Password not accepted: are biometric checks the answer?

[merrybigboy]

I’m old enough to remember a life in which you could confidently expect your skill for guessing passwords to be redundant by about the age of nine. That was when your mate down the road finally overcame his love of spy games and his obsessive desire not to allow you past his front door or into his garden shed without you first establishing his favourite crisp flavour. Unfortunately, however, it seems that mate, who subsequently spent his lunch hours in the school’s windowless computer room, up to his knees in punch cards, has long since taken over the world.

Last week, I again found myself in that familiar circle of hell reserved for tired and impatient and forgetful people very close to a deadline. I had already spent way too long trying to remember that week’s combination of password and user name in order to enter a Gmail account – my Gmail account – which I was unaccountably excluded from and to which I needed access in order to open a document that I had to rewrite. Having finally come up with the password – complete with recent mutations of ampersands and exclamation marks and upper and lower case letters and barnacles of numeric additions (first phone number? gym locker combo?) once created on a cheerful whim and now half-forgotten at painful leisure – I was faced with an unexpected conundrum. Six blurred photographs of street scenes flashed up on my screen along with this unwarranted question: “Which of these images contains a shopfront?”

Password Expiry Notifier | ManageEngine.com

 ManageEngine.com/ADSelfServicePlus

AdNotify Users on Password Expiration with ADSelfServicePlus

Active Directory Reset Password

Active Directory Self Update

Unlock Account Active Directory

Password Expiry Notification

Google’s virtual jobsworth of a security guard clearly wanted to know who exactly it was dealing with (and to collect some more free data for its picture-recognition software). Was I a robot mind myself, intent on hoovering up barnacled passwords? Or was I indeed a tired and impatient and forgetful human being very close to a deadline? In the past, I guess, one or two goes at a Captcha graffiti might have sufficed, but as machine intelligence has become smarter, a more nuanced capacity was apparently required to establish my human credentials. We might not be good for much these days in Google’s eyes, but we can certainly recognise a shopfront when we see one.

I peered at the photographs on the screen, as if they were exhibits in a William Egglestonshow. Some of them were straightforward enough, but one or two undeniably gave me pause. In the background of one picture in particular some warehouse type buildings clearly had floor-to-ceiling glazing but no obvious signage. What to do? Surely the creators of this test wouldn’t expect this level of pictorial analysis – or perhaps that was exactly what they required? If I looked really hard at a certain angle I thought I could make out some shadowy furniture in the window of the warehouse in question. But still it looked more like some kind of out-of-town storage facility than a conventional shop. Taking my life in my hands, I plumped for the “x” indicating “no” and pressed enter. Another six images flashed up, no less complex in their composition than the first set. And again the question: “Which of these images contains a shopfront?” And so the morning ebbed.

Even for the man who is credited with creating the 'user name and password' protocol, the tool has become a curse

A couple of years ago, I visited the headquarters of Google in Palo Alto and talked to Amit Singhal, then head of search, about his vision for the future of our interaction with our uncanny machines. He suggested that the ultimate goal was really something like what you saw in the Star Trek episodes he grew up watching in a village in India. He imagined a near future in which the interface between man and computer would be entirely intuitive and transparent.

“The endgame of this is we want to make it always as natural a thought process as possible,” Singhal said. “We are maniacally focusing on the user to reduce every possible friction point between them, their thoughts and the information they want to find.” I thought of that conversation when I was at San Francisco airport later that day, trying to summon a booking confirmation on my phone and faced with the need to first answer the following questions that might have been posed by my mate up the road: “Who was your favourite teacher at school?” and “What was the first album you bought?” Frictionless wasn’t the first word that came to mind.

