The ID Federation: What Technology Can Displace The Password?

The Future Password

Many people shout that the password is dead or should be killed dead. The password could be killed, however, only when there is an alternative to the password. Let us think about what technology can displace the password.

Some people might say that multi-factor authentications or ID federations will do it. It is not easy, however, to conceive that the password can be displaced by multi-factor schemes for which one of the factors is a password or ID federations which require a reliable password as the master-password.

Some might say “Not using any password altogether is the way to kill the password dead”. Yes, I have to admit, the password could then be killed dead entirely, but it would be criminals rather than us that will be the beneficiaries of such password-free cyber space. In a world where we live without remembered passwords, i.e., where our identity is established without our volitional participation, we would be able to have a safe sleep only when we are alone in a firmly locked room. It would be a Utopia for criminals and a Dystopia for most of us.

Some might say “PIN can”. This observation would, however, only lead us to the entrance to Alice’s Wonderland. If a PIN that is a weak form of numbers-only password could displace the password, a puppy should be able to displace the dog, a kitten the cat, a cub the lion.

Many are saying “Biometrics can”. This observation would lead us to another entrance to Alice’s Wonderland. Biometric solutions used in cyber space need a password (fallback password) registered in case of false rejection. If “something” which has to rely on“the other thing” could displace “the other thing”, your foot should be able to displace your leg for walking. Alice’s Wonderland might receive it, but I have huge difficulties in imagining what it could look like in this 4D Space-Time universe.

There are a lot of people who take it for granted that the password can be displaced by the biometrics operated in cyberspace together with a fallback password. How could such a misconception happen?

Blind Spot in Our Mind

Let us imagine that we are watching two models of smart phones – Model A with Pincode and Model B with Pincode and Fingerprint Scan. Which of the two models do you think is securer?

  • when you hear that Model A is protected by Pincode while Model B is protected by both Pincode and Fingerprints
  • when you hear that Model A can be unlocked by Pincode while Model B can be unlocked by both

Pincode and Fingerprints

  •  when you hear that Model A can be attacked only by Pincode while Model B can be attacked by both Pincode and Fingerprints

Is your observation the same for all the 3 situations?

Eye-Opening Experience

Now let us imagine that there are two houses – (1) with one entrance and (2) with two entrances placed in parallel. Which house is safer against burglars? Every one of us will agree that the answer is plainly (1). Nobody would dare to allege that (2) is safer because it is protected by two entrances. Similarly, the login by a Pincode/password alone is securer than the login by a biometric sensor backed up by a fallback Pincode/password.

Debates over Backdoor between Apple vs FBI

It appears that something crucial is overlooked in the heated debates about the backdoor on smartphones, which is the focus point of the recent events with Apple and the FBI that have drawn a lot of attention worldwide.

I would like to point out that there already exists a backdoor on many of the latest smartphones, namely, a fingerprint scanner or a set of camera and software for capturing faces, irises and other body features which are easily collected from the unyielding, sleeping, unconscious and dead people.

As the technologies of sensing biometric features advance, so do the technologies of copying and replaying them. None of body temperature, movement, pulse and brainwave can be exceptions. Biometrics could be great technologies for forensic and physical security, but far from valid for identity assurance in cyber space.

Suggestions

As analysed above, the authentication by biometrics in cyber space comes with poorer security than Pincode/password-only authentication in most cases. A false sense of security is often worse than the lack of security. I would like to put forward the suggestions below.

  • The vendors of those smart devices, who are conscious of privacy and security of consumers, could tell the consumers not to turn on the biometric functions.
  • Consumers, who are concerned about their privacy and security, could refrain from activating the biometric backdoors.
  • The deployment of biometric solutions could instead be recommended where consumers can accept “below-one” factor authentication in return for better convenience as the case may be.

By Hitoshi Kokumai

EV Sales

Growth of Electric Vehicles – Heading In The Right Direction

Growth of Electric Vehicles The global electric vehicle market is projected to reach $802.81 billion by 2027, registering a CAGR of 22.6%.1 The highest revenue contributor was Asia-Pacific, which is estimated to reach $357.81 billion ...
Building a Robust Virtual Agent (VA) Rollout Strategy for DSPs

Building a Robust Virtual Agent (VA) Rollout Strategy for DSPs

Building a Robust Virtual Agent (VA) Rollout Strategy for DSPs Proven methods to increase VA containment & customer satisfaction The virtual agent’s market is at an all-time high and is garnering more and more interest ...
Scott Leatherman

Beware the Perils of Blind Cloud Provisioning

The COVID-19 Rush to the Cloud Results in Steep Costs and Chaos For many companies, their data center capacity was not built for the instant tsunami-sized jolt of increased load caused by the global pandemic ...
Miha Kralj

SaaS Native – Design, Delivery and Management of Applications

Going cloud native, the right way Moving from a traditional IT organization to one that’s cloud native is an inevitability for all businesses. This is because all real software innovation is now cloud-first or cloud-only, ...
Patrick Joggerst

Why Platforms Matter as UCaaS Adoption Continues to Soar

UCaaS Adoption Continues to Soar Industry analysts agree – the unified communications-as-a-Service (UCaaS) market will continue to grow by leaps and bounds in 2020 and beyond. Mordor Intelligence, for example, predicts a compound aggregated growth ...
Data Web Accessibility

Protecting Yourself from the Rise in Ransomware this Holiday Season

Rise in Ransomware The Baltimore Public Schools system was already dealing with pandemic learning conditions when it was hit by a ransomware attack the day before Thanksgiving. School officials were calling it a "catastrophic attack ...