Slashdot Mirror
Google Plans To Bring Password-Free Logins To Android Apps By Year-End (techcrunch.com)
An anonymous reader shares a report on TechCrunch: Google's plan to eliminate passwords in favor of systems that take into account a combination of signals -- like your typing patterns, your walking patterns, your current location, and more -- will be available to Android developers by year-end, assuming all goes well in testing this year. In an under-the-radar announcement Friday afternoon at the Google I/O developer conference, the head of Google's research unit ATAP (Advanced Technology and Projects) Daniel Kaufman offered a brief update regarding the status of Project Abacus, the name for a system that opts for biometrics over two-factor authentication. With Project Abacus, users would unlock devices or sign into applications based on a cumulative "Trust Score." This score would be calculated using a variety of factors, including your typing patterns, current location, speed and voice patterns, facial recognition, and other things.The Trust API will be available to developers, who can then implement that into their apps. The company says that developers will have the option to adjust the threshold required for a trust score.
What on earth is wrong with two factor authentication? I can't see these being more secure.
....now they want me to start using authentication that assumes that I keep my same physical abilities all my life.
HAHAHAHAHAno.
Finding God in a Dog
Good luck getting that to work when you're drunk and trying to order up an Uber.
"I need -hic- whoa I need a uber to get home"
UNAUTHORIZED USER
"No like really man, open up and order me a..."
UNAUTHORIZED USER
"Oh fu...fu... fine... hic... Oh wait"
UNAUTHORIZED USER"
"SHADDUP THAT WASN'T AN ATTEMPT"
UNAUTHORIZED USER
"wait wait... my voice is.. my passport, verify me?"
UNAUTHORIZED USER
"FUG YOU... Ima just gonna llie down on this soft concrete now..."
"Oh dude... check out this guys awesome phone, grab it!"
User accepted, have a nice day.
"sweet!"
Simple solution:get a new bank, or better yet if you're in the US a credit union. Then again I deal with two of the largest banks in the world (BoA and Wells Fargo, both through acquisition of other banks) and they have no problem doing online banking correctly.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
It sounds like this biometric-based "trust score" will just be an additional verification factor... So I am not sure why they are saying it is going to replace 2nd factor.... it will BE the second (or third) factor...
Also, being a second factor implies that this will not unlock your device by itself... it will just be an additional "verification" on your unlock method... like: I see that you got the unlock dot sequence technically correct, but you did it in a swiping style that is inconsistent with all your previous unlocks... so no login, try again.
So, saying that it will remove the needs for passwords is... well... lying really.
I mean, how would that work even if it was true? Phone: "Walk around a bit to unlock." what?
I mean, the tech is neat, but it would seem as though the article is getting some facts completely wrong... either that, or I am not understanding this correctly...
My eyes reflect the stars and a smile lights up my face.
So they want a technology that can accurately identify me by all sorts of unconscious traits. This would make any form of anonymity impossible.
I completely understand why Google wants this - collecting and selling information is their business model. I don't understand why *I* as a customer would want it.
Do not want. Courts can, and do, compel people to provide bio-metric data, as that is not protected by the 5th Amendment. Only passwords and pass-phrases are protected. Government agencies would LOVE this trend, especially if it became the only form of authentication on your device(s), as they wouldn't need a back door to your encryption anymore. Do not accept this weakening of your security.
This sig intentionally left blank.
This seems horrible in every way possible.
What Google is really saying is that they're tracking so many user behaviors that you will not be able to hide behind an alias.
What problem is this trying to solve? And more importantly, why is google collecting this specific information about users and once collected, how else will it be used and by whom? Maybe that's why the announcement was "low key." They were hoping it would go unnoticed.
But I hope they also have a second channel for verification of login or transation, like sending you an SMS with the amount transferred and the target account number along with a one time pin to sign the transaction, right?
If not, tell them their security theater is worth less than the TSA goons at the airport. And they're already worse than useless.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
When I used to do locksmith work, it would take me a few seconds to unlock your car or house if you locked the key inside. Customers were happy that I could bypass the security for them.
Now that I work in information security, most people seem to think something is horribly wrong if I'm able to bypass the security.
There is an appropriate level of security for each use case. Neither your apartment nor your Slashdot account needs to be an impenetrable fortress that even the CIA can't get in to . Sometimes, convenience does trump security.
I want to be able to write rules, so that, if I'm at home (Geo-location) and connected to the wireless, then you only need a simple unlock code.
If I'm out and about, I want it to be looking for my smart watch before it will unlock, or otherwise a yubikey (NFC).
If you want to get into my work section of my device you need *all* the above. Bluetooth, NFC and a strong unlock code.
If you don't have any of this stuff, no unlock. If you fail auth 7 times, full brick. Device destroyed.
I don't want to reward people who would mug me for my phone, if we got to the point where the devices are a worthless lump without an unlock, then people won't steal from you. Remove the incentive, remove the crime.
Curiosity was framed; ignorance killed the cat. -- Author unknown