no?

[jsitke]

I could be wrong here, but isn't this smart card just a hardware key with some crypto abilities? I have one on my keychain right now. You hold it up to the card reader and the door 'magically' unlocks.

Re:Um... no?

[3terrabyte]

Yikes! And here I was shaking my head to the horrors of getting a finger chopped off...

Re:Um... no?

[nadadogg]

Poor John Bobbit can't pull money out of his ATM anymore :(

Re:Um... no?

[WompPetrovski]

You obviously haven't seen Minority Report then!?

How is this better than the Java iButton?

[WillerZ]

See this page:

http://www.ibutton.com/ibuttons/java.html

I've had one of these Java-powered iButtons since 2001. If you have the PKI in place it's a very easy technology to use. If you don't, it just gives you bragging rights in the my-computer-is-smaller wars.

Both good.

Phil

Java Card and Liberty Alliance

[Anonymous Coward]

Er, um, isn't this what Java Card and Libery Alliance are about? Nice one Bill, you've "invented" something new again about 5 years after the competition.

Microsoft. Double-plus good chocolate ration increases for Party Members.

Re:Java Card and Liberty Alliance

[Anonymous Coward]

caldera.com eh? The company now known as SCO?! Having the cheek to imply that the M$ solution is the "open standard" compared to the Java one? *sigh*

Re:Java Card and Liberty Alliance

[AndroidCat]

It's only recently that the cards have enough storage to run the .NET framework. :)

Re:Java Card and Liberty Alliance

[Anonymous Coward]

You mean the Liberty Alliance who were setup to copy PassPort?

Well done Open Source, you invented something new there.

Didn't Sun do this 5 years ago?

[the_skywise]

And it was called the "Java Ring"?

Re:Didn't Sun do this 5 years ago?

[Anonymous Coward]

Yes, and if you don't like the ring you can have a card. I have one.

Re:Didn't Sun do this 5 years ago?

[WillerZ]

The Java ring was a Dallas Semiconductor DS1955A iButton in a signet ring holder. The 1955A could only hold one key. The 1955B is a bit more useful, as it can hold about 30 keys. I have the dog-tag holder for it, but I wish I'd gone for the USB fob.

Don't waste your time by getting the parallel-port adapter, as most modern machines seem to have trouble providing enough power to the iButton for the compute-intensive parts of the process. On the last 3 machines I've had it's been impossible to generate keys because the parallel port can't deliver the necessary oomph.

The serial adapter is probably the best bet for iButtons if you want to use them from Unix/Linux.

Phil

That's a myth

[Anonymous Coward]

One of the things such sensors check for is blood flow. So naturally they'll just have to kill you afterwards, but you won't be needlessly mutilated.

The obvious question

[Black Noise]

End of passwords? Umm, so, what is the other factor then?

Axalto's new .NET-based smart card is both a great solution to bring strong, two-factor authentication to the enterprise as well as yet another way for .NET developers to take advantage of their skills and code.

US Military has been using this for years.

[RandoX]

Newer US Military ID cards (~last 2 years)have a 'chip' in them that allow instant login to DOD computer systems. It also stores the user's medical records.

Actually...

[boodaman]

...it's pretty easy, all things considered. Unless the tech has gotten better in the last year or so.

http://www.extremetech.com/article2/0,1558,13919,0 0.aspHere's one article that's 2 years old.

Even simple breathing will do the trick of outwitting a capacitive fingerprint scanner.

There are more resources available via Google.

Mass market, affordable biometric systems are far from being foolproof.

One more thing to lose

[nurb432]

"honey, where is my smart card.. i want to check email"

Doubt that 'yet another external device' is the future of anything..

I rarely use passwords now...

[djmurdoch]

I can't RTFA (it's been slashdotted), but this makes lots of sense, and there *are* open source solutions to this, like public/private key pairs in OpenSSH. I do need to know a passphrase to unlock my key, but then I can log in to a number of different machines with it. In fact, I have my machines set up to not accept password logins except at the console, remote users *must* use key pairs.

Currently I keep a key on my desktop machine and another one on my laptop, but if I was worried that those would be stolen I could switch to a USB key.

Perhaps he advocates no-factor authentication

[Anonymous Coward]

Authentication is potentially based on three factors: Something you have, something you know, and something you are (biometric).

Passwords are the "something you know." That gets us down to two factors. Gates probably also has reasons the others should be eliminated.

Perhaps Gates is ultimately advocating "no-factor" authentication. What are the implications of that?

Certain to change Microsoft's image

[amichalo]

Yes, without those pesky "passwords", security on Windows boxes will once again rival that of Linux, et al.

Passport what?!?!?

[al701]

First it was a single password, and now it is none.

No news is big news...

[supabeast!]

Sun has been pushing smart-card signon systems for years -- along with plenty of little security vendors -- not to mention smart rings, smart money clips, hell, smart anything that can take on a key. Has anyone in the mainstream picked it up? No.

Of course, MSFT has a hell of a lot more clout than Sun, but I just don't see this as being technology that anyone other than a nerd who gets off on RFID actually wanting to bother with.

The Pope has Spoken

[ch-chuck]

Now go forth, all ye' faithful, and code as thy supreme being hast commanded.

Uh huh

[Anonymous Coward]

Isn't this the same guy that said we would never need more than 640k of memory?

Thats stupid

[JustNiz]

Why would I want to have to carry a piece of plastic around just so I can log into my PC?

Also what about the increased security risk because now you have something someone can steal an use?

Passwords are more convenient and more secure because no one can see or steal whats in my head (I hope!).

Re:Thats stupid

[arr28]

Passwords are more convenient and more secure because no one can see or steal whats in my head (I hope!).

You're quite safe so long as you keep your tin foil hat firmly in place.

proclaiming the end

[khrtt]

And passwords can proclaim the end of Bill Gates - with about the same net effect:-) The nifty idea is really nothing more than putting the password on a physical medium so you don't have to remember it. It's an old idea; the problems with it are - you need to carry the damn thing, you need to not loose the damn thing, and you need to get the damn thing out every time you are logging in. The reason your bank's web site offers you to store your credit card number in a cookie is that people object to having to mess around with physical objects when they need to get access...

I'm bored, tell me something new

[djeddiej]

I have a smart card and a smart card reader that I have not used since 1998. I remember I was using it to test authentication technology. I remember writing something for this hardware in Java.

Now I can do it in .NET. whooopeee. Not as interesting as the feedback from the Slashdotted article about finding Atlantis near Cyprus (the discussion devolved into something totally non-related, about Moses and writing. Is that slashdot normal?)

good times

Smart Card software you say?

[Anonymous Coward]

"How long before we can get an open-source version of this?"

This sentence had some typos. I've corrected it:

How long before we can get a knockoff, blatant rip-off of this, like we do every other commercial app?

Cards, dongles have major drawbacks

[gilesjuk]

Hardware security solutions require software to work, software can be cracked, therefore hardware solutions don't work.

Look at dongles and other systems, they tend to be cracked. As long as you can snoop what's going on in the PC you can generally find a way of reading and injecting the required code.

Also what happens if your server in another country goes down and you can't get an engineer to sort it out as there's no local smartcard? why you use remote login with a smartcard. Therefore your access code will be sent down the Internet/VPN.

Bill needs to do some proper R&D instead of spouting obvious potential developments.

It's simple, here we go:

I predict the end of magnetic media.

The mouse will be replaced.

We will get tables where the whole surface is a touchscreen.

Keyboards with changing key caps, the keys alter to suit the application.

etc..

Re:Cards, dongles have major drawbacks

[Anonymous Writer]

We will get tables where the whole surface is a touchscreen.

I've been waiting for that since Star Trek: The Next Generation first came out. I've been wondering why touch screens haven't become a standard. after all, clicking on a button with a mouse is supposed to be an extension of using your finger to click it.

Keyboards with changing key caps, the keys alter to suit the application.

Do you mean little LCD buttons, or just simple illuminated characters that light up according to which one is active?

Re:Cards, dongles have major drawbacks

[gilesjuk]

Yeah and it's feasible to have a touch sensitive LCD table now, just expensive and not much good with coffee cups.

As for the keybord, yes I mean a keyboard where the symbols on the caps can change to suit the application. Be it LCD or some other tech. Obviously it'll be very expensive right now.

Re:Cards, dongles have major drawbacks

[mdfst13]

"Look at dongles and other systems, they tend to be cracked. As long as you can snoop what's going on in the PC you can generally find a way of reading and injecting the required code.

"Also what happens if your server in another country goes down and you can't get an engineer to sort it out as there's no local smartcard? why you use remote login with a smartcard. Therefore your access code will be sent down the Internet/VPN."

That's not how these systems work. It's a challenge/response system. The password is never sent. Instead, they send a packet *encrypted* with the password hash to the smart card. The smart card then decrypts the packet and uses the encryption key inside to encrypt a packet of its own.

Yes, the system can be beaten. Given a couple months and a formidable hardware array, one can brute force the password. That's why you are supposed to change passwords every month or so...to replace any that might have been brute forced in the past.

Aren't passwords safer?

[RAMMS EIN]

I don't know about the rest of you, but I'd feel safer authenticating using a password than using a smartcard, or any physical object that can be stolen.

Of course, you could protect the smartcard somehow...like, with a password.

Re:Aren't passwords safer?

[mdfst13]

The point of the smart card is that it allows you to have only *one* password, which requires the smart card to use. Many people compromise security by choosing passwords that are simple and easy to remember (and reusing the same password in multiple instances)...but also easy to crack. Even if they continue to use an easy to crack password on their smart card, it still needs to be stolen to be useful.

