The Internet of Things Is the Password Killer We've Been Waiting For 124
jfruh writes: You can't enter a password into an Apple Watch; the software doesn't allow it, and the UI would make doing so difficult even if it did. As we enter the brave new world of wearable and embeddable devices and omnipresent 'headless' computers, we may be seeing the end of the password as we know it. What will replace it? Well, as anyone who's ever unlocked car door just by reaching for its handle with a key in their pocket knows, the answer may be the embeddable devices themselves.
What will replace it? (Score:3, Funny)
wow (Score:5, Funny)
This is one of the rare cases where the title doesn't ask the question, yet the answer is still no.
Biometrics for all the "things"! (Score:2)
Biometrics for all the "things"!
Sadly, there's not an ASCII art for the Trollface with the torch graphic...
Re: wow (Score:3)
I could imagine there being a collection of things, which one needs to place in the correct position for the access. No need to hardcode anything.
One has more or less certain unique things at home for instance. The position info would add to that.
The devices would be the user interface.
Re: (Score:3)
Re: (Score:3)
Android users have actually had this for a while with Smart Lock. For example, you can disable the PIN/password lock screen when your phone is paired with certain Bluetooth devices.
I'm working on apps without passwords (Score:3, Insightful)
You enter your email to register. And if you ever change phones, you simply do what is commonly known as a "password recovery", but don't actually get a password, you just get perma logged in.
Here's a secret for people who deal with hackers: Have the app generate a keygen unique to the phone: Time stamp it, time stamp it again on the first click, get the X/Y position, and you have a pretty unique code. Keep that code permanently with the installed app, so if they're banned and forget to uninstall your app, they're banned again. Also this key could be used to login automatically without even registering! But if they ever want to recover their account if they lose their phone, they should enter their email in the settings.
Re:I'm working on apps without passwords (Score:5, Insightful)
ANd if they want to use their account on multiple devices? On their actual PC? On a PC at a firend's house or library?
And email recovery- laughable. If they lost their phone, which was almost definitely logged into their email, then they've lost everything.
Please name your apps, so I can be sure never to use them.
Re: (Score:1)
You're right if their email gets hacked, they lose everything. But that's no different than how the web operates now...
Re: (Score:3, Interesting)
The big shift should be away from passwords and to passkeys. So you install the same passkey generating app on multiple devices and when you enter the same password on multiple devices, the app generates a different rotating different passkey for each separate site that device access. So you password never passes beyond your device and the app sets up a procedurally generated passkey that varies with ever access and the passkey accepting app handshakes to ensure that the passkey changes align, the server a
Re: (Score:2)
If only it were possible to change the password of your e-mail account...
Re: (Score:3)
Security that can't meet real world usability requirements is ultimately useless. It doesn't matter how much contempt you show for the end user.
Re: (Score:2)
Before going off on rants like this, I'd study what two factor authentication actually means. Hint: the idiotic idea I was responding to isn't even close.
Re: (Score:1)
In the app, you're always logged in once you register. Yes, I know it is a security breach, but so is losing your stupid phone.
You enter your email to register. And if you ever change phones, you simply do what is commonly known as a "password recovery", but don't actually get a password, you just get perma logged in.
Here's a secret for people who deal with hackers: Have the app generate a keygen unique to the phone: Time stamp it, time stamp it again on the first click, get the X/Y position, and you have a pretty unique code. Keep that code permanently with the installed app, so if they're banned and forget to uninstall your app, they're banned again. Also this key could be used to login automatically without even registering! But if they ever want to recover their account if they lose their phone, they should enter their email in the settings.
How is this different than plaintext FTP authentication or a cookie that says "IAMTOTALLYTHEREALJIMDOTCOMSECRETPASS12345"?
What if my phone gets malware and that skims the cookie? Are you just sending that same cookie every time, so any cell tower/wifi can automatically get a copy of my password on authentication, ala FTP?
What if my phone locks up and I just want to reinstall on the same phone after I wipe it?
