Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
BLACK FRIDAY DEAL: Trust the World's Fastest VPN with Your Internet Security & Freedom--A Lifetime Subscription of PureVPN at $48 with coupon code "BFRIDAY20" ×
Businesses Security

Why Are We Still Using Passwords? (securityledger.com) 209

Here's some surprising news from the Akamia Edge conference. chicksdaddy writes: [E]xecutives at some of the U.S.'s leading corporations agreed that the much maligned password won't be abandoned any time soon, even as data breaches and follow-on attacks make passwords more susceptible than ever to abuse, the Security Ledger reports. "We reached the end of needing passwords maybe seven years ago, but we still use them," said Steve Winterfeld, Director of Cybersecurity, at clothing retailer Nordstrom. "They're still the primary layer of defense."

"It's hard to kill them," noted Shalini Mayor, who is a Senior Director at Visa Inc. "The question is what to replace them with." This, even though the cost of using passwords is high and getting higher, as sophisticated attacks attempt to compromise legitimate accounts using so-called "credential stuffing" techniques, which use automated password guessing attacks against web-based applications... Stronger and more reliable alternatives to passwords already exist, but the obstacles to using them are often prohibitive. Shalani Mayor said Visa is "looking at" biometric technologies like Apple's TouchID as a tool for making payments securely. Such technologies -- from fingerprint scans to facial and retinal scans -- promise more secure and reliable factors than alphanumeric passwords, the executives agreed. But customers often resist the technologies or find them error prone or too difficult to use.

This discussion has been archived. No new comments can be posted.

Why Are We Still Using Passwords?

Comments Filter:
  • by Anonymous Coward on Saturday October 21, 2017 @11:38AM (#55409753)

    Biometrics are not more secure than passwords - theyâ(TM)re less secure but sufficiently more convenient that you can convince people to use them.

    We still use passwords because theyâ(TM)re still the most secure way of authenticating your identity when combined with a second factor.

    • by goombah99 ( 560566 ) on Saturday October 21, 2017 @12:13PM (#55409885)

      think of them as a mutable biometric. it's biometric because its stored in your brain. It's mutable because you can change it. it can't actually be stolen from you if you don't give it up or write it down.

      it's only when you go to transmit it that the problem occurs.

      When you look at this this way, then you see that things like finger prints or retina have the same problems and worse. they are not mutable, they can be taken from you without you knowing it, and the transmission layer is still vulnerable

      Nearly always, your first solution to a problem is the best one. Not always of course or there would be no need to research and study. But people have been using passwords for milennia because they are an effective tool that works from giving something to the sentry, to logging into google.

      • by swschrad ( 312009 ) on Saturday October 21, 2017 @01:00PM (#55410093) Homepage Journal

        accident damage, surgery, degredation of the eye are some of the ways you can be locked out of a biometric identifier. as the population ages, this is an issue that you need to think about. I will not use bios for this reason, as for some reason, I am not getting younger and more invulnerable.

        • The gradual change of your biometrics over time is the least problematical of the issues with biometrics. While this is annoying it is easy to fix by rescanning the information after first proving who you are by some other, manual, means.

          The problem with biometrics is that if my information gets hacked the only way I can change it is via surgery and I'm simply not willing to have eye surgery to change my iris if my iris pattern is hacked when I can change a password simply by thinking of a new one.
      • by lhowaf ( 3348065 )
        I prefer passwords, too, but they can be taken from you without your knowledge. The problem is passwords (or hashes) are stored at the places you authenticate. Even when you use unique passwords, there is a potential breach for each site/authentication pair and there's nothing you can do about that. That said, the point about biometrics not being mutable while still being vulnerable to loss is key.
        • The problem is passwords (or hashes) are stored at the places you authenticate.

          You say that like storing the password and storing the hash are somehow equivalent. They are completely different. Passwords should never be stored. But storing salted hashes is standard practice, and is secure for modern hashes, especially when combined with limited attempts and credential verification.

