Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
Security

The Internet of Things Is the Password Killer We've Been Waiting For 124

jfruh writes: You can't enter a password into an Apple Watch; the software doesn't allow it, and the UI would make doing so difficult even if it did. As we enter the brave new world of wearable and embeddable devices and omnipresent 'headless' computers, we may be seeing the end of the password as we know it. What will replace it? Well, as anyone who's ever unlocked car door just by reaching for its handle with a key in their pocket knows, the answer may be the embeddable devices themselves.
This discussion has been archived. No new comments can be posted.

The Internet of Things Is the Password Killer We've Been Waiting For

Comments Filter:
  • by turkeydance ( 1266624 ) on Wednesday June 17, 2015 @10:05PM (#49934175)
    the NSA enabled code. don't leave home without it.
  • wow (Score:5, Funny)

    by Anonymous Coward on Wednesday June 17, 2015 @10:07PM (#49934187)

    This is one of the rare cases where the title doesn't ask the question, yet the answer is still no.

    • I could imagine there being a collection of things, which one needs to place in the correct position for the access. No need to hardcode anything.

      One has more or less certain unique things at home for instance. The position info would add to that.

      The devices would be the user interface.

    • by AmiMoJo ( 196126 )

      Android users have actually had this for a while with Smart Lock. For example, you can disable the PIN/password lock screen when your phone is paired with certain Bluetooth devices.

  • by GoodNewsJimDotCom ( 2244874 ) on Wednesday June 17, 2015 @10:25PM (#49934235)
    In the app, you're always logged in once you register. Yes, I know it is a security breach, but so is losing your stupid phone.

    You enter your email to register. And if you ever change phones, you simply do what is commonly known as a "password recovery", but don't actually get a password, you just get perma logged in.

    Here's a secret for people who deal with hackers: Have the app generate a keygen unique to the phone: Time stamp it, time stamp it again on the first click, get the X/Y position, and you have a pretty unique code. Keep that code permanently with the installed app, so if they're banned and forget to uninstall your app, they're banned again. Also this key could be used to login automatically without even registering! But if they ever want to recover their account if they lose their phone, they should enter their email in the settings.
    • by AuMatar ( 183847 ) on Wednesday June 17, 2015 @10:28PM (#49934251)

      ANd if they want to use their account on multiple devices? On their actual PC? On a PC at a firend's house or library?

      And email recovery- laughable. If they lost their phone, which was almost definitely logged into their email, then they've lost everything.

      Please name your apps, so I can be sure never to use them.

      • If a log off button is required, simple one could be put there if they really want to log off, but by default it is off unless they registered with email. Since the only way to log back on would require you to register in the first place. I think most people would love to just go straight to playing the game without registering anything to waste their time.

        You're right if their email gets hacked, they lose everything. But that's no different than how the web operates now...
      • Re: (Score:3, Interesting)

        by rtb61 ( 674572 )

        The big shift should be away from passwords and to passkeys. So you install the same passkey generating app on multiple devices and when you enter the same password on multiple devices, the app generates a different rotating different passkey for each separate site that device access. So you password never passes beyond your device and the app sets up a procedurally generated passkey that varies with ever access and the passkey accepting app handshakes to ensure that the passkey changes align, the server a

      • If only it were possible to change the password of your e-mail account...

    • by Anonymous Coward

      In the app, you're always logged in once you register. Yes, I know it is a security breach, but so is losing your stupid phone.

      You enter your email to register. And if you ever change phones, you simply do what is commonly known as a "password recovery", but don't actually get a password, you just get perma logged in.

      Here's a secret for people who deal with hackers: Have the app generate a keygen unique to the phone: Time stamp it, time stamp it again on the first click, get the X/Y position, and you have a pretty unique code. Keep that code permanently with the installed app, so if they're banned and forget to uninstall your app, they're banned again. Also this key could be used to login automatically without even registering! But if they ever want to recover their account if they lose their phone, they should enter their email in the settings.

      How is this different than plaintext FTP authentication or a cookie that says "IAMTOTALLYTHEREALJIMDOTCOMSECRETPASS12345"?

      What if my phone gets malware and that skims the cookie? Are you just sending that same cookie every time, so any cell tower/wifi can automatically get a copy of my password on authentication, ala FTP?

      What if my phone locks up and I just want to reinstall on the same phone after I wipe it?