This is more secure because it combines the benefits of two security mechanisms. Physical thieves are unlikely to be versed in password cracking; password crackers are unlikely to be versed in physical theft. Thus, the combined system is more secure than either would be alone.

It's also helpful in that it gives additional time to report the theft. Now, the thief may have a few hours to use the card before you report it stolen. Under this system, they have to crack the password first, then they can use the card. By that time, you may have already reported the card stolen.

Someone above also mentioned the idea of using biometric data to lock the smart card. Yes, biometric data can be stolen. However, it is not likely to be stolen by the same person who casually steals your wallet. Further, linking the biometric data to the smart card means that stealing the biometric data does not do any good without the smart card. Thus, cancelling the smart card (if stolen) confounds someone who stole both card and biometrics.

Java iButton PAM kit URL

[WillerZ]

There used to be a PAM module to use the Java iButton on Linux here:

http://www-users.rwth-aachen.de/dierk.bolten/pam_i button.html

but it's 404 now, and I can't find a live mirror.

Anyone got it?

Phil

Re:Java iButton PAM kit URL

[Tomun]

It's in the archive

Future crackers...

[mynickwastaken]

So, the password crackers will need to cut fingers in future?! How will this be called?! Brute force?!

Re:Future crackers...

[mikechant]

Or the 'stealth' version where they anaesthetise you while you're asleep and you wake up fingerless and eyeless, thinking "Oh boy, that *must* have been some party last night..."

What ever happened to...

[truthsearch]

Whatever happened to checking a user's authenticity by analyzing typing style and rate? There were studies which proved it was almost always correct. I'm sure in a practical situation they could be made 99.999999% correct. So how come we don't see it anywhere? At least not publicly.

As for the card, just like everyone else I'm not impressed. Bill really needs to get out more. He's really out of touch.

Length of Time?

[Piranhaa]

How long before we can get an open-source version of this?

Who knows? Bill was telling me it wont happen, and Linus told me next week!

Re:How long before we can get an open-source versi

[isaaccp]

I've not read completely TFA, but you can authenticate with a USB pen in Linux using the PAM USB module.

The joy of smart cards

[Vraylle]

The local Air Force base here went to full implementation of smart cards for logins (the cards double as their building IDs). It was a debacle...they were recognized by the readers about 20% of the time, and misread another 60%. They finally modified the login to allow them to Cancel the smart card scan and log in manually while they slinked off in defeat.

Re:The joy of smart cards

[Blitzenn]

To bad they purchase the Chinese cards. If they had bought the ones made in the US, they work 99.9% of the time.

640k

[RasendeRutje]

In earlier news Bill Gates proclaims: "640K ought to be enough for everyone"

Re:640K

[Anonymous Coward]

It's great that you've stopped listening to the man who created the most successful software business in the world because of a fallacy.

Feel proud.

We've killed it

[Anonymous Coward]

Bill Gates Proclaims End of Passwords
Slashdot Proclaims End of Techworld.com

Smartcard?

[wertarbyte]

How much memory does such a smart card have? Around 640k? That shoud be enough for anyone I guess...

also in Java flavour ...

[gerbouille]

Axalto has developed a Java-based version of this card, too.

At least...

[thegnu]

...give him a break on that one. Those words will haunt him the rest of his life. When was the last time you said something stupid?

Because I just did.

And over in Java...

[MosesJones]

A classic case of Billy boy announcing something everyone else has. I saw a demo by Sony about 2.5 years ago now which demonstrated smart card + biometrics as an authentication mechanism.

Something like 98% of the world's new smart cards run Java as their programming language, and there are defined standards for security around it. This stuff is already being used in the wild, for instance by the DoD. Oh and if you have one of those "Blue" or clear Amex credit cards... its running Java too.

Or of course you could wait for Longhorn.

In terms of open source, you can do this in Java (which is published and the source is accessible), today.

I love Microsoft, "yesterday's technology, tommorow".

Re:And over in Java...

[MikeBabcock]

Microsoft is good at taking something that exists, doing their own version of it, then spending huge money marketing it to people who've never heard of it.

This is actually a valid business model to some degree.

For those of us who don't like it, we've failed the world by not telling them about these things before Microsoft did.

Kerberos pre-existed Win2k3 by a long shot and directory services pre-existed it too. But who bothered telling the users that?

Re:And over in Java...

[jayp00001]

It also cost Amex 2 years and around 100G just to get folks to write some apps that used the java on the amex card to do anything remotely useful. The relativly new thing is that because it's on the .net platform, the changes (if any, and I can't stress the, if any, portion enough), you have to make to your code are just a few lines.

Re:And over in Java...

[Eraser_]

Just as an aside, I've seen another neat application of java smart cards in the form of buttons. At the high school I work at we have lockers for the terrorists...uhh...students to stash their books, drugs, guns, etc. Most of the lockers are your standard lockers with dialed combinations and a key for "administrative override". Each of those lockers has 5 combinations in them which is rotatable by the admin key.

Regardless. Some students here do not posess the mental or physical capability to work said dial lockers, or a keyed lock (sorta). So these have iButton readers in them, and the students have ibutton dongles. They, or their aide, presses dongle into locker reader, and the lock pops open. Students are happy, the aides are happy, and the ADA is happy.

Microsoft will get this technology deployed out to people who run 100% windows shops, sending companies comp samples for the various VP/C?O's to work with, and they will think it's the coolest thing since sliced bread. Business weekly will run a 3 page ad from microsoft on it, so all the little PHB's of the world can read it and insist that its better than the rest. Admins will be forced to use it because the regular old smart card tech will need some driver or whatever, while .NET enabled ones will work because of a critical security update pushed out.

Maybe I'm still just bitter about the GDI+ detection tool.

The question still remains...

[merc]

How does this protect us from Microsoft?

I for one, do not welcome our .NET overlords

[Anonymous Coward]

Ah,

Thanks, but no thanks...

MS has enough power already without
giving them all the passwords in the world...

Gates, Ashcroft, hot damn!

[Faust7]

Ashcroft ends crime and terror, Gates ends passwords... what's next? Flying cars? A cure for cancer? Plutonian colonization?

And with that..

[Anonymous Coward]

..Windows Update automatically unlocks every XP machine in existence.

Thanks, Bill.

7 years behind

[Anonymous Coward]

Card support was in Java some time in the last centaury also. 1997 was it? Good to see Microsoft is so close to the cutting edge as ever.

tyranny of the monopoly majority

[Doc Ruby]

As usual, Gates has decided that the lowest common denominator of sophistication will dumb down computing for everyone. I don't want to have to carry around a smartcard, or anything else. Who wants to find their smartcard somehwere in their apartment early in the morning to check their email before their cup of coffee? Who wants their girlfriend to "borrow" it to check that email before that cup of coffee, before they wake up? How much identity theft will be perpetuated in the name of Gates' "convenience"?

The best access solution is a combination of HW token, biometrics and password. Two out of three should gain access to all but root, sending a message to the administrator (possibly attaching a picture, voiceprint and GPS). Too bad for Gates that this security architecture makes a mobile "phone" the best gatekeeper to cyberspace, where his Windows monopoly is most under threat. Too bad for us that his monopoly is in a position to derail even that engine of progress, making mobile phones as much a mess as Windows. Someone stop him before he destroys yet another dream of freedom!

Re:tyranny of the monopoly majority

[advocate_one]

well, perhaps to avoid the necessity of having to find your pass before you can use your computer, the next move will be to ditch the pass entirely, and have an rf coupled chip version implanted that responds everytime it is challenged, in a sequence determined by the time of day, phase of the moon, combined with your encryption ID, which strangely enough is also the same as your SSN

Re:tyranny of the monopoly majority

[Doc Ruby]

They'll be 2-way RFIDs that harness our nervous systems in a massively parallel biocomputer that calculates the interest on Gates' fortune.

Re:tyranny of the monopoly majority

[koniosis]

I have to take security passes to work, which have both proximity and swipe access, in conjunction with a PIN. I have to take the cards to work everyday, everyone wears them round their neck, since they are also photocards, without them we can't even get in the front door of the office! I have no problem with this, and I've yet to not take it with me, like wearing shoes to work.

Re:tyranny of the monopoly majority

[Doc Ruby]

Yeah, I've used synchronized RSA crypto keycards, too. We're professionals, and they're part of our gear. The difference between keycards and shoes is you'll notice you forgot your shoes before you get to your office. And the difference between keycards and good security is that some of us don't need keycards, but we all need good security. Adding keycards to the mix would be fine, but requiring them of everyone is a straitjacket, even if the majority would be better off. BTW, how will you feel when your Microsoft keycard is your universal ID, the join key ID that bridges all the firewalls to all your personal data in every database on the planet?

This will be good

[bash_finger]

Then I won't have to keep entering my Banking and eBay details every time they send me an email to confirm my account details.

PIN "number"?

[DamienNightbane]

You do know that the "N" in PIN stands for "number", don't you?

Re:PIN "number"?

[erlenic]

Maybe he has multiple PINs, and has decided to number them...

Re:PIN "number"?

[Anonymous Coward]

stfu, mr. not-so-smartarse.
people still say number because it doesnt seem to make much sense otherwise. just like "IP protocol", or any other protocol, "PHP" (which stands for "PHP: Hypertext Preprocessor"), and a trillion other things, fuck off and go play with traffic. noob.

Re:PIN "number"?

[DamienNightbane]

Funny, I've never heard anyone say "IP protocol". Do the voices in your head ride the short bus too, or is that just you?

Man in the middle attacks?

[AndroidCat]

What happens when you use your card on a PC that's pwn3d by dozens of pieces of spyware? Does the card use VPN or some kind of encryption wrapper that protects the link between the card and the other end even from a haxored PC?

Re:Man in the middle attacks?

