Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google security exec: 'Passwords are dead'

news.cnet.com

Post reply on HN
Print view View original

41–50 of 54 posts

Re: Google security exec: 'Passwords are dead'

#41

Post by marmot1101 »

devx wrote: post #15

NFC rings for everyone! An NFC Internet-less ring with open source firmware would mean it should be quite protected against NSA backdoors, too. http://www.kickstarter.com/projects/mclear/nfc-ring http://www.technologyreview.com/news/512051/google-wants-to-...

The problem with a hardware token security is that it relies on every user having one or not leveraging the security. That's something that can be difficult for an IT department to coordinate across an organization, thus would be herculean for a Google scale company to legislate across its user base.

Re: Google security exec: 'Passwords are dead'

#42

Post by stephenhuey »

sehrope wrote: post #19

Passwords are not dead. Simple single factor authentication using short passwords is dead. That's not a new thing either and they're not going away either. Biometric implants are cool but it's a long ways away ( and I'm pretty sure I don't want anything inserted into my arm... ). Ditto for security rings and other gadgets. Yes they work but the general populace is not going to be using them for a long while. I'd love…

In light of Apple's announcement yesterday about Touch ID, a way to unlock the new iPhone with your fingerprint, I was hoping to hear someone weigh in on how safe it is compared to a passcode. I'd love to simply use my fingerprint as long as it meets HIPAA requirements for protecting sensitive emails and other data on my phone, but this Forbes article is suggesting the risk of spoofing fingerprints is still too great:

http://www.forbes.com/sites/andygreenberg/2013/09/10/apples-...

Re: Google security exec: 'Passwords are dead'

#43

Post by lifeisstillgood »

jerf wrote: post #18

Something you know, something you have, something you are. Google may be trying to prefer something you have, but that's hardly going to kill "something you know" forever and ever. I also look forward to the silly "two-factor authentication" that involves having two "something you have"s. It'll complement my bank's silly use of two "something you know"s nicely. (Perhaps they can get together for the true security ult…

> Something you know, something you have, something you are.

Excellent point - and oddly reflects a subtle point: Something you are (bio-id) is what we are asserting, and using one or both of the others to give the far point a guage of how likely fraud is.

In short:

* Something you are -> Username * Something you know -> Password * Something you have -> RSA fob

Re: Google security exec: 'Passwords are dead'

#44

Post by msg »

stephenhuey wrote: post #42
sehrope wrote: post #19

Passwords are not dead. Simple single factor authentication using short passwords is dead. That's not a new thing either and they're not going away either. Biometric implants are cool but it's a long ways away ( and I'm pretty sure I don't want anything inserted into my arm... ). Ditto for security rings and other gadgets. Yes they work but the general populace is not going to be using them for a long while. I'd love…

In light of Apple's announcement yesterday about Touch ID, a way to unlock the new iPhone with your fingerprint, I was hoping to hear someone weigh in on how safe it is compared to a passcode. I'd love to simply use my fingerprint as long as it meets HIPAA requirements for protecting sensitive emails and other data on my phone, but this Forbes article is suggesting the risk of spoofing fingerprints is still too great…

If your fingerprints go on a fraud list, you can't get new ones.

You can't repudiate your fingerprints.

Similar, worse problems for iris and DNA.

Imagine being on a watch list that you can't get off of.

This is not a good road to go down.

Re: Google security exec: 'Passwords are dead'

#45

Post by lifeisstillgood »

This is not about passwords per se - its about identity verification providers (as-a-service).

There is a fight coming. A few global providers will have the single-sign-on password/biometric/blah of everyone (the UK government is starting to mandate the use of seven such providers.)

This is big not just because of the commercial advantages of being the sign-in point of 1 billion people. But because right now my major identity verifier is my own government (passports, NHS number, Social Security, arrest record etc). But it will not be in 20 years - I expect I will visit the hospital and need to verify who I am through GoogleID.

The thing is. I expect GoogleID will be a heavily regulated industry by then too.

Re: Google security exec: 'Passwords are dead'

#47

Post by maxerickson »

Vivtek wrote: post #31
sehrope wrote: post #19

Passwords are not dead. Simple single factor authentication using short passwords is dead. That's not a new thing either and they're not going away either. Biometric implants are cool but it's a long ways away ( and I'm pretty sure I don't want anything inserted into my arm... ). Ditto for security rings and other gadgets. Yes they work but the general populace is not going to be using them for a long while. I'd love…

I'll go one further on your first paragraph: I'm pretty sure I don't want something implanted in my arm that lets Google identify me . Passwords may have insecurity - but they also permit anonymity. I think people haven't even started thinking that far yet.

Face detection has many of the same issues and there isn't much you can do about it.

Re: Google security exec: 'Passwords are dead'

#48

Post by 6d0debc071 »

flanbiscuit wrote: post #34
sehrope wrote: post #28

Earlier quoted context omitted.

Yes even over SSL connections. You don't know if the other person's computer itself is compromised (e.g. key logger). Rather then instruct a not-so-tech-savvy person to make the decision of whether computer X is trustworthy the defacto default is "No it's not, don't use it". In practice this doesn't really limit folks too much as how often do you really need to login from somebody else's computer? Can it seriously no…

my bank tracks my IP and notices when I'm logging in from somewhere new and asks me security questions or sends my phone a code like Google's dounle-auth (which I use). And then it asks me if I want to remember the computer I'm on. I've been interested in a password manager but haven't tried them. Do my passwords get stored "in the cloud" or is it a local desktop/mobile app? If it's a local desktop app, can I copy my…

> I've been interested in a password manager but haven't tried them. Do my passwords get stored "in the cloud" or is it a local desktop/mobile app? If it's a local desktop app, can I copy my password DB to another computer I trust like say my work computer?

It depends what you use. LastPass will stick them in the cloud if that's what you want.

Re: Google security exec: 'Passwords are dead'

#49

Post by Vivtek »

maxerickson wrote: post #47
Vivtek wrote: post #31

Earlier quoted context omitted.

I'll go one further on your first paragraph: I'm pretty sure I don't want something implanted in my arm that lets Google identify me . Passwords may have insecurity - but they also permit anonymity. I think people haven't even started thinking that far yet.

Face detection has many of the same issues and there isn't much you can do about it.

True enough - but I don't have to make it rigorous with an RFID chip, do I?

Re: Google security exec: 'Passwords are dead'

#50

Post by guard-of-terra »

jebblue wrote: post #27
guard-of-terra wrote: post #5

Passwords are long overdue, it's a walking carcass. Hard for users to remember, trivial to intercept, easy to lose, not hard to guess.

There are tricks you can use to remember a strong password. As far as "trivial to intercept, easy to lose, not hard to guess", the point is mute over the network as long as the target system uses something like iptables rate limiting or MaxAuthRetries and LoginGraceTime in SSH. If it's a local resource only then all an attacker needs is time and computing resources, but, that's true for key based authentication too.

I can't use "tricks" to remember 50 passwords, my head will asplode.
Post reply on HN