        • by Altrag ( 195300 )

          Biometrics have the same problem. Once your face scan is taken, its just a bunch of ones and zeros same as your password is, and is subject to all of the same storage and security requirements in order to keep it safe.

          And most importantly, it wouldn't be excessively hard to create a dummy device that emulates the biometric scanner's output once you know the expected input data.

      • When you look at this this way, then you see that things like finger prints or retina have the same problems and worse. they are not mutable, they can be taken from you without you knowing it, and the transmission layer is still vulnerable

        Mutability doesn't matter for biometrics, and neither does the fact that copies can be taken without your knowledge, because those don't affect the biometric security model. I wrote a detailed analysis here: http://divegeekstuff.blogspot.... [blogspot.com]

    • by nitehawk214 ( 222219 ) on Saturday October 21, 2017 @12:32PM (#55409967)

      Like passwords with unicode in them. Impossible to share via Slashdot.

    • by fahrbot-bot ( 874524 ) on Saturday October 21, 2017 @01:16PM (#55410169)

      Biometrics are not more secure than passwords - they're less secure but sufficiently more convenient that you can convince people to use them.

      A fingerprint is more convenient until the moment you get a blister (or some other damage) on your finger(s), then you're locked out. Seems unlikely? When I got a job at the NASA LaRC way, way back, I had to get fingerprinted, but couldn't because I had been working on my car that week and my hands and fingers were all beat up. I had to wait a week for them to clear up enough to get processed.

      • A fingerprint is more convenient until the moment you get a blister (or some other damage) on your finger(s), then you're locked out.

        Every biometric system I use has a password fallback. The biometric is only for convenience.

      • "When I got a job at the NASA LaRC way, way back, I had to get fingerprinted, but couldn't because I had been working on my car that week and my hands and fingers were all beat up. I had to wait a week for them to clear up enough to get processed."

        Or you could be in the unfortunate position my wife constantly finds herself in when faced with biometric demands for fingerprints (primarily immigration/visa issues) - her fingerprints are so light that most systems simply can't pick them up. (She can't use iphon

    • by rastos1 ( 601318 )

      Biometrics are not more secure than passwords ...

      I thought biometrics also serves a different purpose - identification, rather than authentication.

      • I thought biometrics also serves a different purpose - identification, rather than authentication.

        My laptop uses it for both. My fingerprint authenticates me and gives me access. It also identifies me, so it opens the right account. If my wife puts her fingerprint on the scanner instead, it opens her account.

        My bank uses it only for identification. I still need to show an ID or enter a PIN for most transactions.

    • We still use passwords because theyâ(TM)re still the most secure way of authenticating your identity when combined with a second factor.

      About a decade ago, Etrade sent me a small free keychain about the size of a stick of gum (1cm x 4cm x 1/2cm). It had a small digital display that had a password that changed every 60 seconds and was somehow synced with etrade's webserver. Even without a secondary password, this is a very secure system. It's not connected to the internet and you would likely know immediately if it was stolen. It ran on a single watch battery for over a year. It likely only cost a couple dollars to produce. The technol

      • No one tell this guy about RSA
        • No one tell this guy about RSA

          Yes, it was manufactured by RSA. That's not really the point. The point is that it has existed for a decade, it doesn't require an internet connection, and they are cheap to produce. There are even free versions today that use an app on your phone. Noone wants to use them. Most people would prefer to either use the same password everywhere or to have all their passwords memorized so if someone steals your phone they automatically have all your passwords too. People don't care about security until afte

    • Perhaps I have to use a touch pad that punctures my finger and takes a blood sample. It will check the dna of my sample, and if it matches what is on file, I will be able to log into the system. Perhaps, in lieu of the blood sample, a saliva sample would suffice. Blow into a straw and if the dna matches, voila-- access.

  • by Anonymous Coward on Saturday October 21, 2017 @11:41AM (#55409763)

    If I ever get arrested or stopped at the airport, my phone could be unlocked by forcing my finger on the button or scanning my face(iPhone X). So without a password, biometrics can trivially compromise your security against state/pseudostate actors when they have physical access to you. At least with a passcode they have to observe some sort of due process to coerce you.