[Anonymous Coward]

lol, yeah i agree, gates & msft better so something about thier insecure kludge they call a OS before they start telling others how to take care of thier authentication...

Re:Man in the middle attacks?

[AndroidCat]

It's a valid question for any OS. A root-kit'ed Linux box has the same problem. If this system depends on trusting the PC, then they've installed an armour door on a straw house.

Re:Man in the middle attacks?

[pesc]

What happens when you use your card on a PC that's pwn3d by dozens of pieces of spyware? Does the card use VPN or some kind of encryption wrapper that protects the link between the card and the other end even from a haxored PC?

A smart card contains a microprocessor that can sign stuff that the PC send to it. It contains a secret private key for signing that never leaves the silicon, so no PC can get at it.

The viruses can't steal the identity in the smart card. The smart card will happily prove its identity to the viruses. The important thing to understand is that while the smart card can prove its identity, it can't prove that its owner is actually at the keyboard or that the IE session withdrawing funds is run by a human in charge of the transactions... There are smart cards with built-in keyboard/display for that. Or you use a Palladium PC...

Re:Man in the middle attacks?

[heathm]

The problem is that if I insert my smart card to do a valid transaction and I've got spyware that steals my PIN to the smart card, the spyware can now access my smart card and do what it wants with it.

To securely access a smart card, you should use a smart card reader that has a built in number pad for entering PIN's that communicates with the smart card WITHOUT going through the user application. This way you can be assured that no one but the smart card gets your PIN (unless the smart card reader has been compromised or you have someone looking over your shoulder.)

Entering anything into the keyboard should not be considered secure (especially on Windows with the proliferation of spy ware on that platform.)

What's this?

[Anonymous Coward]

How long before we can get an open-source version of this?

Open-source geeks now want Gates technology? I thought everything that deals with Gates was EVIL and the open source crowd always had a better way? The more I see of the "open source revolution" the more it looks like Windows all over again except cheaper.

Mod me as a troll, but you know it's true. Anything that has ever had the "wow cool" factor with Windows has been leeched by the Linux heads as they scream that Windows will be the death of us all.

Biometrics are not sufficient by themselves

[CoderDevo]

Biometric fingerprint readers have been hacked by copying a fingerprint impression from a plastic-like mold and even by just lifting the fingerprint off of a glass and manipulating that image into a physical mold.

Something you have, something you know.

'Something you are' is just another form of 'something you have'. The limitation of biometrics is that 'something you are' cannot easily be decommissioned and reissued if it has been compromised.

The key to good security is to have the strength and number of controls increase as the value of the protected contents increases. A password alone may be perfectly appropriate to protect low value content.

Re:Biometrics are not sufficient by themselves

[AndroidCat]

The press release (the first link is fubar) didn't mention anything about defence from man in the middle attacks. Like, maybe, from a PC with dozens of trojans and spyware apps running...

They also have to protect the process of security verification. The card is a seperate black box, but I wonder how good the link protection is through a compromised PC.

PAM does this for linux

[Lorphos]

Pluggable Authentication Modules Want a new method of authentication? Just write a PAM module!

how about the end of Bill Gates?

[Anonymous Coward]

He could retire and spend his money saving ill children around the world. And the let the computer evolve free of MicroSoft domination.

Open Source Alternative

[tdc_vga]

Why not checkout Java? The Java Card system or the JAAS module for J2SE. Sun's machines have been doing this for years now. In fact, if you walk into any Sun office checkout the machines sitting in the lobbies; they'll have a smart card reader attached for people to walkup, and load up their desktop/settings using their smart cards.

Smart Card Module for J2SE:

http://www.gemplus.com/smart/r_d/publications/pdf/ GG00jaas.pdf

Cheers,
Tyler

Bill Gates Proclaims "No one needs more than 640K"

[sir lox elroy]

Oh yah he was wrong right? :-)

Why change?

[PhotoBoy]

Isn't this just replacing "I forgot my password" with "I lost my smart card"? And cards will cost more than passwords to change, unless MS plan to bring in a per CPU licence fee for password changes.

for corporate use

[Dr.Opveter]

I like the idea of using keycards or something for logging onto the computers at work. Usually employees already have a card they clock in with, get coffee at the machine, pay lunch etc. Why not use it also on the computer. Saves the helpdesk a lot of trouble on mondays unlocking accounts after another mandatory password change on fridays..

Bill is good at a lot of things...

[Nijika]

...but predicting the future isn't one of them. He does have a talent for molding the present to suit him, but he's more miss than hit when it comes to being an oracle of progress.

He's of course thinking about public/private keys and such, but they're overkill for almost all web-based applications that don't require money. Do you really want to use a public/private keyshare to log on to like, well for example Slashdot, just so you can post how wrong Bill Gates is?

I know I wouldn't. Fhew!

Re:Bill is good at a lot of things...

[Proney]

Do you really want to use a public/private keyshare to log on to like, well for example Slashdot

Well, the original owner of the account of this post might...

Here it comes

[Hugonz]

Time to burn some karma...

Rev 13:16 And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads:
Rev 13:17 And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name.
Rev 13:18 Here is wisdom. Let him that hath understanding count the number of the beast: for it is the number of a man; and his number is Six hundred threescore and six.

In other News...

[DarthVain]

No one will ever need more than 640k...

password strengthening / stretching

[_|()|\|]

they should be innovating new technologies that make machines insensitive to dictionary attacks

Dictionary attacks were difficult in the olden days, because password hashes were expensive to compute (on the order of a second each). Hardware has caught up, so that hundreds of candidates can be tested per second.

Password strengthening is a scheme that adds a significant amount of random salt to the password. To use the password, you have to brute force the salt. This slows down legitimate authentication, but it also slows down a dictionary attack.

Stretching is a special case of this scheme that uses repeated hashing, instead of random salt. Instead of storing the hash of a password, store the hash after a couple thousand iterations. If the algorithm is good, there is no shortcut to the end hash value.

If it hasn't been done already, I imagine it would be a simple matter to implement as a PAM module.

Re:password strengthening / stretching

[JettLogic]

Idea! (may not be new)

Use stretching, but store after a random number of hashes spanning an order of magnitude. That way incorrect passwords will always take the longest amount of time to check.

i have to agree

[Anonymous Coward]

with the luddites...

An advert from the future....

[mikael]

.NET smartcard - your passport to the universe

Brought to you by guy that missed the Internet.

[jotaeleemeese]

Gates would be funny if it was not for the fact that he has influence and power.

actually....

[wild_berry]

It's apocryphal, but Bill Gate's number is not that one. Nearly: Six hundred twoscore.

The finger...

[Anonymous Coward]

I assume a fingerprint is used to unlock the card. If so, does this mean that Bill just gave everyone the finger?!

Passport was Supposed to Get Us Down to 1

[Greyfox]

But I wouldn't trust that thing farther than I can spit a rat. Billy Boy and his company are not my first choice when I'm worried about security.

It's been pretty easy to add biometrics or hardware keys to your system now. Hell, you can hit thinkgeek and find no less than four devices, although they all appear to only work with Windows. I've seen fingerprint scanners working with Linux at past trade shows too. But of course the idea's not going to catch on until Microsoft "invents" it.

From the high visionary

[bitswapper]

"No one will ever need more than 640K of RAM."

"Windows is stable and secure"

"Paper is dead"

Lets hear all the other insights of genious dripping from his bottom lip....

Re:From the high visionary

[doon]

I remeber this one when that book was on my bookshelf at IBM Research.

"I believe OS/2 is destined to be the most important operating system,
and possibly program, of all time. As the successor to DOS, which has over
10,000,000 systems in use, it creates incredible opportunities for
everyone involved with PCs."
-- Bill Gates, from "OS/2 Programmer's Guide" (forward by Bill Gates)

He now agrees with RMS

[Anonymous Coward]

Gates now says "Just press enter for your password"

OT: A.C.R.O.N.Y.M.s

[tigre]

Acronynms Can be Read Out, so it's Not what You think it Means.

The term "acronym" originally referred ONLY to abbreviations that formed pronounceable words, such as RADAR, LASER, SCUBA, NATO, and even GNU. The term for an abbreviation made up of initials is an "initialism". However, due to common usage, the definition of "acronym" was weakened so that most people understand it to mean the same thing as "initialism".

In Soviet Russia ....

[gstoddart]

Passwords proclaim end of you!

=)

What a choice!

[DrDebug]

Hmmm.... Tough choice....

Use passwords?

or

Sell your soul to Microsoft and let them proxy your most trusted information for you?

Hmmm....

Yes, this is a REALLY tough choice...

Just what I need...

[Dracolytch]

A physical object that can be taken from me, so that when someone steals my wallet, not only do they get my IDs, credit cards, and cash, but they'd also get access to all my e-holdings as well.

Fuck that.

~D

In Soviet Russia...

[Anonymous Writer]

Passwords proclaim end of Bill Gates!

passwords will never go away

[241comp]

Nope, this won't end passwords. For security, you have the following 3 options: something you have (smart card, signature), something you know (password, passphrase, PIN) and something you are (fingerprint, retina scan). For non-vital information (your hotmail account), choose one. For important information (medical, financial) choose two. For vital information (mission-critical applications, firing mechanisms, creating a will) use all 3.

Re:passwords will never go away

[Anonymous Coward]

For vital information (mission-critical applications, firing mechanisms, creating a will) use all 3.

(at the risk of posting non-PC material on /. [gasp!])