You are using a password, you are just not letting the user easily check or change it. And not a goo
Re:I'm working on apps without passwords (Score:5, Interesting)
If you don't enter an email and verify it, yes, you lose everything! This is why you enter your email and verify it, gain some virtual currency for completing the task. The thing is, it won't prompt you for this for about 10-30 minutes in since you don't have anything worth saving anyway, and no one wants detracted from seeing if the game is cool or not.
Re: (Score:2)
"In security engineering, security through obscurity is the use of secrecy of the design or implementation to provide security. A system relying on security through obscurity may have theoretical or actual security vulnerabilities, but its owners or designers believe that if the flaws are not known, then attackers will be unlikely to find them." - Sauce: https://en.wikipedia.org/wiki/... [wikipedia.org]
TLDR: Your system is already a failure. Leave security up to the security experts.
Re: I'm working on apps without passwords (Score:2, Insightful)
Why would it be a failure? It's actually a pretty elegant security design that for example the GMail app uses as well by default:
Attackers on other systems or from other apps cannot get to the password. This covers 99% of the risk.
There's a residual risk: if other apps can break their jail to root mode, or if your system is remote exploitable - but in those cases you are likely hosed no matter what, and requiring password entry won't eliminate those threats.
The best security design is the one that does not
Re:I'm working on apps without passwords (Score:5, Insightful)
Dude, he's not running a f*cking bank. He's obviously talking about a system for some phone toy like Angry Birds. Do you care if I can get into your Angry Birds account? Probably not much.
He's describing a system that is good enough for phone toys and things that require similarly low security. Like apparently Slashdot, which lets you perma-login with a browser cookie and redirects https to http rather than the other way around.
Re: (Score:1)
What about zero-knowledge password proof? It works quite well against MITM attacks. That will protect you when your device is not compromised but but the network you are using to connect is. In worst case the attacker will only be able to hijack the current session but he will not be able to log in again later.
With just using a cookie if an attacker gets it he can log in any time he wants.
Re:I'm working on apps without passwords (Score:4, Interesting)
With all the security available in device operating systems, there are better ways to do this:
When the app is created, have it generate a public/private keypair, store the private key in the OS's keystore (called KeyChain in both iOS and Android.) Then, on first authentication to the servers (you are using SSL/TLS for all communication, right?), the central server will store the device's public key's fingerprint. From then on, it functions like a client certificate, and can be optionally used with an app's PIN function for added security.
The benefit of this over a shared secret? Someone hacks the server, a list of key fingerprints will do an attacker no good to authenticate against (because they don't even have the key material that the fingerprint shows), and can be added/deleted per device. With iOS's and Android's keystore functionality, if the device is locked, the keystore is encrypted and inaccessible, providing another layer of protection on top of encrypting /data.
To the user, it functions exactly the same, but it is a lot more secure in virtually every way. The only way it would be less secure is if RSA or the public key algorithm in use was completely broken.
As for bans, you can easily do what Yik Yak and other apps do -- grab the IMEI (if available) and other serials (UDID), and ban by that. Then, even if the app is uninstalled, the phone is still blacklisted.
Re: (Score:2)
"Someone hacks the server..."
Securing authentication servers isn't a new problem. User authentication on headless devices is.
The problem the article identifies is when someone loses their watch. Your suggestion authenticates the watch, but what really needs to be authenticated here is the user.
Re: (Score:2)
The public key allows for more flexibility than just a shared secret. For example, if one wants to store a blob on a untrusted cloud provider, they could store it encrypted to each device's public key. This can be made transparent to the user, since the user just has to "introduce" a device via another, already trusted device which would decrypt the data blob's master key with its own private key, add an encrypted entry for the public key of the device being introduced.
Another item is that if someone snat
mixed signals (Score:5, Funny)
halfway through the article...
[ Don't miss: Welcome to the Internet of Things. Please check your privacy at the door. ]
Re: (Score:1, Interesting)
shutup. this takes us 1 step closer to living in a cyberpunk novel. we used to laugh at the idea of someone hacking a toaster, fridge, or running shoes. with IoT, it's becoming reality.
