Part 2 - Identity Assurance by Our Own Volition and Memory

Part 2 – Identity Assurance by Our Own Volition and Memory

Identity Assurance We believe that the reliable identity assurance (See part 1) must be built on three prerequisite principles as follows. Volition of the User – with Self-Determination, Identity authentication with no confirmation of the user’s volition would lead to a world where criminals and
Impact of AI and 5G on the Possibilities of Data

Impact of AI and 5G on the Possibilities of Data

Impact of AI and 5G This blog post was made in collaboration with Intel. A smarter world is now a possibility that is starting to sound real. Data sits at the center of this change, and data can be referred to as the oil that

The Future Password

Many people shout that the password is dead or should be killed dead. The password could be killed, however, only when there is an alternative to the password. Let us think about what technology can displace the password.

Some people might say that multi-factor authentications or ID federations will do it. It is not easy, however, to conceive that the password can be displaced by multi-factor schemes for which one of the factors is a password or ID federations which require a reliable password as the master-password.

Some might say “Not using any password altogether is the way to kill the password dead”. Yes, I have to admit, the password could then be killed dead entirely, but it would be criminals rather than us that will be the beneficiaries of such password-free cyber space. In a world where we live without remembered passwords, i.e., where our identity is established without our volitional participation, we would be able to have a safe sleep only when we are alone in a firmly locked room. It would be a Utopia for criminals and a Dystopia for most of us.

Some might say “PIN can”. This observation would, however, only lead us to the entrance to Alice’s Wonderland. If a PIN that is a weak form of numbers-only password could displace the password, a puppy should be able to displace the dog, a kitten the cat, a cub the lion.

Many are saying “Biometrics can”. This observation would lead us to another entrance to Alice’s Wonderland. Biometric solutions used in cyber space need a password (fallback password) registered in case of false rejection. If “something” which has to rely on“the other thing” could displace “the other thing”, your foot should be able to displace your leg for walking. Alice’s Wonderland might receive it, but I have huge difficulties in imagining what it could look like in this 4D Space-Time universe.

There are a lot of people who take it for granted that the password can be displaced by the biometrics operated in cyberspace together with a fallback password. How could such a misconception happen?

Blind Spot in Our Mind

Let us imagine that we are watching two models of smart phones – Model A with Pincode and Model B with Pincode and Fingerprint Scan. Which of the two models do you think is securer?

  • when you hear that Model A is protected by Pincode while Model B is protected by both Pincode and Fingerprints
  • when you hear that Model A can be unlocked by Pincode while Model B can be unlocked by both

Pincode and Fingerprints

  •  when you hear that Model A can be attacked only by Pincode while Model B can be attacked by both Pincode and Fingerprints

Is your observation the same for all the 3 situations?

Eye-Opening Experience

Now let us imagine that there are two houses – (1) with one entrance and (2) with two entrances placed in parallel. Which house is safer against burglars? Every one of us will agree that the answer is plainly (1). Nobody would dare to allege that (2) is safer because it is protected by two entrances. Similarly, the login by a Pincode/password alone is securer than the login by a biometric sensor backed up by a fallback Pincode/password.

Debates over Backdoor between Apple vs FBI

It appears that something crucial is overlooked in the heated debates about the backdoor on smartphones, which is the focus point of the recent events with Apple and the FBI that have drawn a lot of attention worldwide.

I would like to point out that there already exists a backdoor on many of the latest smartphones, namely, a fingerprint scanner or a set of camera and software for capturing faces, irises and other body features which are easily collected from the unyielding, sleeping, unconscious and dead people.

As the technologies of sensing biometric features advance, so do the technologies of copying and replaying them. None of body temperature, movement, pulse and brainwave can be exceptions. Biometrics could be great technologies for forensic and physical security, but far from valid for identity assurance in cyber space.

Suggestions

As analysed above, the authentication by biometrics in cyber space comes with poorer security than Pincode/password-only authentication in most cases. A false sense of security is often worse than the lack of security. I would like to put forward the suggestions below.

  • The vendors of those smart devices, who are conscious of privacy and security of consumers, could tell the consumers not to turn on the biometric functions.
  • Consumers, who are concerned about their privacy and security, could refrain from activating the biometric backdoors.
  • The deployment of biometric solutions could instead be recommended where consumers can accept “below-one” factor authentication in return for better convenience as the case may be.

By Hitoshi Kokumai

Hitoshi Kokumai

Hitoshi Kokumai, President, Mnemonic Security, Inc.

Hitoshi is the inventor of Expanded Password System that enables people to make use of episodic image memories for intuitive and secure identity authentication. He has kept raising the issue of wrong usage of biometrics with passwords and the false sense of security it brings for 16 years.

Mnemonic Security Inc. was founded in 2001 by Hitoshi Kokumai for promoting Expanded Password System. Following the pilotscale operations in Japan, it is seeking to set up the global headquarters.

View Website

TOP ARCHIVES

Chris

How to Avoid Becoming Another Cloud Security Statistic

Cloud Security Statistic Last year, Gartner predicted that, by 2020, 95 percent of all cloud security failures will be caused ...
ERP Ain’t Got the Same Soul, I Like that Old Time Rock ‘n’ Roll

ERP Ain’t Got the Same Soul, I Like that Old Time Rock ‘n’ Roll

Designing Enterprise Software around People Looking back, business owners talked to their customers and employees in person or by phone ...
The Challenges to Tackle Before You Start With AI

The Challenges to Tackle Before You Start With AI

Artificial Intelligence and the technology behind it are growing at a furious pace. Marketers have realized its vast potential and ...
How to Improve the Backup Success Rate of Data Centers?

How to Improve the Backup Success Rate of Data Centers?

Improve Backup Success Rate According to industry analysts, a significant number of backup jobs (from 5 to 25%) are failing ...
Part 2 - Identity Assurance by Our Own Volition and Memory

Part 2 – Identity Assurance by Our Own Volition and Memory

Identity Assurance We believe that the reliable identity assurance (See part 1) must be built on three prerequisite principles as ...
Load Testing Tools

Load Testing Tools

LOAD TESTING TOOLS SMARTBEAR LoadComplete is software that simulates users and creates realistic load tests. No coding is required. Users can generate traffic via the cloud, virtual machines, and also use on premise computers for load testing. Location-based profiles are ...
Business Analytics Vs Data Science

Business Analytics Vs Data Science

Big Data Continues To Grow Big Data continues to be a much discussed topic of interest and for good reason.  According to a recent report from International Data Corporation (IDC), "worldwide revenues for big data and business analytics will grow ...
Cloud Migration – 10 ‘Do it Right’ Tips

Cloud Migration – 10 ‘Do it Right’ Tips

Cloud Migration Tips Businesses continue to adopt the cloud at break neck speed. Inherent benefits like lower operational costs, no infrastructure overheads, and quick access to better technology make cloud a very attractive proposition for businesses, especially start-ups and SMEs ...