Slashdot Mirror
The Internet of Things Is the Password Killer We've Been Waiting For
jfruh writes: You can't enter a password into an Apple Watch; the software doesn't allow it, and the UI would make doing so difficult even if it did. As we enter the brave new world of wearable and embeddable devices and omnipresent 'headless' computers, we may be seeing the end of the password as we know it. What will replace it? Well, as anyone who's ever unlocked car door just by reaching for its handle with a key in their pocket knows, the answer may be the embeddable devices themselves.
the NSA enabled code. don't leave home without it.
This is one of the rare cases where the title doesn't ask the question, yet the answer is still no.
In the app, you're always logged in once you register. Yes, I know it is a security breach, but so is losing your stupid phone.
You enter your email to register. And if you ever change phones, you simply do what is commonly known as a "password recovery", but don't actually get a password, you just get perma logged in.
Here's a secret for people who deal with hackers: Have the app generate a keygen unique to the phone: Time stamp it, time stamp it again on the first click, get the X/Y position, and you have a pretty unique code. Keep that code permanently with the installed app, so if they're banned and forget to uninstall your app, they're banned again. Also this key could be used to login automatically without even registering! But if they ever want to recover their account if they lose their phone, they should enter their email in the settings.
God spoke to me
halfway through the article...
[ Don't miss: Welcome to the Internet of Things. Please check your privacy at the door. ]
Anons need not reply. Questions end with a question mark.
Just implant yourself with an RFID tag. As a bonus, it will also reduce the chance that a surveillance camera misidentifies someone as you.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
In the sense that both 'the internet of things' and 'passwords' can be described as "an egregiously maldesigned and actively user-hostile security clusterfuck; typically bodged together by people who don't know, don't care, or both", I suppose that 'IoT' would be a worthy successor.
In all other respects, what a load of tedious, meandering, bullshit to arrive at some vacuous generalities about a vaguely described non-solution.
Dice Holdings sucks the big hairy meatball.
So far, my "password killer" has been Google Authenticator and RSA SecurID on my Android phone. (I checked out of the Apple ecosystem when I cancelled cable but I'll bet they have the same things over there.) All my VPN connections and some of my web apps now use these.
I've been using various forms of bluetooth proximity to automatically lock workstation forever.
No sir I dont like it.
I'm not looking forward to a world where computers are everywhere and in everything. It's bad enough every moron has a mobile phone stuck in their face whilst they walk. I don't want my stove talking to the fridge. I don't want reminders from the fridge the milk is low. I don't want my toaster sending illegal packets to Yahoo! and then getting blacklisted. No. Simply no.
I want to use computers a tool when I want. I want to have to walk over to one like I do in my living room. I don't a world like Star Trek where I ask the computer stuff whilst I walk along. I like being human with all the constraints that come with being human. We can take this too far if we allow it.
DR TA
I use a password manager (Acerose, Win), so know my passwords are correct, yet can't access my Hotmail account due to it being questioned. Hotmail's only use for me is to forward my e-mail from .com's I've used it on to my newer e-mail address at Gmail; so I don't mess with it, as it's working. This isn't the only site that's questioned my password, those requiring a new account.
I'm feeling a little chipper!
I'm sure whatever they come up with will suck just as much as a password.
Well, as anyone who's ever unlocked car door just by reaching for its handle with a key in their pocket knows, keyless cars are 'increasingly targeted by thieves using computers'
There, fixed that for you.
This is the right basic idea, I think, but I think everything will converge into a single device, either the mobile phone or a wearable. And as it becomes more and more central to everything we do, that device will become very smart about authentication.
The problem with using dedicated embeddable devices is twofold. First, the more of them you have to carry, the more difficult it is to keep track of them. With old-fashioned metal keys we've solved this with the key ring... but that creates its own problem. The more keys you add to it, the more valuable it becomes. Loss or theft become increasingly more problematic. And our metal keys open fewer, and less important, things than our electronic authenticators do.
So, it makes sense to combine the electronic keys in a single device, but then to use the capabilities it has that metal keys do not to solve the theft and loss problems. First, against loss, there must be a way of backing up all of the credentials, securely and automatically, so that in the event the device is lost they can all be recovered relatively easily. Some sort of remote server backup, to which you authenticate with some other mechanism that you protect very carefully (there are lots of options here, but a long, randomly-generated password printed out and stored in a safe place is a good option). That backup needs to be reliable and reliably accessible, but access need not be easy or convenient, since it should be rarely needed.
