For your eyes only: New twist on Digital ID could keep you from getting hacked

For your eyes only: New twist on Digital ID could keep you from getting hacked

Summary: Online verification involving visual preferences may prevent your accounts from being penetrated by hackers.

SHARE:
TOPICS: Security, Cloud
73
mental-biometrics-300px

This week, the security methods used by Apple and other cloud-based software and service providers such as Google and Amazon are under intense scrutiny.

A writer for Wired, Mat Honan, had many of his online accounts compromised and his data destroyed on his cloud-connected Mac, iPhone and iPad after hackers fooled Apple support representatives into re-setting the password on his iCloud account which then alllowed them to gain access to other linked social media accounts.

The hackers then defaced Honan's as well as Gizmodo's Twitter accounts in the process with embarassing racial and homophobic epithets. 

The sordid tale on Wired that Honan tells of his unfortunate experience is a painful one. It is in essence a perfect storm caused by simple human mistakes regarding password security which were exploited by social engineering techniques used by the hackers to eventually compromise his Apple ID account and other linked accounts via weak password reset mechanisms at the cloud providers themselves.

With so many individuals with multiple accounts on so many linked cloud services, it is inevitable that this sort of cybercrime is going to become more commonplace unless new mechanisms are put into place to prevent this form of compromise that Honan experienced.

One way of dealing with this would be to employ biometrics on all computing devices. I wrote about this at length in February 2011, which eventually led to an appearance on CBC Radio alongside prominent independent security researcher Dr. Markus Jakobsson. 

I spoke with Dr. Jakobsson this week regarding the situation experienced by Honan and he is in agreement with me that biometrics combined with brute-force resistant and difficult to guess passwords (but which are still easy to remember) are still probably the best solution to secure one's online identity.

Also Read:

Among his many publications in the discipline of computer security, Jakobsson has done substantial research in creating algorithms that can determine the probabilty of how easy it is for a password to be guessed or re-set based on basic knowledge about an individual's background and commonly used words, and these methods could be employed by cloud providers almost immediately to help users improve the streghth of their passwords.

But getting biometrics such as fingerprint readers integrated into computing devices is going to take some time.

Apple has already taken steps to integrate such technology into future generations of its Macs, iPhones and iPads by its recent purchase of Authentec. However, it could take a few years before the Cupertino-based consumer electronics and personal computer company gets this technology into the mainstream.

In the interim, Jakobsson has proposed an alternative type of biometrics he refers to as "Visual Preferences".

For lack of a better term I am using the phrase "Mental Biometrics" or "Psychometrics." Whatever it ends up being called, an imprint or a snapshot of a user's personality is taken using a unique mnemonic which is then challenged via an authentication mechanism that uses pictures.

These pictures would be easy for the user to remember, but extremely difficult for a hacker to challenge. During the enrollment process, the user is given a long list of pictures of various objects and activities, and then chooses a series of those which they then have to remember based on what they actually like or dislike.

like-dislike-jakobsson-620px

So for example as in the above illustration, one might like Goldfish, Guitars, Karate but dislike Professional Wrestling. That would be easy for that individual to remember but nearly impossible for a random hacker to know, even based on publically avaliable information.

Jakobsson notes that while it would be easier for a spouse or possibly a close family member, friend or a co-worker to know some of these things, they would not be able to deduce all of them. Thus the mechanism is extremely secure.

During the challenge process using this type of mechanism (such as a password reset for iCloud that Honan's hacker encountered) they would be shown a list of pictures, including a lot of ones that the user did not pick, which they would then have to pick from.

Only the user that remembered this particular sequence of pictures during the enrollment process could reset the account. Because these pictures are easy to remember and are unique to the individual's personal preferences, it makes it both measurable (like a biometric) and difficult to crack. 

Jakobsson has told me that this form of authentication is already in use with a major healthcare provider and will be rolled out to a well-known e-commerce infrastructure provider in the near future. So it is entirely plausible that services such as Twitter, Facebook and also other e-commerce/Cloud providers such as Apple, Google and Amazon may follow suit.

Would you feel more comfortable with your cloud-connected accounts if they used "Mental Biometrics?" for challenge mechanisms? Talk Back and Let Me Know. 

Topics: Security, Cloud

About

Jason Perlow, Sr. Technology Editor at ZDNet, is a technologist with over two decades of experience integrating large heterogeneous multi-vendor computing environments in Fortune 500 companies. Jason is currently a Partner Technology Strategist with Microsoft Corp. His expressed views do not necessarily represent those of his employer.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

73 comments
Log in or register to join the discussion
  • I don't know...