    • by goombah99 ( 560566 ) on Saturday October 21, 2017 @12:17PM (#55409907)

      people who post to slashdot from iphones and such get all of their apostrophes turned into å(TM)t â(TM)t

      THis is 2017, it's possible to parse plain text and unicode correctly now I have read.

    • I've never heard of a pipe wrench referred to as "due process" before.

      • I've never heard of a pipe wrench referred to as "due process" before.

        Quite correct. For it to count as "due process" it has to not leave a mark. Something like waterboarding for example.

    • So do not use your finger or face to log into your phone?

      Fucking mindblowing I know
    • How do you propose to log into a website with your fingerprint? Put it on the reader and send it to the website? Unencrypted? Oh Oh now instead of just a password compromised, if it is intercepted, your fingerprint is out there for anyone to use
      And what makes you think the websites will be any more diligent about safeguarding your fingerprint (or the encrypted version thereof) than they are about safeguarding your password (or an encrypted version thereof)?

      Using biometrics as a 'login' device is an insanely

      • by dmr001 ( 103373 )
        I have plenty of apps on my phone that are essentially websites, that, one I verify my identification by other means (like my password and some other factor like my pre-registered IMEI number or out of band code sent to me) let me log in with my fingerprint. Which isn't transmitted; the phone has an API that tells the app my fingerprint was recognized.

        This includes my bank, investment firms, and hospital (that's the one keyed to my specific phone).

  • by Jamlad ( 3436419 ) on Saturday October 21, 2017 @11:42AM (#55409765)
    because as everyone with half a brain realizes that biometrics are a fucktarded method of authentication. A keyword gets exposed, fine. Change it. Your fingerprint gets exposed? How are you going to revise that?

    The best method of authentication, as far I I've experienced, is a physical token (keycard). Worst case scenario, I don't notice it's missing after two days (Friday evening till Monday morning). Chances are I've dropped in a city centre rather than haven it exploited by an unknown agency. Even still, they;ve only got the physical credentials of a low-tier employee. On-site physical access is still required.

    • by Greyfox ( 87712 )
      Yeah, I worked at a company where you just stuck your card into whatever computer you sat down at and it would find your session out on the network and bring it to that computer. You still used a password to unlock the session, though. Without the card, your password was useless. Without your password, the card was useless. They also didn't have the fucktarded password requirements that most companies do, so you could use a passphrase, which can be significantly easier to remember and more secure than the u
    • by djinn6 ( 1868030 )
      What about a physical token with password or pin entered on the token itself, which then signs a message using its private key? The attacker would need to both observe you using that token and obtain the token itself.
  • by Anonymous Coward

    "We reached the end of needing passwords maybe seven years ago" - "The question is what to replace them with."

    qed

  • You are right of course to distrust your own mind; it has a bias for convenience. But someone gives you a thing like a crypto token and tells you to entrust your deepest secrets, perhaps even to imbue the artifact with your personal authority.

    Should you trust that thing so much, keeping mind that in effect means trusting everyone involved in its programming and provisioning?

    I foresee passwords remaining useful and indeed essential, despite their obvious limitations, as part of two factor authentication.

  • by elainerd ( 94528 ) on Saturday October 21, 2017 @11:57AM (#55409801) Homepage

    Clearly we need to replace passwords with a chip or mark or tattoo in the palms of the hands and on the foreheads / retinas, etc. Then we need to make sure that people can't buy or sell without taking these marks on themselves. Naturally cash will have to be eliminated. This way we can control and identify what the people spend their money on and we can use this information to further oppress and bind them down into abject bondage and suffering. Yep, that's the ticket. No more anonymity, all must bow down and accept the will of Evil. Every citizen a slave.

      "A jackboot stamping on a human face forever"-Orwell or Huxley, i forget and am too lazy to search.

