For your eyes only: New twist on Digital ID
could keep you from getting hacked
Summary: Online verification involving visual
preferences may prevent your accounts from being penetrated by hackers.
This week, the
security methods used by Apple and other cloud-based software and service
providers such as Google and Amazon are under intense scrutiny.
A writer for Wired,
Mat Honan, had many of his online accounts compromised and his data destroyed on his cloud-connected
Mac, iPhone and iPad after
hackers fooled Apple support representatives into re-setting the password on
his iCloud account which then alllowed them to gain access to other linked
social media accounts.
The hackers then
defaced Honan's as well as Gizmodo's Twitter accounts in the process with
embarassing racial and homophobic epithets.
The sordid tale on Wired that Honan tells of his unfortunate
experience is a painful one. It is in essence a perfect storm caused by simple
human mistakes regarding password security which were exploited by social
engineering techniques used by the hackers to eventually compromise his Apple
ID account and other linked accounts via weak password reset mechanisms at the
cloud providers themselves.
With so many
individuals with multiple accounts on so many linked cloud services, it is
inevitable that this sort of cybercrime is going to become more commonplace
unless new mechanisms are put into place to prevent this form of compromise
that Honan experienced.
One way of dealing with this would be to employ biometrics on all computing devices. I wrote about this at
length in February 2011, which eventually led to an appearance on CBC
Radioalongside prominent independent security researcher Dr. Markus Jakobsson.
I spoke with Dr.
Jakobsson this week regarding the situation experienced by Honan and he is in
agreement with me that biometrics combined with brute-force resistant and
difficult to guess passwords (but which are still easy to remember) are still
probably the best solution to secure one's online identity.
Among his many publications in the discipline
of computer security, Jakobsson has done substantial
research in creating algorithms that can determine the probabilty of how easy
it is for a password to be guessed or re-set based on basic knowledge about an
individual's background and commonly used words, and these methods could be
employed by cloud providers almost immediately to help users improve the
streghth of their passwords.
But getting biometrics
such as fingerprint readers integrated into computing devices is going to take
some time.
Apple has already taken steps to integrate such technology into
future generations of its Macs, iPhones and iPads by its recent purchase of
Authentec. However, it could take a few years
before the Cupertino-based consumer electronics and personal computer company
gets this technology into the mainstream.
In the interim, Jakobsson has proposed an alternative type of
biometrics he refers to as "Visual
Preferences".
For lack of a better term I am using the phrase "Mental
Biometrics" or "Psychometrics." Whatever it ends up being
called, an imprint or a snapshot of a user's personality is taken using a uniquemnemonic which
is then challenged via an authentication mechanism that uses pictures.
These pictures would be easy for the user to remember, but
extremely difficult for a hacker to challenge. During the enrollment process,
the user is given a long list of pictures of various objects and activities,
and then chooses a series of those which they then have to remember based on
what they actually like or dislike.
So for example as in
the above illustration, one might like Goldfish, Guitars, Karate but dislike
Professional Wrestling. That would be easy for that individual to remember but
nearly impossible for a random hacker to know, even based on publically
avaliable information.
Jakobsson notes that while it would be easier for a spouse or
possibly a close family member, friend or a co-worker to know some of
these things, they would not be able to deduce all of
them. Thus the mechanism is extremely secure.
During the challenge
process using this type of mechanism (such as a password reset for iCloud that
Honan's hacker encountered) they would be shown a list of pictures, including a
lot of ones that the user did not pick, which they would then have to pick from.
Only the user that
remembered this particular sequence of pictures during the enrollment process
could reset the account. Because these pictures are easy to remember and are
unique to the individual's personal preferences, it makes it both measurable (like
a biometric) and difficult to crack.
Jakobsson has told me
that this form of authentication is already in use with a major healthcare
provider and will be rolled out to a well-known e-commerce infrastructure
provider in the near future. So it is entirely plausible that services such as
Twitter, Facebook and also other e-commerce/Cloud providers such as Apple,
Google and Amazon may follow suit.
Comments
Post a Comment