cockroaches of the internet.
They really, despite all of our best
efforts, are very hard to kill off.
And companies have been trying
to do it for years.
The average office worker in the United
States must keep track of between 20
to 40 different username
and password combinations.
With so many passwords to remember, it's no
wonder why many of us use the
same ones over and over, or have
a running list of passwords saved somewhere
on our computers, phones or notebooks.
Passwords are a very serious
and expensive security risk.
It's why companies like Microsoft, Apple and
Google are trying to reduce our
dependence on them. But the question is,
can these companies break our bad
habits? Passwords, by themselves,
are just not that
secure. In a 2015 interview with
John Oliver, Edward Snowden explained just
how easy it is to
crack a typical password.
Bad passwords are one of the
easiest ways to compromise a system.
For somebody who has a very
common eight character password, it can
literally take less than a second for
a computer to go through the
possibilities and pull
that password out.
I think we're going to have a no
passwords future because it just gets rid
of a lot of problems.
You never know when the bad guy has
your password, at the end of the day.
That's Kevin Mitnick. He's pretty well
known in the hacker community.
I started off many, many years
ago as a black hat hacker.
I wasn't hacking to cause
harm or to make money.
It was all about the intellectual
challenge, curiosity and seduction of
adventure. And then I pushed the envelope, and
I pushed it so far, I became
the world's most wanted hacker.
And I was pursued by
federal law enforcement agencies.
And they eventually caught up with me and
I ended up serving five years in
federal prison. Nowadays, Mitnick says
he's an ethical hacker, assisting
companies to identify their security
vulnerabilities and helping to fix
them. And finding your usernames and
passwords, it's much easier than you
might think. There's a site
out there called weleakinfo.com.
So what weleakinfo is, it's a site
that has aggregated a bunch of data
breaches. And so what happens is
the data, namely your username and
passwords that are on these data
breaches, get aggregated because they're
publicly available.
And there's sites like weleakinfo, that kind
of make it like a Google, where
you can actually just put in an email
address of yourself or a friend, and
all the prior data breaches that
contained your username or your email
address, it actually
reveals the password.
All it takes to find the site is
a quick Google search, and users can get
access to more than 10,000 data
breaches for as low as $2.
And it's not even the only
website to offer these services.
Simply put, passwords are not fit
for purpose for today's networked economy.
They present challenges to consumers in
the sense that they're either hard
to remember or they're too easy to
remember, in which case are easier to
mimic and steal. For businesses, they
represent a huge liability, in the
sense that the vast majority of
data breaches are caused by passwords,
either passwords that slip from an employee
and expose a database or allows
other bad actors to
get into their systems.
So passwords present challenges
across the board.
A report that looked at 2,013 confirmed
data breaches found that 29 percent
of those breaches involved the
use of stolen credentials.
In another study, researchers found that the
average cost of a data breach
in the U.S. was more than $8 million.
And even when passwords are not stolen,
companies can lose a lot of money
resetting them. Our research has shown
that the average fully-loaded cost of
a help desk call to reset a password
is anywhere between $40 or $50 per
call. Generally speaking, a typical employee
contacts a help desk about
somewhere between six and ten times
a year on password-related issues.
So if you just do the simple multiplication
of six to ten times times $50
per call, times the number of
employees in your organization, you're talking
significantly hundreds of thousands of
dollars or even potentially millions
of dollars a year. And that's just
really the IT operations costs, that's
not really factoring necessarily the productivity
cost that gets lost by the
user having to wait for maybe 20
minutes, 30 minutes or even longer to
actually have the password issue
resolved to their satisfaction.
In large companies like Microsoft, Apple
and Google with upwards of 100,000
employees each, these costs
can quickly add up.
A former Microsoft executive told CNN in
2018, that the company spends more
than $2 million dollars each month in
help desk calls, helping people to
change their passwords.
With the details of our
personal and professional lives increasingly
residing in the digital realm, those
costs are likely to grow.
The first use of the computer password dates
back to the early 1960s at MIT.
At the time, computers were these
huge contraptions that could only manage
the work of one person at a time.
This limitation frustrated Fernando Corbató, who
came up with the computer
time sharing system.
CTSS was an operating system which
distributed a computer's processing power
so that multiple people could
use it at once.
This naturally led to
the issue of privacy.
So Corbató created the password.
Ironically, the first computer to use passwords
was also the first one to be
hacked. One of the researchers in Corbató's
lab found that he needed more
time to complete his work than
the weekly hours allotted to him.
So he printed out all the passwords stored
on the system, and used them to
log in as his colleagues.
The conventional rules of password
creation adopted by companies, federal
agencies and universities were attributed to
a document released by the
National Institute of Standards
and Technology in 2004.
