Slashdot Mirror
Researchers Develop "Narrative Authentication" System
hypnosec writes "Researchers have developed a 'narrative authentication' system that could put an end to the need of remembering complex passwords to logging onto computer systems. The new system has been developed by Carson Brown and his colleagues over at Carleton University in Ottawa, Canada. The main idea behind the system is to log a user's activities on the system or any other device that he/she may be using and then ask questions about them when they login next time. Users can interact with the logging software and add their own events in the real world like wedding dates, holidays, travel dates, etc."
Sounds like useless bullshit produced to get funding dollars.
I'm sick of "intelligent" systems which are making my life more and more complicated.
lemme in ya fukcin piceec of shhhtt!!!!!!
you ever did to be able to log in?
An authentication system that combines the fun of 'intelligent' phone-tree voice recognition 'expert' systems with the assumption that biographical trivia are anything other than hilariously public.... Where do I sign up?
I'll just leave this right here
https://xkcd.com/936/
I want to delete my account but Slashdot doesn't allow it.
Yeah, really good idea... I bet the NSA already has some guys rubbing their hands in glee while they wait for this tool to be released and start collecting information for them for free!
Completely unhackable because there can only ever be one system that can scan all these sources.
A hacker could not possibly create their own system that scans the same public facebook pages and twitter posts.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Last time I forgot a gmail password it did this. Something like the last 3 people I'd emailed, and the last three I'd received emails from and some other tripe. I don't mean the magic "first pet dog's name" question or anything like that.
I remembered my password before I even got close to figuring any of that shit out.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
So, instead of a single password I'll need to answer a questioner every time I want to login?? And, of course, they company is happy to save me the trouble and storage space and will gladly store all my activities on their servers. No thanks.
I think the big problem with it is that it would tend to be inconsistent in its complexity and might dip to a very low complexity on occasion making it easy to compromise. The algorithm wouldn't have any real idea of when something was easily guessable. Still, probably better in almost all cases than most people's passwords, but not as good as people who use them well.
... would become even more weird
I'd prefer an authentication system that forces you to play a variant of Zork.
Imagine this: Your wife wants to log into her gmail account, you didn't remove your account from the account management, she doesn't notice that she tried to login to your account.
Gmail: What kind of porn were you looking up when you used your gmail account the last time?
It's not meant to be incompletely unhackable. Think of it as adding another factor of authentication. So, with three factor authentication there will be something you know (your password), something you have (your ID card / token), and something you are (a nerd). This adds a fourth factor: Something you did (forgot what that was and called tech support).
The genius of this system is that it relies on the existing proven security of the questions over-seas help desk personnel usually ask you like: How long has it been since you logged in? What's your favorite sports team? What kind of accent is that? What's your mother's maiden name? What are you wearing? Etc.
Yes, because a site breach wasn't annoying enough yet when they take all of the passwords. Let's give them more information which to do spearphising with.
Have these people never heard of microphones?
It also sounds like a really great way to obtain a lot of extremely interesting metadata for nefarious purposes. Personal information that may be also used for things like bank accounts + travel dates? Yay, break in + plundering of all the victim's money!
And then the bank will say "You did this yourself, only you know all this sensitive information. Say bye bye to your money."
lemme in ya fukcin piceec of shhhtt!!!!!!
The real problem is not when you're drunk; eventually, you'll be sober and be able to log in later. That's almost a feature, like a breathalyzer on your phone to keep you from drunk-dialing old lovers who got married to someone else 5 years ago.
No, the real problem is when you *were* logged in, got drunk, did things, and now can't remember what you did the day after, since it involved StumbleUpon.com and one shot too many. How in the heck will you ever guess "Namibian Hang Glider Porn" (or whatever) after you sober up?
Hi, my name is Werner Brandes. My voice is my passport. Verify Me. My wife's birthday is 8/1/67, and I like puppy posts on Facebook.
Silence is a state of mime.
There's nothing wrong with passwords. Use a good password and everything will be fine.
Can we start working on something important for a change instead of obsessively re-inventing the wheel?
The genius of this system is that it relies on the existing proven security of the questions over-seas help desk personnel usually ask you like: How long has it been since you logged in? What's your favorite sports team? What kind of accent is that? What's your mother's maiden name? What are you wearing? Etc.
