Google tackles password security problem
Written by John P Mello Jr on January 23, 2013
Password critics can sometimes sound like the proverbial grouser who would rather curse the darkness than light a candle. Google, however, doesn’t fit in that category.
The Search Behemoth made headlines in recent days with what one news outlet called a “war on the password“. That declaration of war is embodied in a paper prepared by Google’s security team and scheduled to run in IEEE Security & Privacy Magazine this month.
According to Wired Magazine, which obtained a pre-publication copy of the article, Google Vice Presidents of Security, Eric Grosse and Engineer Mayank Upadhyay, declare that passwords and cookies are no longer adequate to protect the Internet’s citizenry. Alternatives to the password must be found, the two proclaim.
One alternative they cite is the Yubico cryptographic card. The card slips in the card reader found on most computers and acts as a “token” to identify a person’s identity.
When you insert the Yubico device into a card slot, it asks you for a PIN. Once activated with the PIN, the card will supply login information to your favorite websites, eliminating the need to remember passwords and login names.
It also removes password vulnerabilities. Stealing passwords from a website doesn’t do a hacker any good because a password won’t work without the Yubico key.
In order for Google’s scheme to work, it’s going to need broad acceptance. That could be a substantial problem, but not one that Google hasn’t considered. It’s working on a protocol for device-authentication that would be independent of Google, require only browser support to work and could not be used by websites to track users.
Tokens need not be limited to the Yubico key. They could include rings that support NFC, allowing you to tap the side of a keyboard or tablet when you want to login to a website, or SIM cards for smartphones.
Needless to say, Yubico is excited about the prospect of being a key player in the future of Internet authentication.
“Imagine that you have one single key and one single password to securely access all your Internet life,” writes Stina Ehrensvard in the company’s YubiBlog.
“The key would not be issued, controlled or hosted by a government or a service provider,” she continues. “Instead, you would buy this key at your retail store, such as 7-Eleven or Amazon.com, similar to a gift card or pre-paid phone card.”
She explains the key would allow you to connect to online services from any computer or mobile device by inserting it into a USB port or, if the device is NFC enabled, by touching the card to the device, and eliminate the need to remember scores of passwords.
The key coupled with Google’s protocol could solve some of the fundamental problems with authenticating identity on the Web, Ehrensvard maintained.
“And these are problems we need to fix soon,” she added. “Very soon. Or billions of people, along with the great creation named the Internet, will be in serious trouble.”
Ehrensvard concedes that there are some major hurdles to the implementation of Google’s grand scheme. They include aligning influential thought leaders and global stakeholders.
They also include consumers themselves. For as much as consumers complain about remembering passwords, they may be inclined to stick with the devil they know than embrace one they don’t. Remembering passwords may be annoying, but how much more annoying might be losing a key to one’s Internet life?
Posted in Email Security, Security | 3 Comments »
January 31st, 2013 at 12:50 am
I am just an ordinary Gmail user, so to read something like this raises two things in my mind. One, is the problem really that serious? I mean all these spam threats and phishing? Quite frankly, I think Google is doing a very good job when it comes to filtering, but I know that I cannot speak on behalf of the rest of the Gmail users. The second point is it sounds kind of complicated. Even if the intention is good, if it’s that hard to understand, I don’t think a lot of people would be tempted to use it, if ever it gets materialized.
January 31st, 2013 at 2:06 pm
And I thought Google is doing well when it comes to securing accounts, though I have to say that mine was hacked once, and it sent mass e-mails to all my contacts. It was such a nightmare since I had to communicate to all my clients back then. But anyway, I’m quite satisfied with the 2-step Google authentication process. It’s a hassle, yes, but it also deters, I hope, phishers from opening my account. Nevertheless, this new suggestions intrigued me, and I can’t wait to use them if ever they come out. But is 7-11 safe or secure?
February 1st, 2013 at 8:56 pm
The problem with passwords is really severe – we all know they are not a secure way to protect data but it’s the best we have. This isn’t the first attempt to substitute passwords with other forms of authentication but the problem always has been that the proposed solutions introduce a new level of complexity, though they do increase security. For instance, one-time passwords were just great in theory but kind of cumbersome to use in practice. The cube isn’t much better than OTP in terms of ease of use and I believe it can also be hacked but we do need to find a way to replace passwords – they are so insecure!