Passwords have no future.\u00a0\u00a0\u00a0 I don’t know if it will be the government that forces it or private industry (like banks), but we’re past the point that using passwords and cookies for authentication is a reasonable method.<\/p>\n
There was a video on a local news site – it was not things I didn’t know, but made the point even clearer.\u00a0\u00a0 WiFi hot spots are now a trap to lose control of your accounts – especially in public places by airports.\u00a0\u00a0 A couple of my visitors recently had their email accounts taken over which I recognize when I get the “no subject” emails with someone’s entire address\u00a0book in the cc: trying to get me to visit a web site in Eastern Europe with a trojan downloader.<\/p>\n
The aspect they connected was that if you lose control of your Facebook account – because you aren’t using secure login, and Facebook says they don’t have the capacity to use encryption on everyone, if you’ve used those features “Link my facebook account to [something else],” you just gave access to all of your linked accounts as well.<\/p>\n
The next domino in the chain is the growth of the “Reset my password by sending me a reset message”\u00a0 (That’s what I use here).\u00a0\u00a0\u00a0 If a person has control of your primary email account, then they can run through all the likely accounts you have (linkedin, facebook twitter, yahoo, hotmail)\u00a0\u00a0and reset all your passwords and reset all your password recovery options.\u00a0\u00a0 Some of the smarter folks force a Security Question at that point “What was the name of your best friend as a child?”, but some of those are really not at all thought out well.\u00a0\u00a0\u00a0 Virtually every question they offer as an alternative is something my brother or sister would know (perhaps that’s the point in case I die so they can get control of my account without a court order?).\u00a0\u00a0 What was the address you grew up at, what school did you go to in 1st grade, what was your mother’s maiden name, what was the name of your dog, what was the name of your 1st grade teacher, etc….<\/p>\n
People with a serious need for tight security carry around SecurID cards with ever changing passcodes, but that authentication was broken a few months ago.\u00a0\u00a0\u00a0 With government “actors” (China in particular) working to breach security and millions of hands available to do brute force breakins, the way we tell the internet who we are and prove it is going to have to change.<\/p>\n
IPv6 was supposedly going to partly address that by making your device’s MAC ID visisble on the packets it sends (at least part of it).\u00a0 Hard drives these days also have a unique identifier that could be used as a method of positive identification if it is tightly enough controlled and not spoofable.\u00a0\u00a0 I don’t know.\u00a0 I don’t have the answers, but it feels like we’re going into a war wearing just loincloths.<\/p>\n","protected":false},"excerpt":{"rendered":"
Passwords have no future.\u00a0\u00a0\u00a0 I don’t know if it will be the government that forces it or private industry (like banks), but we’re past the point that using passwords and cookies for authentication is a reasonable method. There was a … Continue reading