Sorry, when it comes time to unload the shotgun into an intruder in my house, I'd rather not be prevented from doing so because:

a) The key is somewhere else, defeating #1
b) I can't reiterate what I need to remember fast enough, defeating #2
c) There's blood on my finger, defeating #3

I'll take personal responsibility instead, any day and every day. If I whack my wife by mistake, shoot me :)

Re:passwords will never go away

[241comp]

I would think that calling it a firing mechanism rather than a trigger would indicate that I'm talking about something like an intercontinental ballistic missle - not your shotgun. Perhaps with all the morons promoting "gun control" these days that was a foolish assumption. Obviously, the need to immediately defend ones self outweighs the possiblity of unauthorized use when talking about a personal firearm. The opposite is true for a 25-megaton nuclear warhead.

Always catching up

[Doc Ruby]

Why wait for Microsoft's implementation, which will probably require WinCE or something (Passport for .NET for Windows for Passcards for Single Signon Computing) on the smartcard, driving up the price? All for that Windows logo that means it's not really secure, but will crash your car when you leave it too close to the stereo. You can already authenticate, over Bluetooth, without passwords, from your "universal remote" (mobile phone). It might not be tested secure, yet (relying on Bluetooth encryption), but when has that ever stopped Windows?

Keys and the Mind

[ashwinds]

Why did we not think of this before? We could have just had locks to the building, room, PCs - which open with a single Key :-) Naah passwords are not passwords - they are verification of the mind which thinks up a unique password.

One More Screen Door

[webzombie]

In front of the vault is not going to make a difference!

Dot Net...or NOT! :-)

How long before.... ?

[rainer_d]

I once talked to representatvies of a vendor/integrator of cryptographic smartcards.
I also talked about Linux/OpenSource with them and it's not that they hate Linux and love MSFT - it's just that for any serious use (read: digital signatures, use of the smart-card instead of your written signature), any "applets", any application, and any hardware has to be "certified" for a specific platform.
With this certification-process, the vendor testfies that the software and hardware work as advertised and no "unpleasant surprises" happen.
Unfortunately, this is time-consuming and thus very expensive - and must be re-done for every platform. Naturally, smartcard-vendors only certify for the platforms where they have sufficient demand (XP, W2K).

About the only chance that something like this is going to come to the OSS-world is that someone is putting forward a lot of money and essentially pay the vendor for the certification.
In Europe, usually the taxpayer does something like this, but in slashdot's home-country, I hear that the government spending money for "the common good" has recently escaped the mind of the general public who instead believes in privatization, tax-cuts and "trickle down".
You can probably imagine when such a thing will "trickle down" onto OpenSource-software ;-)

cheers,
Rainer

End of passwords....640K...windows 0wnz u...

[carlmenezes]

yeah, he's made a lot of proclamations.

"How long before we can get an open-source...

[stankulp]

...version of this (smart card)?"

The Smart Card Simulator

Extremely irritating when i tried it...

[carlmenezes]

square 1: ...u insert this smart card and then Windows goes "Windows needs to be restarted for your hardware to work properly. Please remove the smartcard and click OK to restart" ..restart...back to square 1.

smart card assumption

[MattCohen]

One of the assumptions of a smart card solution (or a USB solution or a biometrics solution) is that the user has access to a computer that supports such a solution. In my business, I deal with mobile professionals that use many computers and other devices, many of which they do not control and could not install hardware or software on to support those types of authentication tokens, even if they were technically capable of it. For those types of applications, standalone keyfob type tokens (Secure Computing, RSA, etc.) still seem to be the best choice.

Anybody else notice this came from a French co.

[Baumann]

You know, the land of weak encryption or die? I have to wonder just how effective a smart card can be from a country that doesn't allow it's people strong personal encryption.

Re:Anybody else notice this came from a French co.

[mikechant]

Most of the French crypto restrictions were removed in 1999. E.g. see http://www.sobco.com/nww/1999.edited/04-crypto.htm l
and some of the other articles found by googling for "france encryption restrictions relaxed" or similar

RIP

[Shadow_139]

What is the only Admin dies, in a ball of flames from a following Airplane shot out of the air by the US army.., or shot by the RIAA for downloading some crap file the same name as some crap film a US company made 20 years ago and think they own all right to the name forever......

640K

[Thinman]

I've stopped listen' to old Willy since the 640K comment.

What Happened to Passport?

[The Angry Mick]

Bill is good at a lot of things...but predicting the future isn't one of them.

I'll say. Here's a personal fave:

"No one will need more than 637 kb of memory for a personal computer."

And somebody correct me if I'm mis-remembering, but didn't he also predict the death of the password back when he was pushing MS Passport some years ago?

Re:What Happened to Passport?

[mdfst13]

As has been pointed out many times, Gates never said, "No one will need more than 637 kb of memory for a personal computer." It's just a story.

Axalto in Spanish means...

[Guillermito]

Well... it means nothing, but it sounds like asalto, which means mug. I find it to be a well suited name for any Microsoft partner.

hardening windows

[Keruo]

Instead of using plain card authorization, I'm using third party software from inflexpoint, which offers usb key login.
This software allows me to embed user accounts to certain usb mass storage and if the usbkey is removed from the port, the machine automatically logs out current user and refuses to login another unless the correct drive assigned to the account is connected to the machine.

In addition to the token+password login, I'm using the EFS which is built-in to xp, which encrypts all my files with aes-256 on the fly.

Only downside is that currently the software doesn't support domain logins properly, so I have to manually mount all network drives but that's rather small annoyance for the cheap security it provides.

Zemplar Proclaims End of Bill Gates

[Zemplar]

...eventually.

And I suspect many /.'ers would rejoyce.

Translation of phrase "Bill Gates Predicts"

[jridley]

... or "Bill Gates Declares"

translation:

Bill Gates has some new thing he wants to sell, which might be able to replace some tried-and-true technology.

Cheaper Low Tech Alternative

[rseuhs]

Forget hardware keys, I got something much better (and cheaper):

Take a piece of paper and a paper envelope. Write your password onto the piece of paper and put it into the envelope.

This provides the exact same security as a smartcard.

Re:Cheaper Low Tech Alternative

[wertarbyte]

Take a piece of paper and a paper envelope. Write your password onto the piece of paper and put it into the envelope. This provides the exact same security as a smartcard.

No it doesn't. There is no way of breaking the envelope and retrieving the passphrase. Smartcards (at least the ones I encountered) work by cryptographic challenges (think SSH key auth). The private key is stored on the card, and only/i> on the card. It is also locked by a PIN. Even with the PIN, you cannot retrieve the key: The crypto secret stays completely inside the card, and if your cardreader has got a numeric keypad, the PIN as well won't even leave the combo card/cardreader. The reader I got here for HBCI banking is also sealed by the company to avoid manipulation.

Re:Cheaper Low Tech Alternative

[ObiWanKenblowme]

You mean I can read the data on a smart card just by holding it in front of a bright light?

Re:Cheaper Low Tech Alternative

[pjt33]

That's what the smartcard manufacturers say. It's not what security researchers say.

Re:Cheaper Low Tech Alternative

[merlin_jim]

There HAS been some success in using high intensity visible and short-wave em to photograph the chips inside smartcards, reading out the ROMs.

I even seem to remember someone who had developped a method to read the contents of flash RAM inside the smartcard...

*rolls eyes*

[bruns]

"640kb should be enough for anyone"

Need I say anything more?

Got any other predictions Billy Boy?

Re:*rolls eyes*

[CaptainTux]

Yes, you need to say much more...

While I am no fan of either Bill Gates or Microsoft I am very tired of seeing people trot out that old quote as proof that Gates' is a looney, untrustworthy, or someone who always miscalculates things. Yes, he said that. Yes, he was wrong. Yes, it seems silly today in an age where computers routinely come with 512MB of memory. But when this statement was made, it was a reasonable assumption.

I remember when "state of the art" PC's came with 40 MB hard disks and 16MB memory. I also remember having *thousands* of applications and files on that PC. Now, a single application can take over 100 MB and require more than 128MB memory. And this isn't ancient history either; I'm 30 years old and actually *owned* a PC with those specs.

At the time when Gates made the statement it was nearly impossible to envision a situation where one *would* need more than 640k of memory. IBM once said that the reason they didn't enter the PC market earlier was because they didn't believe a personal computer would ever actually sell. Why don't we see constant quotes of that?

People are wrong sometimes - even smart people. Making one (or even a few) stupid or incorrect statements doesn't mean that *everything* they say is wrong even 20 years later. Get over it people. If this is the best you can come up with to refute what he is saying then you need to just leave it alone.

sex vs. email

[redfenix]

Anyone willing to wager which happens more often in the slashdot crowd? (autonomous sex excluded.)

all 640k of it!!!!

[Anonymous Coward]

no end to prophecies by billy. what are his other predictions gone phut? does anyone have a tally of that ? wonder why people fprget it so soon!!!

Great deal for foreign goverments

[bitswapper]

If I was a non-US governmental entity, I'd love to give the access methods for all my data to Microsoft. After all, don't they make the most secure software in the world? And, its not as though they have some kind of official tie to the US government or anything like that...

It is called Kerberos

[LakeSolon]

Linux already has this sort of technology, it is even interoperable with Windows, Solaris, UNICOS and AIX. It is called Kerberos.

Re:It is called Kerberos

[cpghost]

Right. Though Kerberos existed even before Linux ;-)

Blowing smoke

[Anonymous Coward]

Bill is just blowing smoke. He'd rather y'all laugh at him or at ol' monkey boy than spend time with MS' anti-trust trouble in Europe, MSIE's security problems, XP SP2's incompatiblities and security problems, or ,worst , Linux or Free / Open Source Software.

Reminds of of an old AI story

[droleary]

A group of students are working on a neural net project. It comes time to decide what weight to put on the initial connections. One student says, "Set them all to 0 to start." Another student says, "No, that will introduce bias. We should set them all randomly." The smart professor replies, "You'll still have bias, only you won't know what it is."