"Security questions" are a threat to security, as they enable a shortcut past (i.e. easier to guess than) the regular protection of a password. If you demand security questions _in_addition_ to passwords, and never EVER use them without also demanding passwords, then you can create a system that is at least not less secure than a system with only passwords.
In most cases, when I review the security of some system, the existance of security questions is sufficient reason to reject the product altogether and tell the developers to re-think the security aspects from scratch. It's not the programmers' fault, it's their "security" guys' fault, but it is the developers who will suffer for it. Unfortunately.
A system that's inconvenient when it works, is insecure, and get increases the chance of you getting locked out of your own account.
I really can't see a use case for this.
Can't lose!
The main idea is to log a user's activities on the system and then ask questions about them when they login next time
it'll be interesting when the system asks "what was that porn site you visited a lot last time?"
Slashdot, fix the reply notifications... You won't get away with it...
giving up privacy is the solution to everything! What could possibly go wrong?!
Brave Sir Robin ran away. ("No!") Bravely ran away away. ("I didn't!")
Why doesn't every website just let me use my Blizzard authenticator?! Problem solved!
So now "they" are trying to spin tracking online activities as a "security feature"?
Come the revolution....
Blue... I mean red... AHHHHHHHHH
After all, They (tm) wouldn't really get a complete view without getting our DNA as well. /mother's maiden head (or name) - check
Let me just check here real quick what They (tm) have been know to ask for a simple login:
Name - check
Favourite food / first pet
Fingerprints - check and IOScheck
All kinds of other details rendered irrelevant after having our name - check
What we've been up to - check
Rectal probe with RFID - check (wait, I think I dreamt that one, better patent it)
Complete DNA profile - to-do
This particular one isn't so clever, but there are a lot of interesting schemes that rely on keep track of how you type or use the mouse, or what length words and sentences you use, etc.
None of them are super accurate for the general population, but for some subset they're very, very good, and the subset changes depending on what the mechanism is. That is, some people have very unique writing styles, others have unique keystroke timing. So a combination of these techniques might be very powerful.
The comments in this thread all fall into the "we can only use *one true best method*" fallacy. That may be what you're forced to do if you're implementing it in little pieces of metal (key/lock) or on an Intel 4004 or using TTL MSI parts, but with modern computational horsepower and good analysis, using multiple modalities is an appropriate and wise thing to do.
"The main idea behind the system is to log a user's activities on the system or any other device that he/she may be using and then ask questions about them when they login next time."
Cloud security?
I think I'll stick with pass phrases.
"If any question why we died, Tell them because our fathers lied."
Computer: Last time you were on, you watched a video. In that video a _____ was having sex with a ____. Respond?
End of Line
âoeWho knew something as harmless as willful ignorance could end up having real consequences?â
So, how many of you want all of this personal information in a system that will be hacked and stolen? 100% guarantee that hackers would target this
information and than you are REALLY screwed if you're dumb enough to use real anniversary dates, birthdates, etc.
And what is the system going to ask you, "What were you last running on your machine before you shutdown?" Don't remember, Oh shit. That wasn't me but
my wife that was logged on.
Just plain stupid and someone looking to get money from fools.
Narrative authentication has been used by the military for years to authenticate the identity of soldiers found in the battlefield who are able to communicate but don't have any form of identification.
Monitor bandwidth usage on IIS6 in real-time: http://www.waetech.com/services/iisbm/
Except this isn't an example of the third "something you are" factor; it is just more of "something you know".
Now, if the system analyzed your data, created an accurate profile of you and then postulated a rhetorical situation, asked you how you would respond to same, and gave access based on your response, that might be a better example of a third-factor. This changes it from a recitation of a fact (be it a password or personal data) which anyone can answerto an analysis of attributes unique to the individual (biometric data or psychological traits), which purportedly can only be provided by the authorized person.
Example
Of course, that would require the system to make a 100% accurate /and unique/ profile for each user, and somehow I don't think the proposed system is quite up to the task.
No, what is being suggested is just changing a static password to a collection of facts which supposedly are both easier to remember and only known in full to the authorized user.
... by twitter, facebook, etc.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
And how many times have we heard "an end to passwords". UGH Please stop blaring that unless you have it up and running in real life on many different environments.
I am me, I am the anomaly in the machine.
The problem is all of this information is incredibly public. What did I last buy on ebay? Probably a thing I then told a bunch of people I bought for a great price on ebay.
You could even game this system - do a bunch of fake logins, and use the questions to reverse-engineer the responses.