In a recent survey of European workers using IT in their jobs, it was suggested that they spend about 36 minutes a day on “login events”. A number that prompts the thought: they must have got lucky. Over the past decade or two of our digital lives, each of us has built up an average legacy of more than 100 sites and apps requiring passwords for access. As the fraudsters and hackers have got more skilled, so the bar for entry has been set ever higher. The recent added complication that on a “password change event” you cannot choose a password you have used in the past 12 months is another cruel blow to our garbled private mnemonics. In the past year, 55% of people admit to abandoning a login due to a forgotten password and about the same number suggested they had given up on paying for something they wanted to buy online because of the complications of the authentication process.

Even for the man who is credited with creating the “user name and password” protocol, the tool has become a curse. That man is an emeritus professor of MIT, Fernando Corbató, now aged 90. In the early 60s, Corbató was in charge of a massive prototype time-sharingcomputer at the university called CTSS. The computer was the pioneer of many of the features of digital technology we have come to love – email, instant messaging – and one that we do not. Because of the shared nature of CTSS it was decided that researchers should have their own accounts so that their work did not overlap. A simple name and password code was devised to create a degree of privacy.

In 2014, Corbató gave an interview to the Wall Street Journal in which he acknowledged that he had inadvertently made a “sorry that password has not been recognised” monster. “Unfortunately, it’s become a kind of a nightmare with the world wide web,” he said. “I don’t think anybody can possibly remember all the passwords that are issued or set up. That leaves people with two choices. Either you maintain a crib sheet, a mild no-no, or you use some sort of program as a password manager.”

What did Mr Corbató do? the WSJ wondered.

“I have to confess, I used to use a crib sheet,” he said. “I don’t think I’m guarding any great secrets. Three typed pages. Probably 150 passwords over the years.”

This 50-year-old technology has long been showing its age – despite the levels of complexity there are major password breaches reported weekly – but it has proved hard to replace. Currently, there are many companies competing to create a new form of universal open sesame that will make all those password reminders redundant. Google, Facebook and Apple are inevitably leading this effort, though many businesses are reluctant to hand over their authentication processes to the data-loving giant, which gives an opportunity to innovative companies with a focus only on security.

Gigya, based in Palo Alto, provides a platform that manages 1.4bn user identities globally for customers including banks, retailers and the BBC. Most of the login processes they manage are still password-based, but more and more use a form of “social registration” – “Can we use your Facebook or Google details to find out who you are?” – and some use biometric gateways: fingerprints, facial and voice recognition.

Richard Lack, director of sales, expects this latter category to grow exponentially in the next five years. In its somewhat polemical report on the “death of the password” (a demise predicted more often than that of the English novel), Gigya suggested that “more than 770m biometric-enabled applications will be downloaded each year by 2019, as compared with 6m in 2015”.

“We do all hope the password dies quite soon,” Lack says. “And the research supports the fact that most consumers hope that too – 52% would rather have biometric security.” (And, as we all now know, 52% these days means that the people have spoken in unprecedented numbers: biometric means biometric). “A few banks are starting to use it,” Lack says. “HSBC and First Direct are allowing touch ID to log into your account and also some voice recognition. But for the better part we are still using complex passwords.”

Where does the resistance lie?

“I think security is the drag anchor,” Lack suggests. “With most of our customers there is usually a security team that is extremely anxious about adopting new technology. The irony is that, as we know, passwords are far from secure now. The average user has fewer than three passwords and those can very often be easily guessed. They use them on average across 120 online accounts. If a password is guessed on one, then effectively a hacker can completely unlock your digital life.”

A couple of recent changes may accelerate the march of biometrics. The new European directive on payment services mandates that any online payment will require two-factor authentication (usually password plus SMS code), though lobbyists for retailers are currently challenging that. The other engine of change is the fact that two years ago the Apple touch recognition interface was made available to anyone who wants to use it. The first adopters have been banks because they have huge costs on call centres, specifically for password resets. “Touch is anyway far more secure than anything that has gone before,” Lack argues. “We expect all banks to adopt biometrics in the next couple of years.”