So to Mr. Gates I'd like to reply: You'll still have a password, only you won't know what it is. Makes sense from a "security through obscurity" standpoint, though! :-)

Re:Reminds of of an old AI story

[bushidocoder]

Any time you have secrets, its not security-through-obscurity. Security through obscurity is any time you try to make a secret out of something that is trivially discovered. Real security almost always relies on secrets, and if those secrets are protected in a reasonable way that makes them very difficult to uncover, the security can be a meaningful protection.

With a proper smart card, uncovering the secret means stealing the smartcard, cracking it open, and attaching it to a device that can extract the private keys in the physical device. That's certainly not easy. I've seen schemas for secure devices that require three keys to respond to a challenge - two of which are on the smart card, and one of which is on the pc that the smartcard will be attached to. I'm no cryptoexpert, but an algorythmic weakness notwithstanding, that seems to be a real meaningful way of authentication.

Re:Reminds of of an old AI story

[Anonymous Coward]

If you're going to tell old stories, you might want to credit the source, Danny Hillis.

Re:Reminds of of an old AI story

[droleary]

Any time you have secrets, its not security-through-obscurity. Security through obscurity is any time you try to make a secret out of something that is trivially discovered.

But isn't that the case here? If I can social engineer a user to give me their password, adding a smart card into the mix is merely a type of obscurity. This is especially true for all the one-time authentication systems out there (i.e., you only have to validate once at login). While it's true that a smart card means you'll limit access to just that single session (or risk further social engineering attempts), the same level of secrecy can be had from any single-use password system. All the card provides is a way to keep the users from knowing their next password. I'm not even saying that kind of obscurity is a bad thing, just that it doesn't necessarily mean things are a lot more secure, anymore than it means that passwords are a think of the past.

Re:Reminds of of an old AI story

[bushidocoder]

From a social engineering perspective, the secret becomes "more secret". The secret is a key nestled inside the smartcard. A user can't reveal the secret because even they don't know it - certainly, they can give someone their smartcard, although I think that from a social perspective, you'd have alot harder time convincing a stranger to give you their car keys than give you their password - people know how to protect physical things.

The user can't inadvertantly reveal their secret, and malware on a machine connected to the smartcard can't uncover it. Also, you can't run dictionary attacks against a key that can be made as complicated as neccesary since a person doesn't have to remember it. I think that's a level of secret protection far above and beyond simple passwords.

Re:Reminds of of an old AI story

[droleary]

I think that's a level of secret protection far above and beyond simple passwords.

And that's the danger. You think something you cannot audit gives you better protection. That is the very definition of security through obscurity. You don't realize it, but you're making my case for me. You seem to think knowing how a simple password is vulnerable is worse than not knowing how a smart card is vulnerable. That is laughably wrong. I really hope you're not in charge of keeping any system secure.

Re:Reminds of of an old AI story

[bushidocoder]

You love this phrase, "security through obscurity". I've never met a security expert who would consider dual private key challenge response encryption schemas security through obscurity - they're not because they're only vulnerable to the algorythmic weaknesses of the encryption method in use. Smart cards are a fantastic system for key management because they do an amazing job of protecting keys. Deployed smartcard authentication systems are generally only vulnerable to key spoofing (which is a failure of the algorythm behind the authentication, NOT of the key storage mechanism) and vulnerable to physical decoding if the card is stolen, a point which even the PR guys in most smartcard vendors will stipulate. Are they perfect? No. But there exists no perfect security system in the IT world.

The crack about hoping I'm not in charge of keeping systems secure is immature - if you think there are perfect ways of securing assets, you're the dangerous one. It says something about the method that, individual vendor problems ignored, there exist only two general attack vectors against challenge-response smartcard systems after over a decade of them having been fielded in critical positions in the US (I have no idea who/when they've been used outside the US). Heck, you can consider the worldwide GSM phone network a challenge response smartcard network, and after all the time its been up there's still only those two attack vectors on it. Like I said, I'm not a security expert, but I'm not aware of any other key management method for networked systems that only has two vulnerable surfaces, neither of which is a cakewalk. There's like 6 attack vectors on biometrics (not to mention the fact that biometrics do not allow for secrecy recovery after being compromised), and biometrics have been fielded for a substantially shorter time than smart cards have been.

So let me rephrase what I said before - Given proper implementation, I KNOW its a level of security far above and beyond simple passwords. Perfect? No. Better? Significantly. Best solution out there? Depends on the social requirements of your group, whether or not its reasonable to expect you to have your smartcard. But it is a battle-tested approach that's been very successful in deployment, and continues to be a favored system of authentication at the NSA and the Pentagon, two institutions who've spent quite a bit more brain cycles thinking about this problem then I'm sure you or I have.

Re:Reminds of of an old AI story

[droleary]

You love this phrase, "security through obscurity". I've never met a security expert who would consider dual private key challenge response encryption schemas security through obscurity

That's funny, because I've never met an actual security expert who didn't understand that all security is based on obscurity (i.e., it's the very nature of keeping things secret). I guess we must know very different manner of experts, but I must say your talk doesn't instill me with confidence in yours being able to get the job done right. If it seems I use the "security through obscurity" phrase more than necessary, it's because it is a favorite on Slashdot and I'm not above pandering to the crowd. The key difference, though, is that the obscurity that people around here harp on is kind that leaves unintended access holes, not the kind that are understood imperfections.

Deployed smartcard authentication systems are generally only vulnerable to key spoofing (which is a failure of the algorythm behind the authentication, NOT of the key storage mechanism) and vulnerable to physical decoding if the card is stolen, a point which even the PR guys in most smartcard vendors will stipulate. Are they perfect? No. But there exists no perfect security system in the IT world.

Right, which is why you shouldn't be so aggressively trying to defend smart cards when in reality they offer little beyond what a manual one-time password offers, yet come with oh-so-many-more holes. It's like you're trying to argue that a fair algorithm is better than a shitty one-time pad, so people should stop using pads. That might be convincing to people without real secrets to protect, but I know bettter, and I'll take a fair one-time pad over any shitty smart card, and I have to assume it's shitty because the operation is usually completely black boxed.

So let me rephrase what I said before - Given proper implementation, I KNOW its a level of security far above and beyond simple passwords.

That is by no means a given, and that is why I consider your viewpoint to be so dangerous.

But it is a battle-tested approach that's been very successful in deployment, and continues to be a favored system of authentication at the NSA and the Pentagon, two institutions who've spent quite a bit more brain cycles thinking about this problem then I'm sure you or I have.

More importantly, they're the types of organizations that don't take anything as a given. If they use a smart card, you can damn well bet it is built to their specification. The rest of us are stuck with off-the-shelf stuff we really, really can't trust if we want to be honest about a system's security.

Re:Reminds of of an old AI story

[bushidocoder]

More importantly, they're the types of organizations that don't take anything as a given. If they use a smart card, you can damn well bet it is built to their specification. The rest of us are stuck with off-the-shelf stuff we really, really can't trust if we want to be honest about a system's security.

Fair statement - I'm not jumping onboard the one BillG is talking about. I don't know anything about it. I'm just saying that the method (not any specific implementation) is historically sound. We're in total agreement if this discussion is about blackbox security systems - I'm sure both of us would immediately write off an encryption algorythm that wasn't publically available for the same reason.

It is a different approach from one-time-passwords, and I don't think either is better than the other universally. They're both reasonable ideas to approach the same problem. I hope I haven't given the impression that I think smart cards are THE answer - they're not. But I do strongly believe they are one of several valid systems for authentication that are all universally better than the username/password shit we're using across the board today. That said, most one time password solutions I've seen are vulnerable on more surfaces than smartcards - Like smartcards, they're vulnerable to stealing the physical generator, and like smartcards, they're also algorythmically vulnerable (although in the case of most one time password solutions, its vulnerable to predicting the sequence) - In addition, many are vulnerable to dictionary attacks in the window of oppurtunity that a password is valid. Also, because the server performing the authentication must be able to validate the password, many of the implementations I've seen have their private keys in both the generator AND the authentication server. They're often vulnerable to the password being intercepted and being reused within the same window. Lastly, they're still technically vulnerable to the same social engineering attacks that passwords are because at some point in the data flow, the user has knowledge of the secret.

That said, I suppose a one time password can be implemented via a shared public key policy that would allow each asset to individually guard its own private key, but my gut impression is that you're restricted in keysize based and potentially more algorythmically vulnerable simply on the fact that no one wants to type a cypher phrase that's 8 paragraphs long, and you're restricted by the combinations of ascii values. I might be wrong on that - like I said, I'm no security expert, this is just based on what I've learned about the technologies on my own time. You can also defend against the interception vector by immediately making a password invalid the second there's a successful login, but that system will have limitations as to its uses - you'll need to dramatically shorten the window of password oppurtunity for it to be useful in many arenas.

I disagree with the assertion that all security is security through obscurity. It makes the expression meaningless, and its an important little catchphrase. True, all information security is based on secrets, but secrecy is not neccesarily obscurity - obscurity more often than not implies a heuristic pattern approach that's easily uncovered once you discover the known method of decyphering the message. Respectable encryption is strengthened by the number of people who know the method of decyphering the message - but the standard method is protected because even if you know the process, you have uncover one or more protected secrets in order to reveal the secret message. Granted, in encryption there is always the possibility of another method out there that can break it, but unlike security through obscurity, no one (including those responsible for the algorythm in the first place) knows whether or not such a method exists. As such, until the method is discovered, its reasonable security when employed correctly.

There is a fundamental difference between an encrypted channel garage door opener and hiding a key under the doormat.

Re:Reminds of of an old AI story

[droleary]

It is a different approach from one-time-passwords, and I don't think either is better than the other universally. They're both reasonable ideas to approach the same problem.