Re: (Score:2)
RFID tags, obviously (Score:4, Insightful)
Just implant yourself with an RFID tag. As a bonus, it will also reduce the chance that a surveillance camera misidentifies someone as you.
Re: (Score:2)
So instead of a car thief just stealing your car by taking the keys from your hand or pocket, now they're going to have to chop off whatever body part contains the RFID tag that unlocks it. May I suggest installing the RFID tag in the tips of your fingers, to minimize the tissue loss? As an added benefit to RFID at/in your fingertips, after a couple robberies you'll be able to nail the Onion Knight (from Game of Thrones) Halloween costume!
Re: (Score:1)
No they just have to clone your RFID, then you get to chop up your own hand to change your password. Same thing when they clone your fingerprint, iris, etc.
True, in a sense... (Score:5, Insightful)
In all other respects, what a load of tedious, meandering, bullshit to arrive at some vacuous generalities about a vaguely described non-solution.
Re:True, in a sense... (Score:4, Insightful)
Yeah, the IoT is a lightweight proof of concept which nobody yet knows what to do with but are otherwise hoping catches on because it really sounds cool.
The problem with being a lightweight proof of concept is there is pretty much zero security in them thus far.
Derpa derp, internet of things, this is people spitballing about what it might be if it ever comes to pass.
The internet of things isn't even as far as being a solution in search of a problem. It's a construct desperately trying to become real enough to try to have a solution in search of a problem.
The only people who care about the internet of things are the people trying to tell us how awesome the internet of things will be.
Using it for security? Not bloody likely.
Re:True, in a sense... (Score:4, Interesting)
Of course we know what to do with IoT. It exists today. It's not the gadget/smartphone loving hipster IoT that the media fawns over. But the smart grid is IoT, many SCADA systems could fit that description, other networks of sensor controllers that exist today, etc. Sometimes they do have passwords (which nobody enters by hand), sometimes they have to present certificates. There is a LOT of security in them.
Re: (Score:1)
*LMAO* That's why you never hear about SCADA systems getting attacked or crippled, right?
Even the SWIFT banking network has had problems from time to time, and that is just about the most secure network on the planet short of those created by the military in a very short list of nation-states.
There is no such thing as "impenetrable security." Trusting devices that can't be or aren't regularly updated and which don't change their security certificates on a regular basis is just begging to be cracked.
Re: (Score:2)
You think SCADA systems have not improved security? A few examples of old systems with bad security and they're all supposed to be that inept?
Re: (Score:2)
*LMAO* That's why you never hear about SCADA systems getting attacked or crippled, right?
Actually I haven't heard about a SCADA system properly setup with correct credentials setup over a proper link get crippled via a network. Many systems provide sound security out of the box often on the protocol level.
What you hear about often is idiots letting their SCADA systems get crippled often via default passwords, not enabling basic encryption, not enforcing basic security, or just plain old letting someone plug directly into it or into the process network, just like you hear that one of the most po
Re: (Score:2)
Re: (Score:2, Interesting)
The Internet of Things is something Bill Gates wrote about 20 years ago and it's about as close to reality as it was then. The real issue is that we need an embeddable computer that runs Windows (don't laugh, it's what people know) and costs about $0.05, maybe $0.25 is good enough, but I doubt it. Then We'll start to see the Internet of Things take off.
I have literally zero things that are not internet enabled that I wish were internet enabled. If someone offered me an enabled and non-enabled device I'd tak
Re: (Score:2)
People use smartphones now, and almost none of them run Windows. I don't think Windows is a requirement for IoT.
I do think some sort of use case is a requirement, and some form of standardization.