      You are using a password, you are just not letting the user easily check or change it. And not a goo

      • by GoodNewsJimDotCom ( 2244874 ) on Wednesday June 17, 2015 @10:47PM (#49934339)
        Look if your phone gets malware or MITM and skims the logon normally, you're boned. You're boned in many ways since if you have malware you probably have a keystroke logger too. Yet this passwordless style won't ever let them know how to log onto your account. This is no different since your login/password phase of authentication is the same. In fact with the server giving you a quite long randomized password its better than someone's recycled password they use on every site.

        If you don't enter an email and verify it, yes, you lose everything! This is why you enter your email and verify it, gain some virtual currency for completing the task. The thing is, it won't prompt you for this for about 10-30 minutes in since you don't have anything worth saving anyway, and no one wants detracted from seeing if the game is cool or not.
        • by darkain ( 749283 )

          "In security engineering, security through obscurity is the use of secrecy of the design or implementation to provide security. A system relying on security through obscurity may have theoretical or actual security vulnerabilities, but its owners or designers believe that if the flaws are not known, then attackers will be unlikely to find them." - Sauce: https://en.wikipedia.org/wiki/... [wikipedia.org]

          TLDR: Your system is already a failure. Leave security up to the security experts.

          • by Anonymous Coward

            Why would it be a failure? It's actually a pretty elegant security design that for example the GMail app uses as well by default:

            Attackers on other systems or from other apps cannot get to the password. This covers 99% of the risk.

            There's a residual risk: if other apps can break their jail to root mode, or if your system is remote exploitable - but in those cases you are likely hosed no matter what, and requiring password entry won't eliminate those threats.

            The best security design is the one that does not

          • by linuxrocks123 ( 905424 ) on Thursday June 18, 2015 @01:34AM (#49934929) Homepage Journal

            Dude, he's not running a f*cking bank. He's obviously talking about a system for some phone toy like Angry Birds. Do you care if I can get into your Angry Birds account? Probably not much.

            He's describing a system that is good enough for phone toys and things that require similarly low security. Like apparently Slashdot, which lets you perma-login with a browser cookie and redirects https to http rather than the other way around.

        • by Anonymous Coward

          What about zero-knowledge password proof? It works quite well against MITM attacks. That will protect you when your device is not compromised but but the network you are using to connect is. In worst case the attacker will only be able to hijack the current session but he will not be able to log in again later.
          With just using a cookie if an attacker gets it he can log in any time he wants.

    • by mlts ( 1038732 ) on Wednesday June 17, 2015 @11:03PM (#49934419)

      With all the security available in device operating systems, there are better ways to do this:

      When the app is created, have it generate a public/private keypair, store the private key in the OS's keystore (called KeyChain in both iOS and Android.) Then, on first authentication to the servers (you are using SSL/TLS for all communication, right?), the central server will store the device's public key's fingerprint. From then on, it functions like a client certificate, and can be optionally used with an app's PIN function for added security.

      The benefit of this over a shared secret? Someone hacks the server, a list of key fingerprints will do an attacker no good to authenticate against (because they don't even have the key material that the fingerprint shows), and can be added/deleted per device. With iOS's and Android's keystore functionality, if the device is locked, the keystore is encrypted and inaccessible, providing another layer of protection on top of encrypting /data.

      To the user, it functions exactly the same, but it is a lot more secure in virtually every way. The only way it would be less secure is if RSA or the public key algorithm in use was completely broken.

      As for bans, you can easily do what Yik Yak and other apps do -- grab the IMEI (if available) and other serials (UDID), and ban by that. Then, even if the app is uninstalled, the phone is still blacklisted.

      • "Someone hacks the server..."

        Securing authentication servers isn't a new problem. User authentication on headless devices is.

        The problem the article identifies is when someone loses their watch. Your suggestion authenticates the watch, but what really needs to be authenticated here is the user.

  • by Gravis Zero ( 934156 ) on Wednesday June 17, 2015 @10:29PM (#49934257)

    halfway through the article...

    [ Don't miss: Welcome to the Internet of Things. Please check your privacy at the door. ]

    • Re: (Score:1, Interesting)

      by Anonymous Coward

      shutup. this takes us 1 step closer to living in a cyberpunk novel. we used to laugh at the idea of someone hacking a toaster, fridge, or running shoes. with IoT, it's becoming reality.

