The first computer password was assigned in 1961. Ever since then, passwords have been the bane of computer users’ existence. They’re aggravating, and cause no small amount of headaches.
Despite being used to secure our digital lives, in reality, passwords are anything but secure. Part of the reason for this is, passwords only work when people can recall them. But the easier it is to recall any given password, the easier it is for others to guess at it, and take over an account, or computer, or whatever.
The password pxftVT^Rq#@CMT+G$|T3r*ZtKsSc3EHu might be unguessable — and all but unbreakable — but good luck ever typing that into anything. This is why people rely heavily on too-frequently-used passwords like (yes!) password, or the not-really-any-better P@ssw0rd, or slightly-more-secure-but-not-really-very-good Rover (i.e. one’s dog’s name), or not-any-better-than-that icecream.
Another way of putting it is, the more secure and unbreakable a password is, the less practical it is to use, as a password.
A solution to this problem is to require more than just a password, to gain access to something. The idea is to rely on something you know (i.e. username and password), along with something you have (smartphone app, hardware token, etc.), and/or something you are (fingerprint, facial features, etc.).
This is called “multi-factor authentication” (or MFA) since it requires multiple challenges in order to gain entry. A common form of this is “two-factor authentication” (or 2FA). Typically the two factors, in this scenario, are 1) a combination of username and password; and 2) an additional code or response of some kind.
Here are a couple examples:
These are common authentication scenarios. I expect you’re familiar with one or the other, or both, of them, as it is.
Both of these scenarios sound good. They both call for some form of authentication beyond just a username and password. You might assume they’re both as secure as could be.
But, you’d be wrong about that! In John Doe’s case, for crooks with the resources to pull it off (which is nowhere near as uncommon as you’re probably thinking), it’s possible for them to either SIM-jack his phone number and thus get his texts, or gain the assistance of someone at his cellular phone company and collect it that way.
In Jane Doe’s case, all someone needs is to grab her phone and login to GiantStore right on it; the approval will go to the app already on the phone; then, boom! the thief is in.
There are, of course, added protections that can be had. For instance, the LockMyStuff authentication app that Jane uses, might require entering the phone’s PIN or Jane’s fingerprint in order to approve anything. Most authentication apps can do something like this, so that makes them more secure — and thus a better option — than text (or SMS, “short messaging service”) to a cell phone.
Jane Doe’s authentication app is a software version of what is otherwise known as a hardware key. There is a wide range of these. They’re also not new, at all.
Among the older types of this, that some might be familiar with, are small token-number generators (such as the RSA SecureID). These are small devices, about the size of a USB stick, that have an LCD display. They’re programmed to generate a new code, with the passage of an interval (say, every minute, or every 5 minutes). These codes are based on its internal clock and a unique key and “seed” in each token. Both of these are aligned with someone’s account, so at any given time, the service being accessed will know what code is being displayed on the device.
Other types of tokens generate a long secure key which can be transmitted when touched, usually when inserted into a USB port, but it also might happen over Bluetooth, NFC (“near-field communication”), etc. This key matches algorithmically with someone’s credential as well as a “seed” in the device. Sending the correct sequence allows access.
These have the same problem Jane has with her smartphone app, though; they can be stolen. However, these devices can be reported as stolen; after that, the service being accessed will not accept their codes or keys any longer.
Yet another form of added authentication are biometrics. Someone’s fingerprint, or facial features, or retina pattern, can become a unique identifier that’s coupled with his/her username and password.
Some Windows computers support a feature called “Windows Hello.” It connects with a domain account (in the business world) or a Microsoft Online account (in the consumer/home world) to allow someone to login with a PIN, or his/her face (via a webcam with sufficient specifications), or fingerprint (if computer has a fingerprint reader). Not just anyone can walk up to a computer set up this way, and log in.
Most smartphones now allow logins via facial recognition and/or a fingerprint pattern. Not only can you login to the device that way, you can use fingerprints, facial recognition, etc. to login to accounts and services.
One might think this is unassailably secure, but … guess again! Once one has signed into a device or service, even with a hardware key or a biometric check, a record of that authentication is generated, and a secure session token (or sequence of data) that essentially says, “This session is approved, and active.” This is typically saved somewhere on the computer or device. Depending on the service being accessed, sometimes all it takes is to copy this token to another computer, and access to the device or service is granted. (This is one form of something called a “replay attack”).
That isn’t the point of any of this! I’m not telling you the situation is hopeless and that all of your computers, and online accounts and services, are going to be hacked or have already been hacked. That’s not the case at all.
What I am telling you is that the old rule of “the more, the merrier” applies to cybersecurity. The more checks and challenges are in place to gain access to devices or services, the more secure they can be. Is it possible for “the Bad Guys” on the Internet to guess your password? Absolutely it is. Is it possible for them to circumvent any given additional challenge method provided by mult-factor authentication? Yes, it is. Is it possible for even the most secure setup to be breached? Yes, it is.
But … the more challenges are in place along the way to accessing anything, the more likely it is that you’ll stop any given cybercrook. Criminals tend to look for easy targets; that’s as true in the cyber world as it is in the physical world. And it doesn’t take a lot to understand why.
Take, for example, two cars in a parking lot. One is unlocked with the keys in it. The one next to it is locked and the keys are nowhere in sight. Which of those will a car thief steal? The answer is obvious: The first one! The harder you make it to breach your devices and accounts, the more likely a cybercrook will move on and try to commandeer someone else’s things.
Here’s what you need to do, in order to protect your cyber-life:
Don’t be annoyed by the need for passwords and other, additional, authentication methods. Be happy they’re in place, to make sure that you — and only you — have access to your own information.