Re: (Score:2)
I remember the same sentiment expressed against camera-equipped cell phones. Once people had them in their hands, it turned out the realities of how much pocket-space people actually had played a crucial role. Face facts: One day your friend is going to impress you with a tale of how his fridge told his smartphone while he was at the grocery store that he's out of otter pops. You may not believe that now, but sooner or later your free time will come at a premium and you're going to wish you had all the
Re: (Score:2)
Supply management is an interesting application. But is it even close to happening? I'd say RFID might make it possible but I don't think you can check multiple RFIDs at once.
Re: (Score:2)
I might also mention that while I have a camera in my smart phones, I prefer my point and shoot or DSLR.
While the current gen of phones do take pictures perhaps even better than the point and shoots of old they aren't really up to snuff relative to the current gen of point and shoots, the GoPro. Also, neither can touch the DSLR for image quality. But the DSLR is really heavy and expensive enough that you have to think about theft whenever you have it outside of the house, so it's a real pain.
Re: (Score:3)
I think it's really interesting how I'm moderated for this. 50% interesting 30% overrated and 20% troll. There is a lot of passion here about me being wrong.
Or perhaps it's the /. revulsion to having Windows take over. Pretty bad, in my mind, but the only thing worse would be Andriod with its total lack of privacy controls.
Re: (Score:2)
The problem with Android is that you don't get root on your own devices. People who do run Cyanogenmod can run a simple application permissions "firewall" which is somewhat like HIPS on Windows. It can block or return blank or fake data on anything you don't think the app needs to function for you. And from the reports I've heard, almost no apps crash or refuse to run when this is done.
If we had actual control over our devices, we'd not have privacy issues.
It's pretty ironic the supposed security we would g
Re: (Score:2)
It's not walled gardens, Apple actually lets you control the privacy settings on your device.
IoT in a nutshell: (Score:2)
And telling us what backward, mouth-beathing Luddites everyone is who isn't racing to jump on the IoT fanboi bandwagon are.
Re: (Score:3)
The only people who care about the internet of things are the people trying to tell us how awesome the internet of things will be.
You are sadly mistaken. There are a large bunch of people who care about the Internet of things because they recognize what a boon it will be to mining personal data for the corporations who get their stuff adopted first. The IoT is the smart TV which reports your viewing habits, and random videos of your living room (or wherever your TV is) to the company which made it (Samsung, and probably others). I am sure there are other such devices.
Re: (Score:2)
Re: (Score:2)
While that is partly true, you are forgetting the truly benevolent devices from trusted companies/organisations which can actually help people greatly, with no privacy cost. To ignore those is shooting yourself in the foot.
I would agree with you, but even with your reminder I cannot think of any of those. In order to be "forgetting" them, I would have to be aware of them. So, would you care to enlighten me?
Re: (Score:2)
the truly benevolent devices from trusted companies/organisations
I don't think such a thing exists. And even if it does today, what about in 5 years? Think about sourceforge for instance...
meh. (Score:1)
Dice Holdings sucks the big hairy meatball.
the real password killer is... (Score:2)
So far, my "password killer" has been Google Authenticator and RSA SecurID on my Android phone. (I checked out of the Apple ecosystem when I cancelled cable but I'll bet they have the same things over there.) All my VPN connections and some of my web apps now use these.
btprox much (Score:2)
I've been using various forms of bluetooth proximity to automatically lock workstation forever.
Not Looking Forward To This (Score:1, Insightful)
I'm not looking forward to a world where computers are everywhere and in everything. It's bad enough every moron has a mobile phone stuck in their face whilst they walk. I don't want my stove talking to the fridge. I don't want reminders from the fridge the milk is low. I don't want my toaster sending illegal packets to Yahoo! and then getting blacklisted. No. Simply no.
I want to use computers a tool when I want. I want to have to walk over to one like I do in my living room. I don't a world like Star Trek
Re:Not Looking Forward To This (Score:4, Interesting)
Of course, I am leery of the next step above this... having to wait for an ad to play on the fridge before I can open the door, having to pay the stove manufacturer $29.99 a month so I can use the self-cleaning settings, finding my faucet won't turn on because it lost connection with the cellular tower as the telco dropped GSM for pure LTE, getting fined by my HOA because the freezer detected more than the alloted moving things via its camera in the house, and so on.