      • by Falos ( 2905315 )
        You optimists could find a bright side to cancer. I'll concede your point, though this also means Hollywood and CSI episodes will be marginally less ridiculous.
  • by penguinoid ( 724646 ) on Wednesday June 17, 2015 @10:34PM (#49934285) Homepage Journal

    Just implant yourself with an RFID tag. As a bonus, it will also reduce the chance that a surveillance camera misidentifies someone as you.

    • So instead of a car thief just stealing your car by taking the keys from your hand or pocket, now they're going to have to chop off whatever body part contains the RFID tag that unlocks it. May I suggest installing the RFID tag in the tips of your fingers, to minimize the tissue loss? As an added benefit to RFID at/in your fingertips, after a couple robberies you'll be able to nail the Onion Knight (from Game of Thrones) Halloween costume!

      • by Anonymous Coward

        No they just have to clone your RFID, then you get to chop up your own hand to change your password. Same thing when they clone your fingerprint, iris, etc.

  • by fuzzyfuzzyfungus ( 1223518 ) on Wednesday June 17, 2015 @10:35PM (#49934291) Journal
    In the sense that both 'the internet of things' and 'passwords' can be described as "an egregiously maldesigned and actively user-hostile security clusterfuck; typically bodged together by people who don't know, don't care, or both", I suppose that 'IoT' would be a worthy successor.

    In all other respects, what a load of tedious, meandering, bullshit to arrive at some vacuous generalities about a vaguely described non-solution.
    • by gstoddart ( 321705 ) on Wednesday June 17, 2015 @10:59PM (#49934387) Homepage

      Yeah, the IoT is a lightweight proof of concept which nobody yet knows what to do with but are otherwise hoping catches on because it really sounds cool.

      The problem with being a lightweight proof of concept is there is pretty much zero security in them thus far.

      Derpa derp, internet of things, this is people spitballing about what it might be if it ever comes to pass.

      The internet of things isn't even as far as being a solution in search of a problem. It's a construct desperately trying to become real enough to try to have a solution in search of a problem.

      The only people who care about the internet of things are the people trying to tell us how awesome the internet of things will be.

      Using it for security? Not bloody likely.

      • by Darinbob ( 1142669 ) on Wednesday June 17, 2015 @11:23PM (#49934501)

        Of course we know what to do with IoT. It exists today. It's not the gadget/smartphone loving hipster IoT that the media fawns over. But the smart grid is IoT, many SCADA systems could fit that description, other networks of sensor controllers that exist today, etc. Sometimes they do have passwords (which nobody enters by hand), sometimes they have to present certificates. There is a LOT of security in them.

        • by msobkow ( 48369 )

          *LMAO* That's why you never hear about SCADA systems getting attacked or crippled, right?

          Even the SWIFT banking network has had problems from time to time, and that is just about the most secure network on the planet short of those created by the military in a very short list of nation-states.

          There is no such thing as "impenetrable security." Trusting devices that can't be or aren't regularly updated and which don't change their security certificates on a regular basis is just begging to be cracked.

          • You think SCADA systems have not improved security? A few examples of old systems with bad security and they're all supposed to be that inept?

          • *LMAO* That's why you never hear about SCADA systems getting attacked or crippled, right?

            Actually I haven't heard about a SCADA system properly setup with correct credentials setup over a proper link get crippled via a network. Many systems provide sound security out of the box often on the protocol level.

            What you hear about often is idiots letting their SCADA systems get crippled often via default passwords, not enabling basic encryption, not enforcing basic security, or just plain old letting someone plug directly into it or into the process network, just like you hear that one of the most po

        • I was thinking something similar recently. So many restaurants have 'smart' cash registers now, you can order before you get there, or even have it delivered. The IoT is here.
      • Re: (Score:2, Interesting)

        by gumbi west ( 610122 )

        The Internet of Things is something Bill Gates wrote about 20 years ago and it's about as close to reality as it was then. The real issue is that we need an embeddable computer that runs Windows (don't laugh, it's what people know) and costs about $0.05, maybe $0.25 is good enough, but I doubt it. Then We'll start to see the Internet of Things take off.

        I have literally zero things that are not internet enabled that I wish were internet enabled. If someone offered me an enabled and non-enabled device I'd tak

        • People use smartphones now, and almost none of them run Windows. I don't think Windows is a requirement for IoT.

