Google sees one password ring to rule them all
Google researchers have proposed a USB key, or even a finger ring, to solve the problems with website passwords
IDG News Service - Google thinks it might have found an answer to the vexing problem of forgotten or weak passwords: "physical" passwords, which might come in the form of a piece of jewelry such as a ring.
In a research paper, two of its engineers write that current strategies to prevent the hijacking of online accounts, including the two-step identity verification system, are insufficient, partly due to the constant threat of attacks that exploit new bugs.
Google highlights phishing, in which hackers dupe account holders into revealing sensitive information by making them sign into a fake account login page, as one of the biggest security threats of today.
"It's time to give up on elaborate password rules and look for something better," the authors say. The research paper, by Google's Eric Grosse and Mayank Upadhyay, is to be published Jan. 28 in the publication IEEE Security & Privacy. It was first reported on by Wired earlier Friday.
At the core of Google's proposal is an idea it says has been used by businesses but has found little success among consumers: an encrypted USB-like device that people would use to log into password-protected websites and online accounts.
Google says it is working on an internal pilot with an experimental USB device that users first register with multiple websites where they have accounts. A compliant browser would make two new APIs (application programming interfaces) available to the website to be passed down to the attached device.
"One of these APIs is called during the registration step, causing the hardware to generate a new public-private key pair and send the public key back to the website," the paper explains. "The website calls the second API during authentication to deliver a challenge to the hardware and return the signed response."
The method wouldn't require any software to be installed, though users would need to be using a Web browser that's compliant with the effort, Google said. The registration and authentication protocols would be open and free, and the device would connect with a computer's USB without needing any special OS device drivers.
Basically, the Googlers envision a single device that people can slide into a USB slot and then use to log into any number of online accounts with a single mouse click.
Because carrying around another device may not prove popular among consumers, Google suggests the authentication device could be integrated into a smartphone or even a piece of jewelry. The device would be able to authorize a new computer for use with a single tap, even in situations in which the phone might be without cellular connectivity.
The technology aims to improve upon the company's current, optional two-step verification system. With that system, when users want to log into a Google service from a new computer, they're prompted to enter a code sent to their preregistered mobile phone, granting them access to the site.
The company says its experience with that system has been good, though it too can be abused by account hackers. After they steal a password and break into an account, they sometimes set up a two-factor authentication using their own phone number, "just to slow down account recovery by the true owner," the Google engineers wrote.
Google admits its proposed USB key approach is "speculative" and that it will need to be accepted on a wide scale. But the firm said it is eager to test the device with other websites.
"User device registration with target websites should be simple and shouldn't require a relationship with Google or any other third party," the engineers write. "The registration and authentication protocols must be open and free for anyone to implement in a browser, device, or website."
Google didn't say if or when the experimental system might make it into use. "We're focused on making authentication more secure, and yet easier to manage. We believe experiments like these can help make login systems better," a spokesman said via email.
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!