What about theft? This is where the smart device has huge advantages over dumber devices, because it can authenticate the user. This authentication needn't be particularly strong, but it should have good anti brute-force protections, and it should be smart. The goal is to make something that is extremely convenient for the user, but makes it relatively unlikely that someone else who gets it can use it. How could that work? Google is pushing towards this vision with Android Smart Lock features. The core idea is that the device shouldn't rely on a single signal, because that signal then has to be very strong.
It's worth looking at analogies with meatspace facilities that care a great deal about security. What they don't do is put a bank vault door on the exterior wall and rely on the strong combination lock to keep thieves out. Instead, they rely on layering of defenses, monitoring and active response.
What can your phone do? Quite a bit, probably. Not only does it have a touchscreen for entering passwords, it also has cameras, an accelerometer, GPS, various radios, compass, altimeter, microphones, a proximity sensor and probably other stuff I'm forgetting. In addition, it can know a lot about your habits, your plans (e.g. what's on your calendar) and more. With that wealth of signals, it should be possible for the device to determine with relatively high certainty whether or not it is still in your possession. Where it's uncertain, it can fall back to asking for authentication with, say, a fingerprint or simple PIN to increase its certainty. Or in more extreme cases, it can fall back to an even stronger password. The idea is to make authentication as seamless, transparent and automatic as possible... but as strong as necessary.
Or maybe a smart watch will be a better choice. It has pretty much all the same capabilities as a phone, but the advantage that you strap it to your body, making it harder to lose, and harder to steal. (Actually, I think over the next few years for many of us our phones will migrate onto our wrists; right now the smart watch is an extension of the phone, I think that will flip, with the handheld device becoming an extension of the watch providing a larger screen, aimable camera, etc.).
The "as strong as necessary" bit is important here, too. When the phone is going to use a stored authentication key to unlock something for you, the degree of certainty that it needs to have that you're you depends on what it's unlocking. If I'm using my phone to log me into slashdot on my laptop, I really cou
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
DR TA
This isn't the only site that's questioned my password, those requiring a new account.
E-mails being sent to verify ones identity (sometimes) are sent to only one E-mail address, they don't allow forwarding nor POP3ing them as I normally do to get my e-mail (it's caused problems in the past, yet now I'm aware of it).
Biometrics for all the "things"!
Sadly, there's not an ASCII art for the Trollface with the torch graphic...
And telling us what backward, mouth-beathing Luddites everyone is who isn't racing to jump on the IoT fanboi bandwagon are.
CUR ALLOC 20195.....5804M
Not sure what Apple Watch you've used, but if mine isn't on my wrist, I'm required to enter a numeric password if I want to see anything more than the watch face.
It's even greater than 4 numbers, too.
If it's on my wrist, the iPhone needs to be unlocked at which point the watch is unlocked as well.
It would be presumptuous to conclude that Americans have no right to know what is being done in their name
anyone else have one of those cars that lets people steal items from your car while your in the store because the doors don't lock while your in range?
Minimum threshold fixed. Thanks!
You do realize that the Passive Keyless Entry System you are talking about in the submission allows your car to be opened while you are in your house?
https://www.grc.com/sn/sn-508.pdf
But that's OK, just find one of the many other IoT with a great security track record to use as another example. Oh wait....
I remember when the iButton (and the Java ring with a java iButton embedded in the ring) came out, *that* was going to eliminate passwords - just hold your ring up to the iButton reader on your door, your computer, or any thing you want to secure. Passwords are a thing of the past when you have your iButton.
It's only been 17 years, so I'm sure we'll start seeing the readers built in to computers any day now.
https://en.wikipedia.org/wiki/...
I'd like to know who is waiting for it. I certainly am not waiting for passwords to be killed. I only use passwords and never use two-step or more BS. Why? Companies seem to always want shit like my phone number. Well, google, you can F--k off, I'm not giving you my phone number. I'll just make awesome passwords, use different passwords for different websites and never link accounts and devices.
I think you're quite a bit too optimistic about the future with respect to the watch taking over from the phone. Even without doing 99% of what the phone does, the watch's battery life varies from modest (typical Android Wear now) to downright miserable (Apple Watch and, in the early days, Moto 360).