    • We live in both Huxley and Orwell's worlds at the same time.

      http://www.zerohedge.com/sites... [zerohedge.com]

    • by Ol Olsoc ( 1175323 ) on Saturday October 21, 2017 @01:09PM (#55410133)

      Clearly we need to replace passwords with a chip or mark or tattoo in the palms of the hands and on the foreheads / retinas, etc. Then we need to make sure that people can't buy or sell without taking these marks on themselves. Naturally cash will have to be eliminated. This way we can control and identify what the people spend their money on and we can use this information to further oppress and bind them down into abject bondage and suffering. Yep, that's the ticket. No more anonymity, all must bow down and accept the will of Evil. Every citizen a slave.

      I had no idea that Pat Robertson was on Slashdot! You forgot the part where God will fix this problem if we just get rid of all the "homos".

    • Good post. I have a small critique, though.

      You forgot to think of the children.

  • by Anonymous Coward on Saturday October 21, 2017 @12:02PM (#55409837)

    We use passwords because it's something you know AND SOMETHING YOU CAN CHANGE WHEN COMPROMISED.

    You cannot change your fingerprints or other biometric data so when it's compromised or when technology advances in a way which allows the biometric sensors to be fooled then you are completely and totally stuffed. :-(

    Do the people proposing this ever have _ANY_ real world experience at all ?

    Oh, and yes, using biometric data allows intelligence agencies, who will likely be able to obtain that information in various ways, to pretend to be you when they want to compromise systems you control.

    • You cannot change your fingerprints or other biometric data so when it's compromised

      This is irrelevant. I wrote a detailed explanation here: http://divegeekstuff.blogspot.... [blogspot.com]

      Do the people proposing this ever have _ANY_ real world experience at all?

      I do, about 30 years' worth, in both physical and information security.

  • by jfdavis668 ( 1414919 ) on Saturday October 21, 2017 @12:04PM (#55409845)
    Instead of breaking in and stealing passwords, break in and steal all the biometric files. Your fingerprint may be unique, but to identify you I have to have a copy. If someone steals that copy, you are now compromised in a way you can't correct. You can't change your fingerprint every 60 days.
    • To be fair, according to Apple, the probability that someone's else fingerprint fits yours is 1 / 10000, based on current software / technology Apple is using ; that's far from being unique. Besides, I do agree on your concern - and fingerprint is not even the worse biometric data (since it requires contact).
    • I suppose you could prefix a pin or password to the biometric data which, when hashed, creates a unique signature.

      But then it takes us right back to square one in requiring a variable password or pin to begin with, so what would be the point.

      Is a trade off I guess.

      Passwords are easier to compromise, but also easier to change. Biometrics, not so much.

  • While other solutions may be more effective at preventing misuse by third parties, you are not required to give your password to law enforcement without reasonable cause.

    Their simply demanding it is not " reasonable cause ".

    Whereas your biometric ID is fair game. They can, and have, walked into an establishment and forced everyone who used biometric fingerprints to unlock their phones to do so. You have no recourse.

    I'll keep my passwords until they fix the other problem thanks.

    • They can, and have, walked into an establishment and forced everyone who used biometric fingerprints to unlock their phones to do so. You have no recourse.

      Citation needed. That sounds ultra-paranoid.

    • by tepples ( 727027 )

      They can, and have, walked into an establishment and forced everyone who used biometric fingerprints to unlock their phones to do so.

      What's the difference between that and "enter your password while I look away"?

  • because.. (Score:5, Informative)

    by epyT-R ( 613989 ) on Saturday October 21, 2017 @12:08PM (#55409859)

    1. They aren't tied to biometrics, which once compromised, aren't easily changed. Plus, many people find it instinctively invasive, possibly because of that reason. In contrast, passwords/x509 are easily changed when when compromised or forgotten.

    2. Biometrics work as authenticators but not as authorizers.. Nothing stops someone from duplicating your biometric properties (pic of your fingerprints or irises/face) without your authorization. Not so with a password.