          I do think some sort of use case is a requirement, and some form of standardization.

        • I remember the same sentiment expressed against camera-equipped cell phones. Once people had them in their hands, it turned out the realities of how much pocket-space people actually had played a crucial role. Face facts: One day your friend is going to impress you with a tale of how his fridge told his smartphone while he was at the grocery store that he's out of otter pops. You may not believe that now, but sooner or later your free time will come at a premium and you're going to wish you had all the

          • Supply management is an interesting application. But is it even close to happening? I'd say RFID might make it possible but I don't think you can check multiple RFIDs at once.

          • I might also mention that while I have a camera in my smart phones, I prefer my point and shoot or DSLR.

            While the current gen of phones do take pictures perhaps even better than the point and shoots of old they aren't really up to snuff relative to the current gen of point and shoots, the GoPro. Also, neither can touch the DSLR for image quality. But the DSLR is really heavy and expensive enough that you have to think about theft whenever you have it outside of the house, so it's a real pain.

        • I think it's really interesting how I'm moderated for this. 50% interesting 30% overrated and 20% troll. There is a lot of passion here about me being wrong.

          Or perhaps it's the /. revulsion to having Windows take over. Pretty bad, in my mind, but the only thing worse would be Andriod with its total lack of privacy controls.

          • by jp10558 ( 748604 )

            The problem with Android is that you don't get root on your own devices. People who do run Cyanogenmod can run a simple application permissions "firewall" which is somewhat like HIPS on Windows. It can block or return blank or fake data on anything you don't think the app needs to function for you. And from the reports I've heard, almost no apps crash or refuse to run when this is done.

            If we had actual control over our devices, we'd not have privacy issues.

            It's pretty ironic the supposed security we would g

      • ``The only people who care about the internet of things are the people trying to tell us how awesome the internet of things will be.''

        And telling us what backward, mouth-beathing Luddites everyone is who isn't racing to jump on the IoT fanboi bandwagon are.

      • The only people who care about the internet of things are the people trying to tell us how awesome the internet of things will be.

        You are sadly mistaken. There are a large bunch of people who care about the Internet of things because they recognize what a boon it will be to mining personal data for the corporations who get their stuff adopted first. The IoT is the smart TV which reports your viewing habits, and random videos of your living room (or wherever your TV is) to the company which made it (Samsung, and probably others). I am sure there are other such devices.

        • by dave420 ( 699308 )
          While that is partly true, you are forgetting the truly benevolent devices from trusted companies/organisations which can actually help people greatly, with no privacy cost. To ignore those is shooting yourself in the foot.
          • While that is partly true, you are forgetting the truly benevolent devices from trusted companies/organisations which can actually help people greatly, with no privacy cost. To ignore those is shooting yourself in the foot.

            I would agree with you, but even with your reminder I cannot think of any of those. In order to be "forgetting" them, I would have to be aware of them. So, would you care to enlighten me?

          • by jp10558 ( 748604 )

            the truly benevolent devices from trusted companies/organisations

            I don't think such a thing exists. And even if it does today, what about in 5 years? Think about sourceforge for instance...

  • Dice Holdings sucks the big hairy meatball.

  • So far, my "password killer" has been Google Authenticator and RSA SecurID on my Android phone. (I checked out of the Apple ecosystem when I cancelled cable but I'll bet they have the same things over there.) All my VPN connections and some of my web apps now use these.

  • I've been using various forms of bluetooth proximity to automatically lock workstation forever.

  • by Anonymous Coward

    I'm not looking forward to a world where computers are everywhere and in everything. It's bad enough every moron has a mobile phone stuck in their face whilst they walk. I don't want my stove talking to the fridge. I don't want reminders from the fridge the milk is low. I don't want my toaster sending illegal packets to Yahoo! and then getting blacklisted. No. Simply no.

    I want to use computers a tool when I want. I want to have to walk over to one like I do in my living room. I don't a world like Star Trek

    • by mlts ( 1038732 ) on Wednesday June 17, 2015 @11:40PM (#49934557)

      Of course, I am leery of the next step above this... having to wait for an ad to play on the fridge before I can open the door, having to pay the stove manufacturer $29.99 a month so I can use the self-cleaning settings, finding my faucet won't turn on because it lost connection with the cellular tower as the telco dropped GSM for pure LTE, getting fined by my HOA because the freezer detected more than the alloted moving things via its camera in the house, and so on.