As a basis for the knowledge factor component ("something only the user knows") of a multi-factor authentication scheme, this could be very useful, indeed, because it changes every time the user does something. Other forms of knowledge factors such as passwords are vulnerable to spying or code-breaking. The benefit here is it could seriously raise the bar for spoofing the user, since now the attacker would need access to the entire log of activity rather than just a single knowledge factor, and be able to infer the answer to a question rather than just crack an encryption scheme.
Of course, details matter, but I suspect there is a lot of value here. You want to try and eliminate entire categories of attack vectors, and this sounds pretty interesting in that regard.
"We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
Nobody is going to want to go through an interrogation every time they log in.
Proverbs 21:19
Like I can remember my anniversary? A pharmacist used my sons birthday as a check before handing me a prescription (one dose antibiotic... whew). She finally said "is it ...". Yes, yes it is.
Computer: "What did you do the last time you logged on?"
Me: "Surfed for porn and posted snotty comments on Slashdot."
Who woulda' guessed that?
Have gnu, will travel.
Hello. I'm one of the co-authors of the workshop paper that inspired this article. I say "inspired" because the article is completely misleading.
First off, the paper was a position paper. It was primarily speculation about how we could do authentication in the future. The idea behind it was that humans are bad at remembering very specific facts but are very good at remembering stories - narratives. What would it mean to authenticate using stories? Think about how you'd verify the identity of a friend communicating via text message from an unknown phone number or account. Make a computer do that.
And yes, fully developed such a system would be AI-complete. But I think there are lesser incarnations that might be usable and secure. But that is just educated speculation on my part.
Now the paper did present a simple example of how you could do something kinda-narrative-like using text adventures (yes, think Zork). Such a system isn't discussed in more detail because there are many usability challenges. But it can be done. Carson Brown got his Master's thesis in fact by by building such a system. (Yes, I was his advisor.)
If anyone wants to build a PAM module based on Inform 7 drop me a line. Could be fun! But it won't be practical.
If you want to learn more, the paper is "Towards narrative authentication, or, against boring authentication.". The workshop in question is the New Security Paradigms Workshop.
And in case you were wondering, none of us are doing any follow-up work on this right now. But I'm always open to collaboration opportunities. :-)
--Anil Somayaji
I was in a national disaster, and FEMA required this type of narrative 20 questions system with data that was culled from public records. Since I have a common name, and have moved several times, I was never able to disambiguate myself from others with my name. I ended up having to correspond with FEMA via US Mail, which seems more secure and accurate. I can only speculate on the authentication problems that this methodology is causing in the healthcare.gov site. The term 'doomed to failure' immediately comes to mind
Just the washing instructions on life's rich tapestry
crap, crap, mega-crap
The NSA monitors everything everybody ever does. They would know the answer to every single one of those questions, and they could use them to break into your accounts and read all your emai----
oh wait.
If I have to answer a security question to get into a site, who owns the answer to the security question?
Why should I have to tell them what High School I graduated from, so they can spam me with reunion advertising?
Isn't asking and answering security questions itself a form of phishing?
The problem with giving false answers is having to remember or record what answer was for what question.
I used to give the same answer for all questions too, but sites have started checking for and prohibiting that.
Where do I join the class action lawsuit claiming the requiring answers to security questions is an invasion of my privacy and not required according to previously established relationship and asking security questions is phishing and hence a computer crime itself!
their own events in the real world like wedding dates
So if I can't seem to convince the system to let me log in to my computer, I should buy my wife flowers?
Wow, I've seen so many inventions claiming to "end the need for complex passwords" over the past twenty years that we've certainly ended the need for complex passwords by now, haven't we? Wait, we haven't?
On another topic, has the Voyager probe left the solar system again yet?
Liberty in your lifetime
The problem is all of this information is incredibly public. What did I last buy on ebay? Probably a thing I then told a bunch of people I bought for a great price on ebay.
That sort of thing is only public if you're an idiot. I don't tell anyone that shit.
A system that stops asking me for passwords for every fucking account, website, and game, BECAUSE I'M THE ONLY FUCKING USER OF THIS PC??????
AUTHENTICATION CHALLENGE:
During your last session, did you (choose one):
(a) Receive email from your sister, Dorothy about her medical condition.
(b) Access your bank account 101000187-33400301
(c) Install a root kit onto 0F13C73AAB0D4E000028038C99D3125A
[CONTINUE TO LOGIN]