  • Algorithms to validate, store and process passwords have been around a LONG time. Best practices are well known, and are relatively simple. You can build a password-based access control system using off the shelf libraries and known patterns that is very difficult, if not impossible, to bypass. The limiting factor to it's success is human fallibility.

    Nearly everything else is complicated, involves a lot of math that not a lot of people understand, or third party hardware you might not trust, or third party

  • Just support devices like Yubikeys everywhere. Done.

    This is what I use for Google/Gmail, Facebook, Github, and anything that requires SSH access. No more passwords. Just a physical device with a simple pin code.

  • The answers (Score:5, Interesting)

    by Okian Warrior ( 537106 ) on Saturday October 21, 2017 @12:13PM (#55409883) Homepage Journal

    The answers are pretty obvious.

    Firstly, we still use them because there's no reasonable replacement. Duh.

    Secondly, there's no reasonable replacement because of the way our computers work.

    Passwords are essentially information held in a system outside the computer (your head), that can be used for verification. The problem is that humans aren't really good at remembering passwords, and we need so many of them, and they are infrequently needed.

    All attempts at using computers to solve this issue have run afoul of the "general purpose computer" problem: because our computers do not address security properly, we cannot guarantee what software is running on the local hardware. We cannot guarantee the security of passwords held on the computer, or in an encrypted file, because it's so easy to download and run malware. No one keeps track of all the things run on the computer, and we can't even trust the people who supposedly *do* keep track.

    One reasonable solution is to use hardware specific to the purpose that's *not* a general purpose computer.

    If you had a piece of hardware - a thumb drive, for example - that was *not* general purpose and could not download and execute code, then that could be made pretty secure. It could hold a person's private key, have functions to encrypt, decrypt, and sign documents, and also pass out the public key. It could also download and install new keys, with the understanding that the base functions could not be changed.

    There's some details involved: you need a way to securely backup the data, and you need a way to securely recover the data in various situations. Mostly, you need to save the data somewhere safe and write down a master password (one, a PIN of sorts) somewhere else.

    The Mooltipass [themooltipass.com] is pretty close. It generates strong passwords for each web site registration, and will fill in the fields for you when you go to log in.

    That's not the complete solution, however. It should *encrypt* the password with the user's private key and the site's public key so that no one can view it(*), or even better use a zero-knowledge authentication process.

    If we could somehow begin using a fixed-program computer - say, something the size of a credit-card calculator that requires a pin and that holds the information for *all* the cards in your wallet - we could get away from passwords.

    We would also have a single point on which we could put *all* our effort to make secure.

    Hypothetically, that one card would reduce credit card fraud to near zero. When you use the card you enter your PIN on the keypad, and the card generates a ShopSafe number tied to your credit account, valid for one purchase.

    Take a look at the badges at high-tech conferences these days. It seems like the hardware shouldn't be that hard or expensive.

    Could this be the next killer product from Apple? A hand-held thingy that's secure and ultra-convenient, that you use for payments (IRL and online) and password entry?

    (*) Yes, ssh is not absolutely secure. Did you think all those cert authorities in your browser have been properly vetted?

    • I don't like the hardware answer to this problem. It's fraught with issues. The biggest one, which I encountered personally, is what happens when your device is irrecoverably lost. Or in my case, my phone number was lost. I could not get the same phone number, I had to get a new one, and it made fixing sites I had doing 2FA via SMS to my phone number a real bitch to recover. Took many emails and a sob story to get 2FA stripped from my account so I could get back in.

      This is a serious problem. If Google

    • by Kjella ( 173770 )

      Except that a dongle is equally unreliable at telling you what you're agreeing to, which is pretty essential to signing otherwise it's purely an authorization token.

  • Such technologies -- from fingerprint scans to facial and retinal scans -- promise more secure and reliable factors than alphanumeric passwords, the executives agreed.

    No, no no, my god, no. Something that can be acquired just by looking at you is not secure. Using as authentication something that can only be changed by destructive surgery is not sane.

  • The article answers its own question. Why do we still use passwords? and then tells us, of the alternatives,

    the obstacles to using them are often prohibitive

    Which makes the article rather pointless.

