Daily Bulletin


The Conversation

  • Written by The Conversation
imageHow secure are your passwords?Flickr/Krynowek Eine , CC BY-NC-ND

We all need some kind of authentication process if we are to access information systems at work or at home. We know why we need to do it: to make sure we have access to our data and unauthorised people don’t.

So why do we routinely ignore such advice, particularly given the constant advice from cyber security professionals about the need for strong passwords that are changed frequently? It seems there is a significant disparity about what we do and what we want: is it security or is it usability?

Most authentication we encounter today is typically implemented in one (or more) of three ways:

  • Something you know (such as the humble password)
  • Something you have (a smart card)
  • Something you are (a fingerprint).

Many systems use a username/password pair for access control, largely because the interfaces to most systems have typically been some sort of keyboard. Some smart phones use a PIN or fingerprint and bank ATMs use a combination of something you have (a card) and something you know (a PIN).

The trouble with passwords

Having a long random password is good advice. It provides a measure of security for guarding access to important information, such as your online banking account.

Unfortunately, when faced with having to remember several random fifteen character passwords (characters being A to Z, a to z, 0 to 9 and an assortment of other printable characters such as ! @ # $ and %), most users apply a judgement to the value of the information protected by the password and act accordingly.

Some accounts may have a relatively weak password, because of the cost of undue information leakage or harm to the owner if the account is compromised. Other accounts might have a stronger password, because users don’t want their money siphoned off by a cyber-criminal. These are judgements about the perceived value of the information.

How safe is your password?

If you must use a password, what makes a good one? How fast can a password be cracked?

There are several web sites that publish lists of common passwords. I have used a list of 14 million passwords as a test with a local science discovery centre in Perth.

Attendees at the centre (mostly high school students) were asked to enter what they thought was a secure password and this was checked against the list. If not found on the list (a rare occurence), the password was sent to a fast computer for further processing.

This computer could crack a random six character password in under two seconds, using a brute-force attack by trying to match “aaaaaa”, then “aaaaab”, then “aaaaac” and so on through all combination of six characters.

It was surprising how little the fast computer had to do. Many users assume that words or phrases taken from well-established literature are somehow secure. They are not (forget anything from Lord of the Rings or War and Peace).

A longer password takes longer to crack. A random 15-character password might take a week, but then the argument comes back to the time value of information. If a cyber-criminal has to wait a week, your account will still be there and will you change your random 15-character password every week?

One way to add an extra level of security to your password is to enable any two-step authentication, whereby another code is sent to a device, such as your mobile phone, after a password is entered. Plenty of online services already offer this service.

We need some other authentication

If the humble password is not suitable due to usability issues, then there are alternatives such as the popular pay wave contactless payment system for bank cards and travel cards, with no password required for small transactions.

The risk is that if your wallet or purse is stolen, small amounts can be siphoned from your account before it is blocked. Nonetheless, tapping a card is proving to be popular with consumers and with retailers, so convenience wins over security.

Biometric methods, based on some physical property of the human body, are attractive because a person doesn’t need to remember a password or carry a card. Smartphones and computer operating systems already use fingerprint scanners to provide a simple and effective means of authentication.

Other biometric devices in use include retinal scanners, iris scanners and voice recognition. Despite what is seen in popular movies, no-one likes having a laser shined into their eyes, so voice recognition might be the way forward.

But there are known issues with biometric technology. But those issues are the same for any authentication system. Current error rates for single-fingerprint devices are approximately 2% at best – not good enough to be used on their own yet.

Some systems don’t rely on matching the actual fingerprint, but match other behavioural properties of a user. For example, the angle and velocity of fingerprint scanning, which are properties that are different for each person, are measurable and repeatable. This defeats a physical attack such as removing a person’s finger in an effort to impersonate someone.

Returning to the ATM example: for now, we are bound to cards and PINs due to their low maintenance and production costs. From a customer’s point of view, it would be simpler to speak to an ATM and ask it for cash, once your voice print linked to your account has been confirmed. This is a much more user friendly (and safer) future.

Ultimately, until more robust security alternatives are widely accepted (and implementable at low cost), those who continue to ignore the advice on passwords much seriously ask what balance of security and usability they prefer, and what price they’re prepared to pay for weak security?

Mike Johnstone receives funding from the European Union’s Seventh Framework Programme for research, technological developmentand demonstration under grant agreement no: 611659

Authors: The Conversation

Read more http://theconversation.com/security-vs-usability-thats-the-choice-we-make-with-passwords-46627

Writers Wanted

Why some people find it easier to stick to new habits they formed during lockdown

arrow_forward

Why is it worth playing at an online casino?

arrow_forward

What is Self-Education? + 4 Ways to Improve Yourself

arrow_forward

The Conversation
INTERWEBS DIGITAL AGENCY

Politics

Prime Minister Interview with Kieran Gilbert, Sky News

KIERAN GILBERT: Kieran Gilbert here with you and the Prime Minister joins me. Prime Minister, thanks so much for your time.  PRIME MINISTER: G'day Kieran.  GILBERT: An assumption a vaccine is ...

Daily Bulletin - avatar Daily Bulletin

Did BLM Really Change the US Police Work?

The Black Lives Matter (BLM) movement has proven that the power of the state rests in the hands of the people it governs. Following the death of 46-year-old black American George Floyd in a case of ...

a Guest Writer - avatar a Guest Writer

Scott Morrison: the right man at the right time

Australia is not at war with another nation or ideology in August 2020 but the nation is in conflict. There are serious threats from China and there are many challenges flowing from the pandemic tha...

Greg Rogers - avatar Greg Rogers

Business News

Cybersecurity data means nothing to business leaders without context

Top business leaders are starting to realise the widespread impact a cyberattack can have on a business. Unfortunately, according to a study by Forrester Consulting commissioned by Tenable, some...

Scott McKinnel, ANZ Country Manager, Tenable - avatar Scott McKinnel, ANZ Country Manager, Tenable

InteliCare triple winner at prestigious national technology awards

InteliCare triple winner at prestigious national technology awards Intelicare wins each nominated category and takes out overall category at national technology 2020 iAwards. Company wins overal...

Media Release - avatar Media Release

Arriba Group Founder, Marcella Romero, wins CEO Magazine’s Managing Director of the Year

Founder and Managing Director of the Arriba Group, Marcella Romero, has won Managing Director of the Year at last night’s The CEO Magazine’s Executive of the Year Awards. The CEO Magazine's Ex...

Lanham Media - avatar Lanham Media



News Co Media Group

Content & Technology Connecting Global Audiences

More Information - Less Opinion