Then, there is the security nightmare. Think those IoT providers will pay more than lip service to ensuring their devices are not easy prey? Won't happen.
Finally, there are the higher prices. I don't feel like paying hundreds of dollars for a thermostat, or thousands of dollars for a fridge because it is "smart". If I wanted to pay top dollar for a fridge, depending on availability, I would get a propane or natural gas fridge, so my stuff stays cold even if there is a power outage.
Re: (Score:2)
Won't happen because it cannot happen. There will be some manufacturers who go out of business. Where's the updates then?
Not to mention the manufacturers dropping support for older models EVEN IF THEY STILL WORK. Gotta buy a new fridge because the old one isn't updated any more.
Even if they do put the minimal effort in being better than "easy prey", how many times have we seen secret backdoors
Re:Not Looking Forward To This (Score:4, Interesting)
If phone makers (and phones are not cheap items) in general won't provide updates for more than a version or two at most, then I doubt IoT device makers would provide much, if any, about updates.
IMHO, the best thing about IoT is to just say no.
There are ways to design IoT devices securely (for example, having them use a hardened, central hub that handles the communication through the Internet, so attacks on individual devices end up having to be physically local), but since IoT is such a "fad", security is at best an afterthought after the product design is rushed out the door, so I expect zero security whatsoever.
Re: (Score:2)
Nope - the answer is not there.
IoT is the best known way to donate all your privacy to the lowest scum on earth - by which I mean all of them collectively, not the exact lowest - exactness will be missing.
Re: (Score:2)
I already trust my home router as a hardened, central hub for everything else: Why not trust it to be an IoT hub as well?
I'm game for that (not being embedded gung ho for) (Score:2)
DR TA
I use a password manager (Acerose, Win), so know my passwords are correct, yet can't access my Hotmail account due to it being questioned. Hotmail's only use for me is to forward my e-mail from .com's I've used it on to my newer e-mail address at Gmail; so I don't mess with it, as it's working. This isn't the only site that's questioned my password, those requiring a new account.
Re: (Score:2)
DR TA
This isn't the only site that's questioned my password, those requiring a new account.
E-mails being sent to verify ones identity (sometimes) are sent to only one E-mail address, they don't allow forwarding nor POP3ing them as I normally do to get my e-mail (it's caused problems in the past, yet now I'm aware of it).
I'm feeling a little... (Score:2)
I'm feeling a little chipper!
Does it matter? (Score:1)
I'm sure whatever they come up with will suck just as much as a password.
Not embeddable devices, smartphones (or watches) (Score:4, Interesting)
This is the right basic idea, I think, but I think everything will converge into a single device, either the mobile phone or a wearable. And as it becomes more and more central to everything we do, that device will become very smart about authentication.
The problem with using dedicated embeddable devices is twofold. First, the more of them you have to carry, the more difficult it is to keep track of them. With old-fashioned metal keys we've solved this with the key ring... but that creates its own problem. The more keys you add to it, the more valuable it becomes. Loss or theft become increasingly more problematic. And our metal keys open fewer, and less important, things than our electronic authenticators do.
So, it makes sense to combine the electronic keys in a single device, but then to use the capabilities it has that metal keys do not to solve the theft and loss problems. First, against loss, there must be a way of backing up all of the credentials, securely and automatically, so that in the event the device is lost they can all be recovered relatively easily. Some sort of remote server backup, to which you authenticate with some other mechanism that you protect very carefully (there are lots of options here, but a long, randomly-generated password printed out and stored in a safe place is a good option). That backup needs to be reliable and reliably accessible, but access need not be easy or convenient, since it should be rarely needed.
What about theft? This is where the smart device has huge advantages over dumber devices, because it can authenticate the user. This authentication needn't be particularly strong, but it should have good anti brute-force protections, and it should be smart. The goal is to make something that is extremely convenient for the user, but makes it relatively unlikely that someone else who gets it can use it. How could that work? Google is pushing towards this vision with Android Smart Lock features. The core idea is that the device shouldn't rely on a single signal, because that signal then has to be very strong.