The other advance is in using network effects for identity management – a pooling of your identity data: “On the horizon is the capacity that when security is breached in one place the network immediately knows about it,” Lack says. “It’s like an immune response. Where one customer detects that I have had three failed password attempts it notifies everyone else in the cloud and says this user needs to step up authentication or have their account locked. That’s a massive benefit for security teams. That will drag them toward cloud-based security and biometric authentication.”

It does sound like a major step forward for security teams, if somewhat less so for users who will presumably suddenly be shut out from their online lives, although perhaps only until they have swiped a finger.

The company ThreatMetrix has been working in this latter area for a decade and 30,000 websites and apps use its technology, which is invisible to the customer. Its solutions director, Stephen Moody, says: “The challenge is that you can’t really have a central store of biometric data because of the privacy implications. It needs to remain anonymous. In our view, the key additional security measure you need is what we call ‘ongoing behavioural analysis’, which secures all the weak points in registration.”

To this end, ThreatMetrix has built an anonymised network called the “digital identity network”, which already sits on websites and mobile apps and is enabled by cookies. This network monitors every account transaction you make, anonymously. “We don’t know who you are but we tokenise various aspects of your behaviour and we correlate that together,” Moody says.

What kind of aspects of behaviour?

“Simple things. For example, when I go about the internet I use several devices. Maybe a couple of laptops, two phones, and I tend to use these machines to connect to the internet in different ways and from different locations. I have a VPN at work, I have Sky broadband at home. So over time I have a clear pattern of behaviour. Do I tend to have flash-enabled or is it turned off? The system looks at all that and correlates it with my different email addresses for example, work and home, the credit cards I have associated with those accounts and so on. Every time we see an event, we are saying, ‘Does this interaction look consistent with what we know of this person’s behaviour? Do you usually log on to your bank account in this way from this location?’ If you do, you get a positive trust score. If not, there will be an alert.” Over time, your anonymous security profile will only get stronger, Moody suggests, making it easier and easier to know for sure it is you doing what you are doing.

Phil Dunkelberger is the CEO of a company called Nok Nok. Speaking on the phone from California, he inevitably asks me: “If I say Nok Nok, you say?”

“Who’s there?” I reply dutifully.

Nok Nok has added an extra twist to these future scenarios. It is Dunkelberger’s belief that your phone will increasingly become your gateway to much of the internet. If you have it on your person and you are biometrically logged in, that will be enough to enable forms of access without password issues.

“One of the companies we work with allows you to use your phone to open the electronic lock as you move inside the perimeter of the building they have ‘geo-fenced’. You don’t have to log in to anything, as long as you have your phone with you. It logs you in to machines, the assembly line. You have a strong authenticator. The biometric is the phone itself. If at any point the system suggests it doesn’t think it is you, it can prompt you to swipe your finger. It’s like keeping your front door keys with you.”

The other most requested service Nok Nok has is for face or “selfie recognition”, says Dunkelberger, “partly because the whole world is selfie mad”. The technology has overcome the teething problem of people bypassing the security test by simply holding up a photograph of a face for recognition access. “We have this thing we call liveness,” Dunkelberger says. “You are asked to blink your eyes and nod your head and the software can read that. It works well in good lighting. It’s more challenging in a shadowy area, but the cameras are getting better. That is coming. Yesterday on the east coast I was in five places that were asking, ‘When can we have picture modality?’” The answer, he says, was soon.

In the meantime, we are left with the last knockings of passwords that accumulate their unusual characters by the day. Or, maybe for some of us, perhaps they do not. Every year, SplashData compiles a list of the millions of stolen passwords made public in the past 12 months, then sorts them in order of popularity. And every year the top two passwords remain unchanged: “123456” always comes in at number one and “password” stubbornly retains its runner-up spot. Not far behind is a login that sounds quite a lot like a cry for help: “letmein”. You can add exclamation marks as required.

http://www.msn.com/en-us/entertainment/story/password-not-accepted-are-biometric-checks-the-answer/ar-AAjBLjK