Technology Cloud Contributor

“Management by AI”: Analytics in the Data Center

Management by AI Behind any cloud, hosted environment or enterprise computing environment are data centers with tens of thousands of servers, racks upon racks of networking equipment, and supporting critical infrastructure, from power distribution to thermal management. The scale, complexity and required optimization of these
DIY AI! Build your own AI with kits from Google

DIY AI! Build your own AI with kits from Google

Worried about the rise of the machines? Like doing things yourself? Now you can address both. Build your own AI with kits from Google. You can tell when something’s time has come. Hobbyists and tinkerers start doing it by themselves by cobbling together off-the-shelf parts.

CONTRIBUTORS

How To Be Data Compliant When Using The Cloud

How To Be Data Compliant When Using The Cloud

Data compliant Companies using the cloud for data storage, applications hosting or anything else, have to carefully consider data compliance ...
Cyber Criminals and the Business Insider

Cyber Criminals and the Business Insider

Cyber Crime Business Insider You’re on the morning train on the way to work and take a look at the ...
GDPR Compliance: A Network Perspective

GDPR Compliance: A Network Perspective

GDPR Compliance Regulations can be a tricky thing. For the most part, they’re well thought out in terms of mandating ...

RECENT NEWS

Pressure grows on Zuckerberg to attend Facebook committee hearing

Pressure grows on Zuckerberg to attend Facebook committee hearing

Australia, Argentina and Ireland join UK and Canada in urging Facebook CEO to give evidence to parliaments Parliamentary committees from ...
Amazon picks New York City, Virginia for $5 billion new headquarters

Amazon picks New York City, Virginia for $5 billion new headquarters

SAN FRANCISCO (Reuters) - Amazon.com Inc (AMZN.O) said on Tuesday it will build offices for up to 25,000 people in ...
Batteryless smart devices closer to reality

Batteryless smart devices closer to reality

Researchers at the University of Waterloo have taken a huge step towards making smart devices that do not use batteries ...
Alibaba's on-demand online services unit valued at $30 billion: sources

Alibaba’s on-demand online services unit valued at $30 billion: sources

HONG KONG (Reuters) - Alibaba Group’s newly formed on-demand online services unit has rocketed in value to as much as ...
Capgemini in Gartner Magic Quadrant

Capgemini in Gartner Magic Quadrant

Paris, November 9, 2018 – Capgemini, today announced that Capgemini (Prosodie) has been positioned as a Leader by Gartner in its ...
Hitoshi Kokumai

The ID Federation: What Technology Can Displace The Password?

The Future Password

Many people shout that the password is dead or should be killed dead. The password could be killed, however, only when there is an alternative to the password. Let us think about what technology can displace the password.

Some people might say that multi-factor authentications or ID federations will do it. It is not easy, however, to conceive that the password can be displaced by multi-factor schemes for which one of the factors is a password or ID federations which require a reliable password as the master-password.

Some might say “Not using any password altogether is the way to kill the password dead”. Yes, I have to admit, the password could then be killed dead entirely, but it would be criminals rather than us that will be the beneficiaries of such password-free cyber space. In a world where we live without remembered passwords, i.e., where our identity is established without our volitional participation, we would be able to have a safe sleep only when we are alone in a firmly locked room. It would be a Utopia for criminals and a Dystopia for most of us.

shutterstock_379201975

Some might say “PIN can”. This observation would, however, only lead us to the entrance to Alice’s Wonderland. If a PIN that is a weak form of numbers-only password could displace the password, a puppy should be able to displace the dog, a kitten the cat, a cub the lion.

Many are saying “Biometrics can”. This observation would lead us to another entrance to Alice’s Wonderland. Biometric solutions used in cyber space need a password (fallback password) registered in case of false rejection. If “something” which has to rely on“the other thing” could displace “the other thing”, your foot should be able to displace your leg for walking. Alice’s Wonderland might receive it, but I have huge difficulties in imagining what it could look like in this 4D Space-Time universe.

There are a lot of people who take it for granted that the password can be displaced by the biometrics operated in cyberspace together with a fallback password. How could such a misconception happen?

Blind Spot in Our Mind

Let us imagine that we are watching two models of smart phones – Model A with Pincode and Model B with Pincode and Fingerprint Scan. Which of the two models do you think is securer?

  • when you hear that Model A is protected by Pincode while Model B is protected by both Pincode and Fingerprints
  • when you hear that Model A can be unlocked by Pincode while Model B can be unlocked by both

Pincode and Fingerprints

  •  when you hear that Model A can be attacked only by Pincode while Model B can be attacked by both Pincode and Fingerprints

Is your observation the same for all the 3 situations?

Eye-Opening Experience

Now let us imagine that there are two houses – (1) with one entrance and (2) with two entrances placed in parallel. Which house is safer against burglars? Every one of us will agree that the answer is plainly (1). Nobody would dare to allege that (2) is safer because it is protected by two entrances. Similarly, the login by a Pincode/password alone is securer than the login by a biometric sensor backed up by a fallback Pincode/password.

Debates over Backdoor between Apple vs FBI

It appears that something crucial is overlooked in the heated debates about the backdoor on smartphones, which is the focus point of the recent events with Apple and the FBI that have drawn a lot of attention worldwide.

I would like to point out that there already exists a backdoor on many of the latest smartphones, namely, a fingerprint scanner or a set of camera and software for capturing faces, irises and other body features which are easily collected from the unyielding, sleeping, unconscious and dead people.

As the technologies of sensing biometric features advance, so do the technologies of copying and replaying them. None of body temperature, movement, pulse and brainwave can be exceptions. Biometrics could be great technologies for forensic and physical security, but far from valid for identity assurance in cyber space.

Suggestions

As analysed above, the authentication by biometrics in cyber space comes with poorer security than Pincode/password-only authentication in most cases. A false sense of security is often worse than the lack of security. I would like to put forward the suggestions below.

  • The vendors of those smart devices, who are conscious of privacy and security of consumers, could tell the consumers not to turn on the biometric functions.
  • Consumers, who are concerned about their privacy and security, could refrain from activating the biometric backdoors.
  • The deployment of biometric solutions could instead be recommended where consumers can accept “below-one” factor authentication in return for better convenience as the case may be.

By Hitoshi Kokumai

Hitoshi Kokumai

Hitoshi Kokumai, President, Mnemonic Security, Inc.

Hitoshi is the inventor of Expanded Password System that enables people to make use of episodic image memories for intuitive and secure identity authentication. He has kept raising the issue of wrong usage of biometrics with passwords and the false sense of security it brings for 16 years.

Mnemonic Security Inc. was founded in 2001 by Hitoshi Kokumai for promoting Expanded Password System. Following the pilotscale operations in Japan, it is seeking to set up the global headquarters.

View Website

Cloud Community Supporters

(ISC)²
Cisco
SAP
CA Technologies
Dropbox

Cloud community support comes from (paid) sponsorship or (no cost) collaborative network partnership initiatives.