I think we agree more than we disagree. My biggest beef is with Billy, or anyone, touting smart cards as the be-all, end-all of security. They definitely have their uses, but they also have some very real weaknesses. From an "every day" standpoint, they are almost certainly better than most password policies most places have. But if it gets to the point that security is so unacceptable with user/password, I just think all appropriate solutions should be considered instead of just going for smart cards.

I disagree with the assertion that all security is security through obscurity. It makes the expression meaningless, and its an important little catchphrase.

It's only a catchy phrase, so it simply can't tell the whole story. The real issue is in what is obscured when protecting a secret. As you say, obscuring the algorithm is bad, but obscuring your password/phrase is, of course, good. Smaller secrets obscuring bigger secrets, as it were.

There is a fundamental difference between an encrypted channel garage door opener and hiding a key under the doormat.

Different isn't enough; we need to talk better. We both know that to do that requires knowledge of how each system is implemented to figure out the weakest vectors of attack. After all, finding my key under the doormat only gets you into my house, whereas finding an especially poorly implemented garage door opener system can get you into thousands of totally unsuspecting homes. Not to mention you have to target me to know I'm hiding a key, whereas a universal crack become something of a crime of opportunity (i.e., it might have been cracked for some other target and I'm hit afterwards just because I'm easy pickings).

SSH keys

[zoeblade]

Don't SSH keys already provide an alternative to passwords for both shell access and file transfers?

(Not that I'd expect Microsoft to use an existing technology rather than making their own proprietary one...)

What a nutjob!

[Anonymous Coward]

This psycho has the answer to all of our problems. Just submit...

just use IE

[Anonymous Coward]

A little web browsing or maybe outlook and after a short while NO passwords are needed to be r00t.

PKCS11 support for Java

[palad1]

So will that mean that once MS integrates this technology into .Net, Java will play catch-up and provide a -free- PKCS11 implementation into its JCE?

Or even bouncycastle?

Please?

Pretty please with sugar on top?

I don't get it...

[jav1231]

How is this more secure? Items can be lost, stolen, duplicated etc. I realize this is an attempt to circumvent complacency and human slackness, but replacing passwords with an item in the grand scheme of things merely introduces a new technology of equal (at best) value. Hey, it gives you good press though. What's more, this has all been tried before. It's great to see tht Gates is hot on the innovation trail! And in true form, via a third party!

3 different types...

[xxx_Birdman_xxx]

Im doing a uni course on security at the moment..
What they are teaching is that there are three main type of authentication:
Something you have - A smartcard, something physical.
Something you are - a fingerprint, biometrics.
Something you know - a password in ya head.

The whole idea is that you combine these for stronger protection.

To say that passwords are towards the end of their life is like saying they (M$) will be ignoring one possible type of authenitication. Sure you can just use smart cards, but its always better to have a combo of types and passwords are still handy to add that extra layer.

Re:3 different types...

[Anonymous Coward]

You should wait until you finish the course ;)

"Something you know" is not restricted to passwords. It may be selecting a few images from a random set of images (Deja Vu), or applying an algorithm only you know to some data. Don't reduce human knowledge to passwords. It can take many forms.

Re:3 different types...

[xxx_Birdman_xxx]

Totally agree.. hence the use of the term 'something you know'.. and not just passwords- which was an example.. :-)

RIP Passwords

[Anonymous Coward]

Bill Gates has declared the end of passwords. I guess they'll burn in fiery pits of hell with the command-line they declared dead five years ago ...

Bill

[Anonymous Coward]

Yes, he also predicted that 16Mb of system memory will be plenty for everyone in the future.
He isn't very good oracle after all.

Retinal scans

[phorm]

There is definately a difference between how easily one could have a fingerprint "lifted" vs a retinal trace, but as noted it isn't that much more secure. Just like somebody can stick a little scanner device over the debit-card hole on a cash-machine, so could somebody easily enough steal your retinal scan whilst you are being authorized at a legit service - particularly if such services become more commonplace.

Of course, with such an imprint it wouldn't exactly be as easy to create a new retina as a new thumbprint, but I'm sure that if such technology became popular it wouldn't be that long before somebody found a way (some form of non-opaque contacts, perhaps?)

Re:Retinal scans

[WreathOfBarbs]

Nah, All they would have to do is create an artificial eye out of a glass sphere with the pattern on the back side of it. They could probably even make the patterns replaceable so they only needed one sphere, with a pack of replaceable retinal patterns. Or for the more gruesome they could just take your eye instead.

Re:Retinal scans

[lee7guy]

Which movie is that now? The one with the eye ball mounted on the pencil.

Blade runner?

Re:Retinal scans

[lee7guy]

Maybe a combination. Retinal scan + fingerprint (several fingers) scan + spoken passphrase using voice recognition.

Should be reasonably secure, unless someone steal the whole data package and figure out a way to feed it to the analyzing devices. Would also make for fun watching sessions at beginning of work days when everyone logs in.

"Put your thumbs on these plates, look into the camera and say "Redmond Rules"". :)

Re:Retinal scans

[JimmehAH]

Demolition Man.

Re:Retinal scans

[lee7guy]

Ah, thanks.

In Blade runner they where placed on top of scared scientist now that I think about it.

For the future

[Anonymous Coward]

I read your password.. using your own eye

a bunch of marketing speak

[harriet nyborg]

sorry, the hyperlink to the theoretical studies in the last post didn't show up.... http://www.isaac.cs.berkeley.edu/isaac/gsm-faq.htm l

I'll keep my password, thanks.

[JeffTL]

Smart cards are a good thing for multifactor identification -- if you have not only the username and password but also a smartcard, authenticity is pretty good. Toss in a biometric and you can be almost certain of who's logging in.

But a common pickpocket can take your smart card, and if you don't realize right away (or can't report it quickly enough) you won't get it deactivated in time to prevent compromise. Coupled with a password, though, the amount of time needed to break a decent password will give you the time you need to change out the card anyhow.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Biometrics

[wirelessbuzzers]

There is only one way to use biometrics securely. If your office has a huge guy at the door who's good with faces, that's secure biometrics. He'll be much harder to dupe than a computer, and you can't steal his database. Of course, he's expensive, and you probably want at least one additional factor.

You have to hand it to BillG

[theolein]

No matter how bad a piece of his company's technology is - I'm refering to the desaster that was the original passport which was hacked with remarkable speed and spurned by the industry almost unanimoulsy - the man just does not give up. Every time he launches yet another piece of drivel guaranteed to fail, he simply puts it back in the marketing department which is tasked with bringing it back at some later date under another name with one or two improvements, which they will keep on doing in an endless loop until, even if its ten years later, it finally gains traction.

Re:You have to hand it to BillG

[Anonymous Coward]

and yes - you'll be sitting and moaning about it in your mother's basement... loser

Great - now I have to get a bigger wallet

[robertjw]

Now, not only do I have to rememeber 40 passwords, I'm going to have to carry 40 smart cards and remember 40 keys.

I know, I know, it's not supposed to work that way, but I already have one, and I don't think my datacenter ID is going to work with Mr. Gates' .Net architecture. So now it will be two, then Apache will require a different card for secure access to my bank's site, each credit card company will want to use their own credit card, my mortgage company will have to issue their own, then there's the cable company, satellite TV (and radio), cell phone, gas, electric, water... It will never end.

I'll have to buy a bigger SUV to carry all this crap!!!

Re:Great - now I have to get a bigger wallet

[3terrabyte]

Funny but true. I have access to 10 systems here at work, and they can't even give me the same login name!

A different kind of password authentication

[silicon not in the v]

When I was in college, a guy I knew was working on a software authentication scheme for this senior project. Here is how it works. As a new account, you select your user name. You go through a login trainer session, where you have to type that login name about 10 times, while it reads and stores the time intervals between the characters you enter. If you haven't established a certain degree of consistency, it will ask you to enter it a few more times. So that parameter of the natural rhythm with which you type your login name is stored in the system as your "password".

So that sounds like it wouldn't work, right? People know your username so they can duplicate your login, right? Actually, it was really tight. He already had a working version that we all(in the senior design project class) got to try. We never could fool the thing. You could tell someone what your login name was and they would try and try and never could successfully login as you. The main reason this works is that you are typing your own name. If it were a generic word that most people don't have to type very often, there would probably be a lot more similarity in the way different people type it and the system wouldn't work well, but being your own name that you are used to typing, there is some muscle-memory developed that makes it flow out effortlessly and consistently, which no one else can match.

Re:A different kind of password authentication

[silicon not in the v]

Crap. I just re-read that and realized I used the phrase "software authentication scheme". That was a bad turn of phrase. I mean a software-implemented user authentication scheme. Please don't go off on some "I hate registering software" thing.

Re:A different kind of password authentication

[Anonymous Coward]

Although you might have trouble logging in if you are drunk, have a cast on one of your hands, or some other hand-related medical problem.

Re:A different kind of password authentication

[Anonymous Coward]

Im thinking, when i get up im tired as hell and type slow as hell! oww my aching head

Re:A different kind of password authentication

[Anonymous Coward]

This is actually not a terribly new scheme. And in fact, it doesn't just work with login names. I could login to the machine and just walk away at the command prompt. I wouldn't have to worry about security because it would only execute commands that I'd type in. It works a bit like voice recognition, only with typing. There are various patterns of words or letter combinations that are almost impossible to duplicate.

Perhaps somebody could implement a secure shell for Linux using this technique.

aQazaQa

Re:A different kind of password authentication

[Anonymous Coward]

Okay, i'm no champion musician but I can listen to a song and copy the synchopation pretty quickly. I reckon after listening to a recording of someone typing their name i could copy the "beat" after a few minutes...