      Then, there is the security nightmare. Think those IoT providers will pay more than lip service to ensuring their devices are not easy prey? Won't happen.

      Finally, there are the higher prices. I don't feel like paying hundreds of dollars for a thermostat, or thousands of dollars for a fridge because it is "smart". If I wanted to pay top dollar for a fridge, depending on availability, I would get a propane or natural gas fridge, so my stuff stays cold even if there is a power outage.

      • by khasim ( 1285 )

        Think those IoT providers will pay more than lip service to ensuring their devices are not easy prey? Won't happen.

        Won't happen because it cannot happen. There will be some manufacturers who go out of business. Where's the updates then?

        Not to mention the manufacturers dropping support for older models EVEN IF THEY STILL WORK. Gotta buy a new fridge because the old one isn't updated any more.

        Even if they do put the minimal effort in being better than "easy prey", how many times have we seen secret backdoors

        • by mlts ( 1038732 ) on Thursday June 18, 2015 @01:01AM (#49934837)

          If phone makers (and phones are not cheap items) in general won't provide updates for more than a version or two at most, then I doubt IoT device makers would provide much, if any, about updates.

          IMHO, the best thing about IoT is to just say no.

          There are ways to design IoT devices securely (for example, having them use a hardened, central hub that handles the communication through the Internet, so attacks on individual devices end up having to be physically local), but since IoT is such a "fad", security is at best an afterthought after the product design is rushed out the door, so I expect zero security whatsoever.

          • In reality, the hardened, central hub that shares the same hacked router credentials and NSA back door with the rest of my home.

            Nope - the answer is not there.

            IoT is the best known way to donate all your privacy to the lowest scum on earth - by which I mean all of them collectively, not the exact lowest - exactness will be missing.

          • by adolf ( 21054 )

            I already trust my home router as a hardened, central hub for everything else: Why not trust it to be an IoT hub as well?

  • DR TA

    I use a password manager (Acerose, Win), so know my passwords are correct, yet can't access my Hotmail account due to it being questioned. Hotmail's only use for me is to forward my e-mail from .com's I've used it on to my newer e-mail address at Gmail; so I don't mess with it, as it's working. This isn't the only site that's questioned my password, those requiring a new account.

    • DR TA

      This isn't the only site that's questioned my password, those requiring a new account.

      E-mails being sent to verify ones identity (sometimes) are sent to only one E-mail address, they don't allow forwarding nor POP3ing them as I normally do to get my e-mail (it's caused problems in the past, yet now I'm aware of it).

  • I'm feeling a little chipper!

  • I'm sure whatever they come up with will suck just as much as a password.

  • This is the right basic idea, I think, but I think everything will converge into a single device, either the mobile phone or a wearable. And as it becomes more and more central to everything we do, that device will become very smart about authentication.

    The problem with using dedicated embeddable devices is twofold. First, the more of them you have to carry, the more difficult it is to keep track of them. With old-fashioned metal keys we've solved this with the key ring... but that creates its own problem. The more keys you add to it, the more valuable it becomes. Loss or theft become increasingly more problematic. And our metal keys open fewer, and less important, things than our electronic authenticators do.

    So, it makes sense to combine the electronic keys in a single device, but then to use the capabilities it has that metal keys do not to solve the theft and loss problems. First, against loss, there must be a way of backing up all of the credentials, securely and automatically, so that in the event the device is lost they can all be recovered relatively easily. Some sort of remote server backup, to which you authenticate with some other mechanism that you protect very carefully (there are lots of options here, but a long, randomly-generated password printed out and stored in a safe place is a good option). That backup needs to be reliable and reliably accessible, but access need not be easy or convenient, since it should be rarely needed.

    What about theft? This is where the smart device has huge advantages over dumber devices, because it can authenticate the user. This authentication needn't be particularly strong, but it should have good anti brute-force protections, and it should be smart. The goal is to make something that is extremely convenient for the user, but makes it relatively unlikely that someone else who gets it can use it. How could that work? Google is pushing towards this vision with Android Smart Lock features. The core idea is that the device shouldn't rely on a single signal, because that signal then has to be very strong.