    However it misses out a vital aspect. No matter what technology replaces passwords, it will get hacked, faked, or discovered. One day. And that means that whatever security measure is in place, it must be changeable by the user, just like passwords are.

    So that rules out all the biometric options, if they were only to be used on their own. Consequently, wha

  • There is nothing wrong with passwords as a first line of authorization, but if it's all you're using then you really deserve to be hacked. In 2017 it's no longer acceptable to have a single factor of authentication to a system, especially with the prevalence of TOTP and Hardware key, such as YubiKey.

    When trying to secure servers, if you don't have 2FA+ enabled, then you should be fired and blacklisted!
    • by tepples ( 727027 )

      In 2017 it's no longer acceptable to have a single factor of authentication to a system, especially with the prevalence of TOTP and Hardware key, such as YubiKey.

      Which is why I find reliance by Google and Twitter on SMS as the primary second factor, with TOTP and YubiKey relegated to backup second factors, to be unacceptable. What would you recommend for working around this unacceptable situation?

  • Here is a thought. How about multipurpose disposable personal authentication devices.

    Think of TouchID. They key thing about TouchID is that the biometric authentication is "on device". So if you decoupled the TouchID from the iPhone, and developed a token that could use generate a one time passphrase that you use to login to any website, that would mean an attacker needs physical proximity to you to steal your logins. Goodbye Russian hackers.

    Single point of failure yes, but also single point of hardening.

    • by Average ( 648 )

      Welcome to the world of FIDO U2F (fidoalliance.org). The best-selling U2F device these days (the YubiKey line... note that FIDO U2F is only one mode those work in) does not do biometric authentication before responding with one-time public-key-based security, but there are more expensive U2F devices out there already that do local biometric unlock.

      • I'd suggest googling yubikey weakness and looking at the bug list before trusting one. Or any hardware/software device you don't really control the innards of.
      • It would be nice to see a device that combines the features of YuiKey 4 Nano with Kensington VeriMark. My fingerprint wouldn't get stolen, because it wouldn't leave the device, but the device wouldn't provide authentication without both my fingerprint and a password. I suppose a little more security in public places could be added by the device also requiring the presence of an RFID keyfob I'm not seen to be using.
  • Because all the big sites wanted to be OpenID providers but not to accept logins from elsewhere.

  • Why a 4 digit pin code is considerd secure?

    Passwords for something you care enough about to protect are only the start. Businesses have been using TFA either Secure ID or via text for years.

  • Biometrics make horrible passwords. They are way too easy to steal and copy. Two factor makes more sense, but it is still a password. I suggest a many-factor system.

    What we do in real life is use a combination of multiple different methods. It's not just the way your face looks, but the location, clothing, and voice.

    A complex system that combines multiple methods, assigns a percent sure of identity might work. It could include a simple password (six characters), that must be typed on live video (incre

  • It's Akamai, not Akamia.

  • Alas, as of this moment, the one place you can put something that NO ONE else can get it is in your mind. This is the ultimate safe.

    This is why passwords remain the preferred authentication method. Because it feels secure, your mind is the only place the key exists. As soon as you move that key out of a person's mind and into a device, or biometric, it's no longer in the best safe in the world. Your mind. It's a very important semantic. People feel passwords are safe because they're stored in the best

  • Fingerprints are easily forged. The excellent paper http://web.mit.edu/6.857/OldSt... [mit.edu] covered the issue 15 years ago and remains valid with even the best modern fingerprint scanners.

  • A person determined to use passwords in a sane way (every password unique, with 60+ bits of true entropy) enjoys at least a modicum of confidence that the password implementation itself is simple enough to actually work as implied.

    I'm about fifty years away from believing than any biometric security solution can be trusted without inspection (we still need some astounding advances in proof-of-correctness technology).

    And I don't really feel like reading all that code, anyway. Theo and his crowd probably won

  • by QuietLagoon ( 813062 ) on Saturday October 21, 2017 @01:24PM (#55410197)
    Bingo! Biometrics suck. How do you change your fingerprints, or your eye's iris?
    • How do you change your fingerprints, or your eye's iris?