A bit of a myth, yes.

[GQuon]

One of the things such sensors check for is blood flow. So naturally they'll just have to kill you afterwards, but you won't be needlessly mutilated.

Yes. Some biometric sensors can be tricked with dead tissue or a photocopied fingerprint, but the good ones detect life signs. (This is the case for both good fingerprint sensors, reading electric impulses instead of light, and retinal scans that measure blood flow.)
Some sensors are even active, checking how the body reacts to stimuli, for example how the iris reacting to light, comparing it with a recorded sample.

Another M$ Innovation!

[Anonymous Coward]

Where did Billy Boy Gang stole this innovation from this time?

Re: "How long until we see an open-source...

[codergeek42]

...version of this?"

Hopefully not too long...

Safety Devices

[Z00L00K]

I have checked an assortment of devices, among them smartcards of various types. The conclusion is that we will have to stick with passwords, even if they are used to unlock the smartcard. Recently I have been trying a USB thumb device that works as a smartcard. Really neat, and is easy to keep on your keyring. It actually accepts real passwords, and not only the digit PIN code normally used for smartcards.

Using biometrics is actually as said not that secure. That is since it's possible to fool any system with a fairly simple technique.

Maybe fingerprint checking, using the right sequence of fingers? But what happens if you have had a bad day injuring any of your fingers? Same goes for retina scans, how will they do the day after one heck of a party?

Brainwaves could maybe be something better, then you might have to think of something to create the right brainwave pattern! :-)

Not to mention...

[markbark]

that passwords are always vulnerable to the "Rubber Hose Exploit"

i.e. apply a rubber hose smartly and often to the person who knows the password until he/she divulges it

--MAB

Re:Not to mention...

[jp10558]

What about the systems that have two passwords, one with "dummy data" or misleading data or whatever, and one that shows the real info?

The problem with torture is that well, depending on the circumstances, how can you ever know if you actually are getting correct data, planted data, or just whatever they thing you want to hear so the torture stops?

Wow...

[Run4yourlives]

so why isn't this thing a patent and your buddy selling sofware to billy bob?

"Axalto", hehe..

[edmz]

Depending on how you pronounce the "x" in your spanish speaking country but "Axalto" does sound a lot like "asalto" which in english means "robery". Nice.

On Xbox?

[Albert Sandberg]

Will this unhackable smartcard be featured on the unhackable xbox?

Who's got dibs...

[Anonymous Coward]

on when it gets cracked first?

I would say give it a few months, myself, let's say April...

Smoke screen

[Anonymous Coward]

Isn't it obvious what this is all about - to get the public talking of some other aspect of security, so as to draw attention away from all the vulnerabilities, viruses, worms, spyware, popups, and other problems that plague Windows users. And to make it look like M$ was doing something about security, without actually solving any of those problems.

Microsoft lackey

[Uosdwis]

How long before we can get an open-source version of this?

Why is it whenever M$ comes out with a stupid idea, OSS wants to jump on this bandwagon? This seems like an amazingly stupid idea. Maybe if OSS community would come up with breakthrough ideas it would actually be seen as a viable alternative rather than a M$ catch up.

and where is this info stored?

[Anonymous Coward]

what happens if your card gets melted, where do you go for a new one?

then the larger question, who stores all of your information for such a retrieval?

Never Proclaim End of Life

[nuintari]

Anything so entrenched can never be said to be heading the way of the Dodo. Things last, for better for for worse, things stick around:

floppy disks
command line interface (if this dies, I quit computers)
serial ports(also, on my own list)
ps/2 keyboards and mice
analog modems

Technically, all of these can be replaced, but they haven't been, for one reason or another, they still exist. You cannot dictate change in this industry, you just sort of have to create oppurtunity for change, and flow with it.

From the other side, people use floppies, people use their favorite keyboard into keyboard death, then buy the same one as a replacement. People hate passwords. No one who writes the admin password for their xp box on a postit note under the keyboard will ever miss passwords. If people find it easier, they might switch. But don't bet too much on it. Not that you venture capitalists will listen.

I'm pretty sure passwords will end up on that list someday and I will personally stand in the way of their demise. Why? Because I do not trust PKI's, especially dotNet.

Smart Card Clarifications

[mpapet]

1. How much will it cost? Axalto smart cards are still very expensive even for 10,000+ card orders. (A rough estimate about $7 a card for 10,000) Ouch! 2. Where's the infrastructure to handle this? Card issuing and management is still a double-secret custom application that will cost as much as the cards. 3. Based on the press release, (couldn't RTFA) it sounds like Axalto has a library that sends commands back to their existing smart card. Putting an application on the card to do this doesn't seem very smart because of the lack of computing resources on the card. Good luck to them.

Today and Tomorrow

[Vandil X]

Today, your wallet gets stolen or mugged form you. You make a few calls and move on with life.

Tomorrow, with biometrics, you can get knocked unconscious and:

- RFID/chip implants removed (cue bathtub/kidney urban legend)
- hands lopped off
- eyes removed

I like today's solution better.

Re:How long before we can get an open-source versi

[Anonymous Coward]

Haha, and since when has prior art stopped M$ getting patents before?

Nothing New

[MirrorField]

US Federal Government has used similar system for years. It's called "Fortezza" and it's produced by Mykotronx.
This idea isn't new, though Fortezza is kinda expensive. On the other hand, Fortezza's price is most likely inflated due to limited customer base and FedGov supply system.

What if the smart card stops working or goes bad?

[Anonymous Coward]

What if the smart card stops working or goes bad?

Great thing . Caution with RDFI

[Anonymous Coward]

I think this is fantastic! I beleive common user password are highly unsophisticated and are bad for security.

Smart card tokens, which replaces password among other possible usage of the smart card, can provide better password.

By using this, you don't have to fear that someone else knows you password. You have the card, you have the password. You've lost the card, you've lost the password.

I hope that RDFI won't develop into a problem : allowing other people to read you card remotly, form a close distance or a longer one.

Holy Crap

[multipartmixed]

I'm beginning to suspect my wife is a polygamist. :)

Bill never heard about 2-tier security ...

[Anonymous Coward]

I guess Bill needs Security fundamentals 101 course ...

He never heard about 2-tier security:

1. something you have (access card)
2. something you know (password)

Yep Bill, who would nee more than 640k of RAM?

AC Proclaims End of Blindness

[Anonymous Coward]

http://shit.slashdot.org/article.pl?sid=04/11/16/1 318210

And In Other News ...

[Anonymous Coward]

... the key and barrel mechanism will be replaced by the more secure digital lock by the end of the 1980s. ... People will still give away sensitive information when threatened with a gun to the head or bribed with chocolate.

I'm Rod Shuffler and I'm a pornographer. Once the porn industry embraces smartcards, just watch the rest of the industry follow suit. Mark my words.

Here is Wisdom...

[syrynxx]

And he causeth all, both small and great, rich and poor, free and bond, to receive a biometric implant in their right hand, or in their foreheads: And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name. Revelations 13:16-17 (flame not, it's just funny)

Coming Soon

[batkins]

LOGIN FAILURE: Your password is dead. Please contact billg@microsoft.com for a replacement.

as usual...

[geg81]

Microsoft is rather late. Smart card authentication is widely used already, even on Windows. Sun has been trying the same thing with JavaCard. Experience shows that it works in some environments and it doesn't work on others. And along with the security problems it solves, it also introduces new ones.

An open-source alternative...

[tillerman35]

There should be a biometric unit that uses the pattern of veins on the underside of your tongue to uniquely identify individuals.

The underside of everyone's tongue is different. I verified this using basic research techniques over a series of weekends while I was in college. After obtaining a more permanent research assistant, I was unable to proceed with further "comparison-" however, I do encourage others to carry on my work in the spirit of cooperative science.

The beauty of this approach is that you could integrate the tongue reader with the computer's mouse. The user would insert his/her into an opening in the underside of the mouse, a laser light would illuminate the pattern of veins, and the resulting image would be captured and compared against the security database. The process is as simple as licking the filling out of a custard donut. In fact, in some companies I have worked for the users are so simple that care would be needed to ensure that they could tell the difference between a custard donut and a tongue reader or problems might occur. Utter panic ensues as user authentication fails at Dunkin' Donuts Wi-Fi access points... Well, you get the idea.

For those users on a low-carb diet, the process can be described as similar to that used for another research project I conducted while in college. One advantage of the tongue-reader biometric system is that computer mice, like research assistants, are much more responsive when properly lubricated. Some other method might be necessary when dealing with portable computers. Perhaps it would be possible to integrate a tongue reader with the touch-pad pointing device. Obviously, this would favor users with the ability to lick their own laptops. But isn't that already the case for much of life?

And in case anyone is wondering, yes this IS a tongue-in-cheek post.

whats the point

[fender_rock]

no matter how you look at it, there is no foolproof protection scheme. take biometrics and fingerprinting and all that good stuff for example. all people will need is one drop of blood or a piece of your hair to gain access. and even if they dont, hackers will always find some way to get around it. if you're sending info over the internet, all they have to do is hook up a packet sniffer and capture the relevant packets and resend them when necesary. in my opinion, well-thought out passwords with hashes offer the best current protection. while its easier to replicate those, its very inexpensive and any good OS can provide safegaurds to make it extremely difficult to access. besides, anybody can steal a smartcard, but can anybody steal something stored in your head?

Palladium

[Anonymous Coward]

That's where Palladium (NGSCB for those abbreviation-challenged) comes in.

no more passwords

[torrents]

so hardware will be free, people will pay for software, and instead of remembering passwords we will have hardware that we paid??? m$ for?

Heh

[garote]

Actually that raises a humorous point: People use their smartcards by extracting them from their wallet, WITH THEIR FINGERS. Anyone who gets the card, also gets a great set of fingerprints. D'OH.