However, as a password killer my watch is already there. My phone is locked when it's more than about 15 feet from my Moto 360 smartwatch (and therefore, from me). I can still get into my phone easily, but others can't -- and dozens of times a day the watch stops me having to take the second or two to unlock the phone. And while it'd be awesome if the watch could be paired to my tablet at the same time and do the same thing for it (it can't), my tablet senses the presence of my phone and unlocks when it's around too, which is almost as good (if not quite as secure).
As for the PC, my laptop has a fingerprint scanner that gets me into Windows in a fraction of a second with no fuss. It can also log me into websites using Internet Exploder, but sadly not with Chrome, so we have some work to go still. Solve that nut, though, and passwords will be a thing of the past for me about 95% of the time.
Might be OK on a touch phone, where typing is a painful process. Mine doesn't have a fingerprint scanner, and AFAIK, none of the ones with removeable batteries and SD cards do, so it is not an issue I am likely to encounter.
Sent from my ASR33 using ASCII
... tying something you physically possess to identification, but it should never be used standalone. A password, pass-phrase, or even a pin should still be required, because anything else can always potentially be taken from you, or worse yet... compromised. The additional factor of having some physical device that can further confirm your identity gives an added layer of security over the password by itself that can still be beneficial, but it should never be trusted to the exclusion of a password.
File under 'M' for 'Manic ranting'
Since I'm unfamiliar with the watch I'd like to know why this comment is -1. Even my iPod Nano that I wore with as a watch had enough icons on the screen to prove pass codes are at least feasible with the form factor.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
You know how old-media companies always go on about how copying media is somehow "theft", even though we all know it's not?
Well, the problem with digital authentication keys is similar; it can get copied without you losing anything.
Attaching authentication to a physical item that actually CAN get stolen changes the game dramatically.
It's a single point of failure that will give a false sense of security.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
if it is simple enough for a device to recognize you it can be faked. The device has to use radio waves and this makes it more vulnerable as has been proven few times already by e.g. stealing a car that had that feature on from the parking lot while owner was sitting in a restaurant.
... was just used to login to /.
now we need to go OSS in diesel cars
Would be fun to observe people waving their hands in complex patterns detected by a built-in watch motion sensor to unlock things. The watch could even play a little tune to help synchronize arm movement to a beat. It would be easy to steel people's password though, if you got a good sense of rhythm and dance. Ok, this was meant as a bit of a joke. But the fun thing is we would probably get used to it, just like we got used to people talking to themselves on the street.
On a somewhat more serious note, authentication should in theory not be too hard. People could have e.g. electronic watches, which could be authenticated by some secure means - e.g. a fingerprint scanner on the back side plus enter a code in some way. Or it could be coupled with a mobile phone so that you use your cell phone to authenticate with the watch. The wristbands could have some type of wiring and/or sensors which informs the watch it is still on the wrist (plus pulse sensors to detect owner is alive and defend against the good old movie plot chop-off-the-arm attack), so no need to re-authenticate as long as the watch is not physically removed. The watch or some other gadget could be used to authenticate with other things.
The main problem I would see is some decent secure open standards for authenticating with "things". There will probably be a bunch of walled gardens which force you to choose between various closed ecosystems.
Fuck you and your pointless buzzword.
Buck Feta. You know what to do.
It will be a cold day in hell when I use a cloud based authentication scheme to access my own shit. I'm not going to use a system where I have to ask someone else permission to use my shit. Anyone that does is eventually going to get what they deserve.
Digital is, by definition, imperfect. Analog is the way to go.
"Well, as anyone who's ever unlocked car door just by reaching for its handle with a key in their pocket knows, the answer may be the embeddable devices themselves."
BMW cars without this are secure and not easily stolen. BMW cars with "comfort access" are easily stolen.
Same with GM, Toyota, etc...
Nope, I am not trading security for convenience.
Do not look at laser with remaining good eye.
calling the trend is a bit much. That's like some having a cold and the next day we're sending someone through the town square yelling "Bring out your dead".
Two factor secuirty : Something you know, Something you have, Something you are - Pick two
Something you know : Password
Something you have : Device, RFID etc
Something you are : Biomentrics
using only one is a bad idea
Also known as Something you forget, something you lose, something cease to be ....
Puteulanus fenestra mortis
Actually, I think over the next few years for many of us our phones will migrate onto our wrists
And this is the problem with the culture at Google these days. Ever since all employees started using macbooks and they only hired 20 something's with thick frame glasses and "nerd" t-shirts they've been on a steady decline into the toilet. This geek tech culture is a serious blight. You people are ruining a once magnificent company. Oh ya... And get off my lawn.