    It's worth looking at analogies with meatspace facilities that care a great deal about security. What they don't do is put a bank vault door on the exterior wall and rely on the strong combination lock to keep thieves out. Instead, they rely on layering of defenses, monitoring and active response.

    What can your phone do? Quite a bit, probably. Not only does it have a touchscreen for entering passwords, it also has cameras, an accelerometer, GPS, various radios, compass, altimeter, microphones, a proximity sensor and probably other stuff I'm forgetting. In addition, it can know a lot about your habits, your plans (e.g. what's on your calendar) and more. With that wealth of signals, it should be possible for the device to determine with relatively high certainty whether or not it is still in your possession. Where it's uncertain, it can fall back to asking for authentication with, say, a fingerprint or simple PIN to increase its certainty. Or in more extreme cases, it can fall back to an even stronger password. The idea is to make authentication as seamless, transparent and automatic as possible... but as strong as necessary.

    Or maybe a smart watch will be a better choice. It has pretty much all the same capabilities as a phone, but the advantage that you strap it to your body, making it harder to lose, and harder to steal. (Actually, I think over the next few years for many of us our phones will migrate onto our wrists; right now the smart watch is an extension of the phone, I think that will flip, with the handheld device becoming an extension of the watch providing a larger screen, aimable camera, etc.).

    The "as strong as necessary" bit is important here, too. When the phone is going to use a stored authentication key to unlock something for you, the degree of certainty that it needs to have that you're you depends on what it's unlocking. If I'm using my phone to log me into slashdot on my laptop, I really cou

    • I think you're quite a bit too optimistic about the future with respect to the watch taking over from the phone. Even without doing 99% of what the phone does, the watch's battery life varies from modest (typical Android Wear now) to downright miserable (Apple Watch and, in the early days, Moto 360).

      However, as a password killer my watch is already there. My phone is locked when it's more than about 15 feet from my Moto 360 smartwatch (and therefore, from me). I can still get into my phone easily, but oth
      • My laptop has a fingerprint scanner, but I have stopped using it because its faster to type the password in! - 8 characters, mixed case, with numerics. Because I type a lot, and scan my fingers rarely.

        Might be OK on a touch phone, where typing is a painful process. Mine doesn't have a fingerprint scanner, and AFAIK, none of the ones with removeable batteries and SD cards do, so it is not an issue I am likely to encounter.

        • You should probably invest in a better laptop, then. I type extremely fast -- the only person I know who types faster than me is my wife -- and good thing too, because my entire career is based around my creating and typing my own content.

          My laptop password is 11 characters and takes me somewhere between three-quarters of a second and a full second to type, from the moment my fingers reach the keyboard after having clicked in the password field. My fingerprint scanner takes somewhere between 0.25 and 0.5
    • by tom229 ( 1640685 )

      Actually, I think over the next few years for many of us our phones will migrate onto our wrists

      And this is the problem with the culture at Google these days. Ever since all employees started using macbooks and they only hired 20 something's with thick frame glasses and "nerd" t-shirts they've been on a steady decline into the toilet. This geek tech culture is a serious blight. You people are ruining a once magnificent company. Oh ya... And get off my lawn.

    • Gah, i am so disappointed in slashdot. comments like the parent are why i come here. Somebody who spends their time thinking about an interesting problem and is willing to share some of that background. Instead of discussion we get people complaining about ... anything.

      Anyway, thanks for the post. I like the way you are thinking and I love the idea of 'as secure as necessary'. I can see a future where my phone decides when it is still with me based on the myriad of data it collects (and helpfully share

  • Not sure what Apple Watch you've used, but if mine isn't on my wrist, I'm required to enter a numeric password if I want to see anything more than the watch face.

    It's even greater than 4 numbers, too.

    If it's on my wrist, the iPhone needs to be unlocked at which point the watch is unlocked as well.

  • anyone else have one of those cars that lets people steal items from your car while your in the store because the doors don't lock while your in range?

  • by hawguy ( 1600213 ) on Thursday June 18, 2015 @01:35AM (#49934933)

    I remember when the iButton (and the Java ring with a java iButton embedded in the ring) came out, *that* was going to eliminate passwords - just hold your ring up to the iButton reader on your door, your computer, or any thing you want to secure. Passwords are a thing of the past when you have your iButton.