It's worth looking at analogies with meatspace facilities that care a great deal about security. What they don't do is put a bank vault door on the exterior wall and rely on the strong combination lock to keep thieves out. Instead, they rely on layering of defenses, monitoring and active response.
What can your phone do? Quite a bit, probably. Not only does it have a touchscreen for entering passwords, it also has cameras, an accelerometer, GPS, various radios, compass, altimeter, microphones, a proximity sensor and probably other stuff I'm forgetting. In addition, it can know a lot about your habits, your plans (e.g. what's on your calendar) and more. With that wealth of signals, it should be possible for the device to determine with relatively high certainty whether or not it is still in your possession. Where it's uncertain, it can fall back to asking for authentication with, say, a fingerprint or simple PIN to increase its certainty. Or in more extreme cases, it can fall back to an even stronger password. The idea is to make authentication as seamless, transparent and automatic as possible... but as strong as necessary.
Or maybe a smart watch will be a better choice. It has pretty much all the same capabilities as a phone, but the advantage that you strap it to your body, making it harder to lose, and harder to steal. (Actually, I think over the next few years for many of us our phones will migrate onto our wrists; right now the smart watch is an extension of the phone, I think that will flip, with the handheld device becoming an extension of the watch providing a larger screen, aimable camera, etc.).
The "as strong as necessary" bit is important here, too. When the phone is going to use a stored authentication key to unlock something for you, the degree of certainty that it needs to have that you're you depends on what it's unlocking. If I'm using my phone to log me into slashdot on my laptop, I really cou
Re: (Score:2)
However, as a password killer my watch is already there. My phone is locked when it's more than about 15 feet from my Moto 360 smartwatch (and therefore, from me). I can still get into my phone easily, but oth
Re: (Score:2)
Might be OK on a touch phone, where typing is a painful process. Mine doesn't have a fingerprint scanner, and AFAIK, none of the ones with removeable batteries and SD cards do, so it is not an issue I am likely to encounter.
Re: (Score:2)
My laptop password is 11 characters and takes me somewhere between three-quarters of a second and a full second to type, from the moment my fingers reach the keyboard after having clicked in the password field. My fingerprint scanner takes somewhere between 0.25 and 0.5
Re: (Score:2)
Actually, I think over the next few years for many of us our phones will migrate onto our wrists
And this is the problem with the culture at Google these days. Ever since all employees started using macbooks and they only hired 20 something's with thick frame glasses and "nerd" t-shirts they've been on a steady decline into the toilet. This geek tech culture is a serious blight. You people are ruining a once magnificent company. Oh ya... And get off my lawn.
Re: (Score:2)
Gah, i am so disappointed in slashdot. comments like the parent are why i come here. Somebody who spends their time thinking about an interesting problem and is willing to share some of that background. Instead of discussion we get people complaining about ... anything.
Anyway, thanks for the post. I like the way you are thinking and I love the idea of 'as secure as necessary'. I can see a future where my phone decides when it is still with me based on the myriad of data it collects (and helpfully share
Uh.... (Score:2)
Not sure what Apple Watch you've used, but if mine isn't on my wrist, I'm required to enter a numeric password if I want to see anything more than the watch face.
It's even greater than 4 numbers, too.
If it's on my wrist, the iPhone needs to be unlocked at which point the watch is unlocked as well.
smart cars (Score:1)
anyone else have one of those cars that lets people steal items from your car while your in the store because the doors don't lock while your in range?
iButton (Score:3)
I remember when the iButton (and the Java ring with a java iButton embedded in the ring) came out, *that* was going to eliminate passwords - just hold your ring up to the iButton reader on your door, your computer, or any thing you want to secure. Passwords are a thing of the past when you have your iButton.