If it ain't broke, don't fix it.
There is so much wrong with this article its not even funny. I don't blame the writer, he's just trying to tie a nice neat bow on a badly wrapped pig.
I had to laugh though when he twice gives the example of proximity unlock on cars as IOT security. These are the same devices that only guarantee proximity security by using signal strength and thus are easily defeated by a $17 signal booster available on eBay, which has been in the news as the cause of many thefts of the contents of vehicles.
By seriously the core issue here is authentication and concentration of secrets, and no matter how many extra factors you have this will not change because each new factor requires the service to store another secret to be stolen or live phished from you.
As I see it the only long term solution is a better single factor and one that puts the handling of secrets as close to the user as possible and contained in something that is hardened or prevented from running malware. Then have that device use a site specific asymmetric key pair to offer a zero knowledge proof of authentication to the service. In that way the services hold no authentication secrets and what they do hold cannot even be used by an attacker to infer linkage between services.
Unfortunately right now, there is nothing in production and widely available that can do this, not even the much vaunted FIDO an U2F will accomplish this as their choices have rendered those protocols only usable as a second factor. There is one Single factor protocol that is presently 18 months into its research and development that I think will satisfy all the requirements of what the article writer needs, that being SQRL from The Gibson Research Corporation. Which also has additional features that even allow complete recovery from a loss of control over its core secret.
How about NO.
Came here to say the same thing. THIS is the correct answer, not some shitty article.
but also the juveniles and it leads the current fashion trend in the this competitive boot industry in the globe. The products which have various kinds of styles and functions have been acknowledged by many patrons presently in the fierce marketplace as they embrace the good durability as well as comfort for different ages. Meaningwhile air max 90 . the unusual and distinctive design can capture the regulars' eyes at once. Leather materials and pure wool texture are the key points in manufacturing the boots so that it can match people's feeling. The boots corporation are manufacturing all kinds of boots together with a choice of designs in order to fulfill different people's needs, so the boots are trendy engouh for you to go to each place and in any moment of the year. A range of kinds of boots are used in sundry fields, for instance, the watertight boots can keep your feet from wet, and the working boots are made for those who have to work in the outside. Interestingly, the company also holds the kids boots which are designed based on children's characteristic and usage. Undoubtedly, timberland casual boots are welcomed by scores of people, especially in the summer as the boots are used to enter to the bazaar in order to expand the earnings.
Until the person who wants your password, access to your house/car, etc. cuts the embeddable device out of you to use it.
You should probably invest in a better laptop, then. I type extremely fast -- the only person I know who types faster than me is my wife -- and good thing too, because my entire career is based around my creating and typing my own content.
My laptop password is 11 characters and takes me somewhere between three-quarters of a second and a full second to type, from the moment my fingers reach the keyboard after having clicked in the password field. My fingerprint scanner takes somewhere between 0.25 and 0.5 seconds to swipe, and doesn't require me to select a field first -- I just swipe straight away that the login screen appears. And only very seldom do I need to swipe a second time.
The result is that I'm into my laptop somewhere around a second or more quicker, and without increasing my chances of carpal tunnel unnecessarily, no matter how slightly. (On any given day I likely login several dozen times, because my laptop locks itself regularly after a short, secure delay.)
Gah, i am so disappointed in slashdot. comments like the parent are why i come here. Somebody who spends their time thinking about an interesting problem and is willing to share some of that background. Instead of discussion we get people complaining about ... anything.
Anyway, thanks for the post. I like the way you are thinking and I love the idea of 'as secure as necessary'. I can see a future where my phone decides when it is still with me based on the myriad of data it collects (and helpfully shares) and unlocks my house as I get near (unless I mumble a 'kidnapped' signal in which case it should drop the machine guns and kill the bad guys trying to force their way in with me... B)
tbh, the steps to get there don't seem that far off either. I spent a bit of time trying to think of 'real' road blocks but i was able to dismiss most of them outside of time and money it would take to replace everything w/ an integrated version.
That of course assumes somebody wins a standard war and is able to push through a standard protocol for the authorization levels which the various apps and IoT vendors support. Which also needs someobdy to solve the patching problem on these IoT devices (which will hopefully allow us to move toward a solution to the security problem). gah, i was getting optimistic for a second there...
Kidding aside, I would like to explore this more. Any podcasts/blogs you recommend in this space?