Duh.....

[Allnighterking]

Already have it. It's called ssh keys. etc. It's not missing from OSS it's just not applied.

Get rid of passwords

[tolonuga]

I think smart cards are the right way. Get the normal cryptoflex 32k egate card with a token connector, install openct and opensc (both http://www.opensc.org/), and use the opensc pam module for login, openssh for remote authentication, mozilla or firebird with the opensc pkcs#11 module for email signing and decryption, the opensc tools for initializing the card and diagnostics, openssl with the pkcs11 engine to create signed certificates, and so on.

you don't need microsoft to do that. opensc is available for linux and friends, mac os X and windows, and a CSP for windows is under development.

opensc supports cryptoflex, cyberflex, gemplus pk, siemens card os, telesec tcos, micardo, setec, ibm jcop, oberthur and openpgp smart cards. also the finnish, swedish, estonian and italian id cards are supported with full source code, the spanish linux user group has a special version with support for the spanish id card using a binary only plugin.

also note that opensc does not use a propriotory on card format (like most commercial alternatives), but implements the pkcs#15 standard.

disclosure: I'm one of the developers, doing some advertisement here :-)

wow, this is new!

[the-build-chicken]

oh, except sun was doing it ten years ago.

You know, love Sun microsystems...but if one company has consistently been the victim of an idea whose time has not yet come, and won't come for another 10 years...it's got to be sun. Smart cards, JINI, SunRays...all brilliant...all dead because of being ahead of their time IMHO. They've seriously gotta start hiring some dumber people...I here you can find them in Redmond.

Re:wow, this is new!

[Anonymous Coward]

And Xerox invented GUIs and the fax machine. Atari invented game consoles. Sony invented the best VCR format (beta). Apple popularized GUIs. Nintendo revitalized game consoles. It's not who's first to market; it's who's *best* to market.

At least Nintendo is still a major player in game consoles...in Japan.

Smart cards are not as insecure as you think

[Ytsejam-03]

But a common pickpocket can take your smart card, and if you don't realize right away (or can't report it quickly enough) you won't get it deactivated in time to prevent compromise.

A typical smart card will require a password or biometric to unlock it. Therefore, a "common pickpocket" would also need to either guess your password or cut off your finger. Most smart cards will also lock you out after 3-5 bad password attempts.

So, how long until DishNetworks sues MS?

[SmurfButcher Bob]

Because in order for MS to do this, they must *clearly* have bought a SmartCard Programmer...

Pure marketing...

[innerweb]

...No matter how you break it down, Bill Gates is good at marketing and business tactics. MS is all about the blinding sheen of their marketing and the ball and chain of their contracts (and software).

This does not even have to be a reality. It gets people talking about what MS is *going to do next*, and does so without invoking Linux or any other competitor. You see, to win the public, they do not have to be better, just better at marketing themselves and silencing the competition. The public does not hear whispers in the wind.

InnerWeb

JavaCard

[Trejkaz]

Haven't JavaCards been usable for this sort of thing since... well, forever?

This is just another ".NET tries to catch up to Java" article. Move along...

And even before then, I remember magnetic strip cards being usable for authentication. Heck, I helped hack a crappy magnetic-based system together for one of my previous jobs!

HI THERE!

[Anonymous Coward]

My balls are sweaty! Big, hairy, sweaty and SLAPPING YOU IN THE FACE!
Love TrollBurger

Well, it sort of is Open Source already

[grikdog]

Assuming you have a Mac (or FreeBSD?) which implements /dev/random using Yarrow, you can encrypt using Mersenne Twister (initializing the large internal table according to the docs), on the fly, passing the key to an external USB or dongle, to seed AES in one or more of its less familiar modes. This has been in the public domain for years.

Embrace and Extend what?

[dbacher]

A lot of people seem to have not read the article (including potentially the poster of the story)

1. Microsoft purchased smart cards to upgrade their existing smart cards that they use for system and facility access. This is said explicitly about 2/3 of the way down.

2. Microsoft was the first to purchase this particular type of smart card.

3. The smart cards have an ECMA-compliant implementation of the .NET CLI and CLR on them. This means you can send ECMA compliant code, such as code compiled with Mono, to the smart card and it can run it, if you use their tool.

4. The smart cards ship with the device driver and libraries to work with it.

People are going "why .NET why not Java." This is a third party, not Microsoft. Java involves purchasing a license from Sun for commercial use (to make a Java-logo compliant JVM), while .NET involves downloading a specification from ECMA for free.

So far as raw assembly being superior, I'm not even going to touch that one except to say that the processor is junk on these things, you need isolation of code, the best way to get it is a VM of some sort you might as well use a standard one for which tools are available as roll your own.

So this is the situation. Some company released a smart card with an ECMA compliant .NET implementation on it, Microsoft bought a bunch of them and wants to use them for security.

This doesn't really involve anyone outside of Microsoft (it really doesn't), doesn't involve embrace and extend or FUD, or anything else that's been brought up in the comentary.

And it's not some great shocker that Microsoft doesn't like passwords, as a lot of people have said. For years, most of the industry preached passwords as the way to go. With a few exceptions, most people understand now that users are generally stupider than the chairs that they sit in, and either write down their password, chant it while they type, or use the same password everywhere. Also, if you require a user to change their password every 30 days, generally they achieve this by attaching a number and incrementing it.

The good news is hackers have been getting dumber, too, so they're unlikely to realize the user uses Pa$$word10 one month and Pa$$word11 the next...

Sweet!

[Anonymous Coward]

telnet fluffy.microsoft.com
login: bgates
Last Login: Tue Nov 16 04:34:29 from 127.0.0.1
You have mail.
$ cd /usr/src/windows
$ rm -rf *
$ ^D

No passwords!

[Maljin Jolt]

Unlike everybody, I use no passwords for a very long time. Just because nobody suspects me about it, it works!

This is why

[rofthorax]

Marketing (aka Data Mining) costs money, now what if Microsoft owned the only way to collect marketing information, the biggest pool of marketing data?

Now you know why they are trying to do this .net stuff.. The other reason is so they can find the source of competition and attack it before it has chance to develop.

Nice try Bill Gates but no go..

okay I see..

[rofthorax]

But the reason I suspected for .net and centralized application use over a network, like subsribing to using MSWORD, I believe was a method of collecting information about people and then selling this information or using it to their advantage,
call me paranoid.

Hack once, obtain everything?

[Anonymous Coward]

Right?

Id rather get this card

[hardkrash]

http://www.g10code.de/p-card.html It as a smartcard that holds your pgp key. you can use it for authentication, encryption, and signing.

Missed Again

[Tom]

As always for the past five years, Bill is an idiot who is years behind, and his "visions" are only somewhat close because they're being adapted retroactively.

Smart cards, eh? Look, we've had them for a decade. We've had reliable, cheap smartcard-as-login solutions (both hardware and software) for several years.

They haven't replaced passwords so far, and they won't replace them in the future.

Smart cards are nifty, and very useful. But they aren't the end-all of security and anyone who says so in public is only making a fool out of himself.
For one thing, they can be lost, stolen and yes they can be copied (don't trust the marketing drones of the vendors, smartcard hacking has been public knowledge for at least 3 years).

Then, you are tied to a local system, or infrastructure. I can log on to my server from anywhere in the world where I can get an ssh client running. If you rely on smartcards, and you're in Tokio where the Internet cafe doesn't have them, or has a different system, you're fucked.

And then there's the frightening reliance on a closed system that's essentially a black box. If you fully automate the login process, I can fully automate the exploit. There's a reason manual intervention is sometimes a useful feature, but M$ didn't get that when they wrote Outlook, so I figure they still don't.

Fortunately, the market will kill this idea dead. I've yet to read one argument that would convince the CEO here to pump out ten thousand bucks or so to install the necessary infrastructure.

Smart Card and Gates

[Lee Darrow]

Oh, yeah, the death of passwords based on Microsoft's say-so. Somehow, while the technology is interesting, one has to wonder at ANY hardware based security method. Look at the supposedly "uncrackable" encryption devices on such things as cable TV signals and DVDs. Not to mention that Gates is looking for yet another way to literally control the transfer of ALL information in the world.

We must also remember that Microsoft has one of the poorest records on security in the computer software industry. I am willing to bet that this product, nifty tech though it seems to be, will be as full of holes, security-wise - as everything else that has come out of Redmond.

"One does not conquer the world with military force or economic pressure. One conquers the world by controlling what people think. Control the sources of information and you will control what people think." - me 1969.

Also, it's yet another assault on the open system of the web by .Net and a whole new way for Gates to line his already incredibly well-filled bank accounts.

Lee Darrow, C.H.

Re:Touchscreens Suck

[Anonymous Coward]

try working in a stop and rob and watching your favorite fingertip split banging away at a touch screen. touchscreens are for people who cant figure out how to manipulate keys, mice, lightpens..;)

The Kaffe connection

[jpick]

Cool.

This is the "Nectar" .NET virtual machine written by Tim Wilkinson's new company here in Berkeley - Hive Minded, Inc. (the name is a reference to the Borg in Star Trek).

Tim is the guy who wrote Kaffe - I used to work for him. He's no longer working on Kaffe, and I'm running the project now.

He's also the guy who wrote the first Java smart card implementation for Schlumberger (now Axalto), before Sun did their own implementation -- so he knows what he's doing. :-)

Death of passwords

[demon_2k]

It's been said before that the best security works by using something people have and something people know. So what's the deal here? What's something they know if it's not a password?

Unless it's a trick. They'll use a passcpde or passphrase instead...

Biometrics, presumably

[GQuon]

Biometrics, presumably