The documents suggested that users should
have a minimum of eight character
passwords and that those passwords should
include at least one uppercase
letter, one lowercase letter, one number
and 1one special character, and be
changed regularly.
But in 2017, NIST
rewrote the password rules.
This time, the agency suggested using
long, easy to remember phrases instead
of crazy characters, and only changing your
password if it might have been
hacked. Passwords have come a
long way since the 1960s.
With innovations such as fingerprint
readers and face scanning on
smartphones, verifying your identity now often
goes beyond just entering a
password. This comes in the form
of two-factor and two-step authentication.
There's three forms of authentication.
One is what you know, such
as a password or a pin.
The second thing is what you have.
So possession of a
device in your hands.
And a third means of authentication is
who you are, like a biometric.
The password alone is the
highest risk way of authenticating.
And that that leads to phishing and
data breaches and all the nefarious
things we see on the web today.
Any form of two-factor authentication is
better than passwords alone. What I want
to note, though, is that not all
two-factor authentication is
created equal.
Things like getting SMS messages, so a text
message with a pin code, is both
inconvenient but also can be spoofed and
is not a foolproof means of second
factor authentication. NIST even restricted
the use of one-time passwords
being sent over SMS as
a means of two-factor authentication.
For something to be two-factor
versus two-step, the authentication elements
must come from
two separate categories.
An example of two-factor authentication is
withdrawing money from an ATM.
First, you insert your bank
card, something that you possess.
And then you were asked for
a pin, something that, you know.
Biometrics are the newest form of
authentication and have risen in
popularity thanks to smartphones that
include fingerprint readers and
face-scanning cameras.
Meanwhile, digital assistants like Siri,
Alexa and Google Assistant have
advanced voice
recognition technologies.
In fact, a number of banks, including
Chase and Barclays, now allow their
customers to verify their
identity using voice biometrics.
When customers call in, their voice
is automatically matched to a previously
recorded voiceprint, that's made up of
more than 100 characteristics such as
pitch, accent and shape of your mouth.
One organization that's been at
the forefront of bringing two-factor
authentication standards to the masses
is the FIDO Alliance.
The FIDO Alliance, which stands for,
Fast Identity Online, is a consortium
of more than 250 companies who are
working together to reduce the industry's
reliance on passwords by
standardizing two-factor authentication.
This past year, we've seen FIDO become
a core part of the Android and
Windows operating system, meaning that any Android
7 or later handset or any
Windows 10 machine can leverage actual
onboard biometrics for that device.
So a fingerprint reader, a face scanner,
whatever it might be, to log in
rather than using passwords.
Other companies that work with the
FIDO Alliance include eBay, Facebook,
Twitter, PayPal and Bank of America.
Even the U.S. government
has adopted the standard.
FIDO's big advantage over other standards
comes down to where it stores
users' personal information.
The core problem with passwords is
that they reside on a server.
The problem with that is that when it
sits on a server, they can be stolen
by a hacker. Additionally, someone can
impersonate you quite easily, either
by phishing your credentials or by buying
your credentials off the Dark Web
and then trying to stuff
them into the account.
Everything FIDO does is local on the
device, which does a couple of things.
One, it's easier.
But perhaps most important,
it protects your privacy.
So you can always change
your password if it's hacked.
But you really can't
take your face back.
You can't take your fingerprint back.
So it's very important that companies
that are using biometrics use
local-match biometrics, meaning match-on-device, which
is what FIDO supports
to protect user privacy and
have enhanced user experience.
Microsoft has been hinting about getting
rid of the password for years.
Let me move over to my Surface Pro 4.
I don't know if
you noticed what happened.
It recognized that I was just standing
in front of the computer and it
logged me in. And this is
the power of Windows Hello.
Where it does the face recognition
and logs you right in.
I mean, think about one of the
biggest issues of security is passwords.
So one of the things that we are
working on is a world where passwords are
not going to be the ones
that, you know, get hacked.
But you really have other biometrics
that really help us secure our
computing interfaces.
Microsoft sees 6.5
trillion hacking incidents per year.
That's why 90 percent of its employees
can now log into the corporate
network without a password.
We are on a mission
to be password less.
We've built password less
technology into the OS.
And we tell customers, of course, that
it's much more secure than actual
passwords because about 70 percent of
phishing attacks today still are
caused by stolen passwords.
So what we've recommended is
that customers use biometrics.
At Microsoft, we use
Windows Hello for business.
I look at my computer to
log on in the morning.
That's how I authenticate. If I'm on
my phone, I'm using my thumbprint.
We don't see our passwords anymore because
that is, the user and the
password or the weakest link
in your security system.