    It's only been 17 years, so I'm sure we'll start seeing the readers built in to computers any day now.

    https://en.wikipedia.org/wiki/... [wikipedia.org]

    • by adolf ( 21054 )

      I remember when iButtons came out a million years ago, and I've actually used them. Motorola likes to use them for some of their dispatch consoles and radios for licensing software features, and in some cases as keys to access particular radio systems.

      And that's...it, although they do function in those roles rather well.

      • by Lumpy ( 12016 )

        They were used heavily for door access in many places. they work great. I still have a few ibuttons and the dev kit around. And I have the good ones that run java and have a RTC inside them, so you never send the keys in the clear but you instead do a challenge response incredibly high security in those, but very few places used them. Most of the ibutton door locks simply used the serial number if the ibutton as the key.

        The US postal service used them for a while as identifiers on tubs until optical re

  • ... tying something you physically possess to identification, but it should never be used standalone. A password, pass-phrase, or even a pin should still be required, because anything else can always potentially be taken from you, or worse yet... compromised. The additional factor of having some physical device that can further confirm your identity gives an added layer of security over the password by itself that can still be beneficial, but it should never be trusted to the exclusion of a password.
  • You know how old-media companies always go on about how copying media is somehow "theft", even though we all know it's not?
    Well, the problem with digital authentication keys is similar; it can get copied without you losing anything.
    Attaching authentication to a physical item that actually CAN get stolen changes the game dramatically.
    It's a single point of failure that will give a false sense of security.

  • ... was just used to login to /.
  • Would be fun to observe people waving their hands in complex patterns detected by a built-in watch motion sensor to unlock things. The watch could even play a little tune to help synchronize arm movement to a beat. It would be easy to steel people's password though, if you got a good sense of rhythm and dance. Ok, this was meant as a bit of a joke. But the fun thing is we would probably get used to it, just like we got used to people talking to themselves on the street.

    On a somewhat more serious note, authe

    • Would be fun to observe people waving their hands in complex patterns detected by a built-in watch motion sensor to unlock things.

      Wow, I think you just implemented wizard spells with a somatic component. Add in voice recognition and the need to have your phone with you, and you've got verbal and material components too.

  • Fuck you and your pointless buzzword.
  • It will be a cold day in hell when I use a cloud based authentication scheme to access my own shit. I'm not going to use a system where I have to ask someone else permission to use my shit. Anyone that does is eventually going to get what they deserve.

  • "Well, as anyone who's ever unlocked car door just by reaching for its handle with a key in their pocket knows, the answer may be the embeddable devices themselves."

    BMW cars without this are secure and not easily stolen. BMW cars with "comfort access" are easily stolen.
    Same with GM, Toyota, etc...

    Nope, I am not trading security for convenience.

    • by tom229 ( 1640685 )
      I'm not sure about this claim. Whether it's a traditional key or a proximity key it still falls in the "something you have" category of security. And while I admit I don't know exactly how the proximity keys work I do know that if they use an rsa handshake then they're certainly more secure, than a laser cut key.
      • by Lumpy ( 12016 )

        http://www.networkworld.com/ar... [networkworld.com]

        You are not cracking the rolling code in the physical key chip on a car easily or for $17.00

        Before you are unsure on claims, you should read up on the subject with google.

        • by tom229 ( 1640685 )

          some sophisticated thieves have laptops equipped with a radio transmitter" and use brute force attacks to find the correct and unique code of a car's key fob.

          Thanks for the info. This definitely seems like poor design rather than a broken concept though. I'd like to see them brute force a 2048 bit RSA key. Wireless authentication protocols have the ability to be just as secure as anything else.

  • Two factor secuirty : Something you know, Something you have, Something you are - Pick two

    Something you know : Password
    Something you have : Device, RFID etc
    Something you are : Biomentrics

    using only one is a bad idea

    Also known as Something you forget, something you lose, something cease to be ....

  • There is so much wrong with this article its not even funny. I don't blame the writer, he's just trying to tie a nice neat bow on a badly wrapped pig.

    I had to laugh though when he twice gives the example of proximity unlock on cars as IOT security. These are the same devices that only guarantee proximity security by using signal strength and thus are easily defeated by a $17 signal booster available on eBay, which has been in the news as the cause of many thefts of the contents of vehicles.

    By seriously the

"How many teamsters does it take to screw in a light bulb?" "FIFTEEN!! YOU GOT A PROBLEM WITH THAT?"

Working...