It's only been 17 years, so I'm sure we'll start seeing the readers built in to computers any day now.
https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:2)
I remember when iButtons came out a million years ago, and I've actually used them. Motorola likes to use them for some of their dispatch consoles and radios for licensing software features, and in some cases as keys to access particular radio systems.
And that's...it, although they do function in those roles rather well.
Re: (Score:2)
They were used heavily for door access in many places. they work great. I still have a few ibuttons and the dev kit around. And I have the good ones that run java and have a RTC inside them, so you never send the keys in the clear but you instead do a challenge response incredibly high security in those, but very few places used them. Most of the ibutton door locks simply used the serial number if the ibutton as the key.
The US postal service used them for a while as identifiers on tubs until optical re
There's nothing wrong with... (Score:3)
Copyright analogy (Score:2)
You know how old-media companies always go on about how copying media is somehow "theft", even though we all know it's not?
Well, the problem with digital authentication keys is similar; it can get copied without you losing anything.
Attaching authentication to a physical item that actually CAN get stolen changes the game dramatically.
It's a single point of failure that will give a false sense of security.
my password (Score:2)
Easy ... use watch+gestures for authentication (Score:1)
Would be fun to observe people waving their hands in complex patterns detected by a built-in watch motion sensor to unlock things. The watch could even play a little tune to help synchronize arm movement to a beat. It would be easy to steel people's password though, if you got a good sense of rhythm and dance. Ok, this was meant as a bit of a joke. But the fun thing is we would probably get used to it, just like we got used to people talking to themselves on the street.
On a somewhat more serious note, authe
Re: (Score:2)
Would be fun to observe people waving their hands in complex patterns detected by a built-in watch motion sensor to unlock things.
Wow, I think you just implemented wizard spells with a somatic component. Add in voice recognition and the need to have your phone with you, and you've got verbal and material components too.
Re: (Score:1)
Haha ... as a former RPG player, this gave me a good laugh. *Slow clap*
IoT (Score:1)
Again, a security joke (Score:2)
It will be a cold day in hell when I use a cloud based authentication scheme to access my own shit. I'm not going to use a system where I have to ask someone else permission to use my shit. Anyone that does is eventually going to get what they deserve.
Not a good thing.... (Score:2)
"Well, as anyone who's ever unlocked car door just by reaching for its handle with a key in their pocket knows, the answer may be the embeddable devices themselves."
BMW cars without this are secure and not easily stolen. BMW cars with "comfort access" are easily stolen.
Same with GM, Toyota, etc...
Nope, I am not trading security for convenience.
Re: (Score:2)
Re: (Score:2)
http://www.networkworld.com/ar... [networkworld.com]
You are not cracking the rolling code in the physical key chip on a car easily or for $17.00
Before you are unsure on claims, you should read up on the subject with google.
Re: (Score:2)
some sophisticated thieves have laptops equipped with a radio transmitter" and use brute force attacks to find the correct and unique code of a car's key fob.
Thanks for the info. This definitely seems like poor design rather than a broken concept though. I'd like to see them brute force a 2048 bit RSA key. Wireless authentication protocols have the ability to be just as secure as anything else.
Security (Score:2)
Two factor secuirty : Something you know, Something you have, Something you are - Pick two
Something you know : Password
Something you have : Device, RFID etc
Something you are : Biomentrics
using only one is a bad idea
Also known as Something you forget, something you lose, something cease to be ....
So much FAIL! (Score:1)
There is so much wrong with this article its not even funny. I don't blame the writer, he's just trying to tie a nice neat bow on a badly wrapped pig.
I had to laugh though when he twice gives the example of proximity unlock on cars as IOT security. These are the same devices that only guarantee proximity security by using signal strength and thus are easily defeated by a $17 signal booster available on eBay, which has been in the news as the cause of many thefts of the contents of vehicles.
By seriously the
Re: (Score:2)
Since I'm unfamiliar with the watch I'd like to know why this comment is -1. Even my iPod Nano that I wore with as a watch had enough icons on the screen to prove pass codes are at least feasible with the form factor.