[Cryptography] Passwords: Perfect, except for being Flawed

[Jerry Leichter]

On Feb 17, 2015, at 4:42 PM, Kent Borg <kentborg at borg.org> wrote:
> Passwords are a fundamentally good system, but for their cumbersome details. All the alternatives are worse, and I think for rather fundamental reasons.
I basically agree.  The attacks we see on passwords are all based on a combination of bad and weakly protected implementations (which store password-equivalents on the server - hashing was intended to keep what the server stores from being equivalent to a password, but bad security that allows those stores to leak, combined with ever-faster offline password testing systems, have killed that idea), and on bad user practices (reuse of passwords).  There are technical fixes to the former (SRP et al).  The latter become somewhat less of an issue if the former is resolved, but beyond stopping the dumb practice of telling people to *never* write down their passwords, requires some more work to help on the human side.

I'm not sure that all the alternatives are worse.  We're starting to see alternatives that are actually workable in at least some situations.  The first is two-factor systems - enabled by the near-universal presence of phones that can receive texts.  (Keyfob solutions are workable in specialized situations, but are unlikely to be really broadly acceptable.)

The second has its beginnings in Apple Pay.  For years, we rejected biometrics with all kinds of snide remarks about not being able to change your fingerprints if they were stolen, the ease of faking fingerprints, the fact that no matter where you got the biometric data, once it was on the net, it was just bits that could be copied.  But we missed the fundamental insight:  If you combine a fingerprint - something you *are* - with a phone that has local intelligence and secure hardware that can store some secrets for you - something you *have* - you can construct an inherently two-factor system that can be quite secure.  Using "tokenization" (a horrible term) means that nothing password- or biometric-equivalent ever leaves the phone.  The intelligence in the phone, combined with the fact that it's *yours* - unlike a fob that belongs to one bank - means that supporting multiple ID's for multiple mutually-suspicious organizations is straightforward.

The password is great because you don't have to bring anything along with you to use it.  Most proposals to replace it foundered on the problem of getting people to carry some additional piece of hardware - other than biometrics, which if not done locally, on your own device, founders on other issues.  If everyone can be assumed to have a smartphone ... the whole world changes.  (And, yes, for the solution to be Apple Pay, it has to be not just a smartphone but an iPhone.  Unless Apple decides to allow other phone or gadget makers to use Apple Pay, something else will have to be developed.  But the *basic idea* can work.)
                                                        -- Jerry