      They do it in movies and anime all the time.

    • Bingo! Biometrics suck. How do you change your fingerprints, or your eye's iris?

      This is irrelevant. Your erroneous argument arises from the mistaken application of the secrecy-based security model of passwords to the acquisition process-based security model of biometrics. I explained at length here: http://divegeekstuff.blogspot.... [blogspot.com]

  • There are three factors for authentication. Something you know, something you have and something you are.

    Why would we give up one in favour of another when we could adopt the radical idea of using TWO AT ONCE.

  • They're unique, but stay the same between uses. So if someone manages to copy it when you use it, they can use the copy in the future to pose as you.

    Fortunately, that means they have the same solution as credit cards. Chip and pin works by you remembering a PIN (like how you remember a password). You enter the PIN into an authorized device, and that allows the device to query the chip. The chip then establishes a secure link to the processing site. Intercepting that session's communications doesn't
  • It has been shown, time and again, that biometrics can be beat (and are beat) by relatively low-tech approaches - sometimes very low-tech approaches. And, to add insult to injury, once compromised, biometrics cannot easily be revoked, if at all. Use biometrics at your own peril.
  • You can change your password, but you canâ(TM)t change your fingerprint.

    Aside from all the low tech ways to defeat biometrics (gummy bears anyone?), the simple issue is if your biometric information gets compromised, youâ(TM)re toast.

  • Start using Biometrics AND Public Keys. Multi Factor is always better than single factor. PKI can be convenient if the syustems are in place to use them. Imagine world where you use your fingerprint and a Public Key to get access. THen you can generate public keys for every transation you make. Finger print to prove you are present, the system sends a message signed with the key you gave it, you decrypt using your private key and send a reply back with the random data in the message (signed with their pub
  • Why can so many people, even people "in the industry" not understand the difference between Identification and Authorization.

    Biometrics is a good form of Identification, it's hard to lose your fingerprint or your retina (it can happen but it's not common in everyday life). You can't forget them at home, your spouse can't take yours with them by mistake, etc. A biometric ID/Authorization system can be excellent, near perfect if fact, at identifying you as you but it has no ability to handle the situation whe

  • Because (Score:5, Insightful)

    by markdavis ( 642305 ) on Saturday October 21, 2017 @04:21PM (#55410773)

    >"Why Are We Still Using Passwords? "

    Because they are cheap, generally convenient, proven, and understood. Passwords actually work quite well *IF* they are managed correctly. And despite the summary, dictionary attacks are generally useless when servers are configured correctly.

    For high security, when necessary, combining a password with a token of some sort is extremely effective.

  • Now fuck off trying to fool people into making your job easier.

  • They only authenticate you to the machine reading you. I can't use biometrics on line unless the machine reading me is already trusted. So how does a bank trust the finger print scanner?

    A secret is always going to be the best security. However, how knowledge of the secret is verified can can be improved in a lot of ways.
  • And for most of us a fairly permanent one at that.

    What an absolutely asinine statement by "the executives".

  • The question posted is: Why Are We Still Using Passwords?

    The answer is provided in the summary: Stronger and more reliable alternatives to passwords already exist, but the obstacles to using them are often prohibitive

    Nothing more to say.

  • A password provides you legal protection from being (legally) forced to divulge it, not so with biometrics or hardware authentication dongles.

    Multifactor is always better, but a key component of that has to be something hidden in your mind.

  • https://ask.slashdot.org/story... [slashdot.org]
    https://it.slashdot.org/story/... [slashdot.org]
    Let's re-hash the same old crap and get advertising revenue, yay.
  • Until the biometric device is talking directly without any middlemen (like the vendor or the internet) to the payment people, it is inherently less secure. Because at all the points between, it's just a digital password, and one that is (a) reused between sites and (b) unable to be changed.

If you're not careful, you're going to catch something.

Working...