Microsoft introduced Windows Hello to customers
in 2015 with its devices
running Windows 10. Windows Hello allowed
users to ditch the password and
log into their devices with just
their face, fingerprint or pin.
Like FIDO, Microsoft has said it
stores user biometrics on the device
instead of on a cloud.
In 2018, Microsoft announced that it
would support logging into Windows 10
with FIDO2 compatible devices, such as
hardware keys made by Yubiko.
We've been on a mission
to eliminate passwords altogether.
And, you know, we're focusing on
passwordless log in experience that's both
secure and the user friendly.
And we've seen a lot of success
with our authenticator app for consumer.
And so we'll bring that to Azure AD.
Microsoft Authenticator is an app that
allows users to take advantage of
two-factor authentication on any device, not
just those running Windows 10.
Alex Simmons, Vice President of Microsoft's
identity division, said in a
tweet that the company has more than
80 million unique monthly users that
sign in with a passwordless method.
Apple's been encouraging the use of
biometric authentication since it came
out with Touch ID on the
iPhone 5S back in 2013.
The company called Touch ID the
gold standard for consumer device biometric
protection until it introduced Face ID
on the iPhone X in 2017.
And the data for Touch ID has been
1 in 50,000, meaning that the chance that
a random person could use their fingerprint
to unlock your iPhone has been
about 1 in 50,000 and it's been great.
So what are the similar
statistics for Face ID?1
1 in a 1,000,000. Back in 2016,
Apple also introduced Auto Unlock, a feature
for MacOS. Today, when you first approach
your Mac to use it, the experience
is something like this. You open it
up, you're confronted with a password
field, and you type and then maybe
mistype, and then retype your password,
and then you're in and using your Mac.
But you know, for many of us,
we already have a device securely
authenticated to our wrists that already knows
who we are and could tell our
Mac. And so then, when we open our Mac,
it could be a little bit more like
this. In its guidelines to app
developers, Apple stresses that apps should
support biometric authentication whenever possible
and that apps should only
ask for a username and password as
a fallback, if the first method fails.
Google has also been working to make
passwords a thing of the past.
The company has required its employees
to use physical security keys since
early 2017, and has seen
a huge reduction in phishing.
In August of 2018, the
company released Titan to consumers.
Titan is a physical key that allows
users to take advantage of two-factor
authentication on their
computers or smartphones.
In 2019, Google announced that phones running
Android 7 would all come with
a built-in security
key using Bluetooth.
A few months later, Google extended
that function to iOS devices, meaning
that iPhone and iPad users could
now use their secondary Android smartphones
as a security key whenever logging into
their Google accounts on an iOS
device. While Microsoft's Windows 10
devices and Google's new Android
devices are FIDO2 certified, Apple has been
slower to adopt the standard in
its products. Even though Touch ID
and Face ID made biometric authentication
the norm for unlocking our phones,
Apple's devices are still not FIDO
certified. But Apple
is making strides.
Of late, Apple's been supporting FIDO technology
both on iOS and on MacOS.
So the latest versions of their
operating system support FIDO, meaning that
if you're accessing a website that supports
FIDO on an Apple device, you'll
be able to leverage
FIDO authentication as well.
The Department of Justice has also
been moving away from password
authentication. The agency adopted a
single-sign-on method back in 2017.
One of the reasons why passwords persist
is that they are universal, they
can be used by anyone.
There are no limitations.
There's no special
hardware requirements.
You don't have to have a certain kind
of phone or certain kind of laptop.
Anyone can use passwords. There are a
few key challenges to really moving
beyond being dependent on passwords.
One of them is technical, and that's
FIDO has been seeking to address.
And we've now created the technical
standards that are web standards for
authentication that does not
depend on passwords.
Another challenge is behavioral.
And we've been trained with this
risky way of authenticating using
passwords. We'll have to be untrained to
use simpler, but new mechanisms for
logging in. So I think there'll be
some behavioral changes that need to take
place, some education.
You know, the good news is these are
changes are for the better and for the
simpler. And so, we think that people
will embrace these changes at the same
time as new technologies roll to market
to enable us collectively, on the
whole, to move beyond passwords.
Experts say that getting rid of the
password will be a long journey,
especially when it comes to getting
people to ditch their bad habits.
The consumer approaches will
be very much opt-in.
In other words, if users actually
want strong authentication, companies will
be able to provide it to them,
but just because it's available, doesn't mean
that every customer is going
to go for it.
You may now need to start collecting
information about the user like a
mobile phone number that you need
to use to communicate with them.
And perhaps users don't want to
provide that information or they're
reluctant to. On the consumer side, I
believe passwords will be slower to
get rid of. Which also means that
the risk of breaches of consumer sites
will persist for
the foreseeable future.
No comments:
Post a Comment