    I never really liked having to remember random stuff like that, because I would need to be consistent across all sites, kind of like using the same password on all sites.

    Biometrics, like holding your eye up to your PC's camera, would be convenient for not having to remember any passwords and probably more secure than your run of the mill password. The image needs to be encrypted at capture time securely. Basically instead of keyloggers, it would have to be protected against a hacker doing a man in the middle attack on your camera device during capture.

    The other obvious problem with biometrics is the vendor is going to store that information. Like no offense to Google, but I really don't think I want them with my fingerprints or retina scan. I'm sure law enforcement would love if they did that, you wouldn't even have to get processed if arrested cause Google would already have given your prints to the LEOs.

    Even worse, what if there database was hacked and people with malicious intent get a hold of your biometrics? You could imagine the possibilities.
    dtdono0
    • Common sense works better.

      Not to mention that this fiasco was caused, in part, by Apple's idiotic insistence that you use an E-mail address as your user ID. With this amateur-hour policy, Apple, Amazon, Facebook, and LinkedIn put your security at risk: http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html
      Oscar Goldman
    • Biometrics are encrypted

      Every biometric system I've seen so far does, indeed, encrypt the biometric data; thus, if someone stole the entire system where your prints and retina scans were stored, they would be useless.

      Maybe there are some that store biometrics without additional encryption; but I would not use those systems. The author never said any of the next round of pictures would be "alternate / generic replacements for previous images." He said "they would be shown a list of pictures, including a [lot of ones] that the user did not pick, which they would then have to pick from."

      As I said in this article: http://tiny.cc/w3esiw - multi-factor is all that's needed. No 'bio;' no pics.
      bitdoctor
      • oops

        I think I cut and pasted some in my previous reply.
        Go figure. And no way with ZDNet to edit your own reply :-(
        Ugh!
        bitdoctor
      • THere's encryption and there's encryption

        Sorry but saying without qualification that templates are "encrypted" and therefore "useless" to a thief is like saying "there's a lock on my house so no burglar can get in". There is no encryption that cannot be defeated. Implementation is critical. Look at Apple: they implemented what is reckoned to e the world's best encryption (AES) but broke it.
        God help us if biometrics become widespread, in the cloud, shared amongst providers ... we're going to need some much more rigorous thinking around what it all means.
        swilson@...
  • despite your assurances

    that it is very easy to remember images, I dare to disagree.
    One example is how unreliable eye witness accounts are. People routinely fail to pick a correct person from a line-up.
    Try it for yourself - stare at a picture today, and try to pick it out of a set a month later. Or try to recall what someone was wearing yesterday.
    If every site starts doing same, you will need to remember dosens of sequences.
    :-(
    ForeverSPb
    • It's not about remembering pictures, it's about topics

      You clearly didn't understand how the system works.

      Let's say you like dogs, air planes, and Monopoly. You are shown a grid of a dozen or so picktures. One picture is of a great dane, one of a 747, and one of a the Reading Railroad square.

      The next time you are asked to authenticate, you are are shown a grid of a dozen or so pictures. There is no Great Dane, no 747, and no Reading Railroad square in this set of displayed pictures. Instead, one is of a poodle, one is of a Fokker Triplane, and one is of the Park Place square.
      mheartwood
      • yes I do understand how it works.

        The problem is that I do not know if I am picking an image of a generic 'dog' or of a 'poodle'? Is it a generic car or a Mustang? If I picked a Mustang, and I am shown a Ferrary - is it the right answer? Did they mean 'sports car'?
        With different categoriztion on different sites, it will become very confusing very quickly.
        ForeverSPb
      • No, I think you (mheartwood) misunderstood

        The author never said any of the next round of pictures would be "alternate / generic replacements for previous images." He said "they would be shown a list of pictures, including a [lot of ones] that the user did not pick, which they would then have to pick from."

        That does NOT indicate that any original pictures would be like a Great Dane and the next time you're challeged it would be a Poodle.

        What that means is you might be shown 12 pictures during initial selection and let's say you choose 5 of those pictures as "like/dislike."

        Well, the next challenge that happens - example: Hacker tries to log in, he/she would see maybe 20 images - those images would include the FIVE that you originally chose, but 'also' a number of other images that you never chose and never even saw.

        Author NEVER said one world about 'substituting' the original pictures with 'alternates.'
        If so, the author should clarify.

        I wrote an article "Two-Factor Authentication Would Fix Linked-In Password Breach"
        ( http://tiny.cc/w3esiw ) which applies to this situation and which I fully believe is all that would be needed - two-factor authentication - images or not (preferably not - I also would have trouble with images, whereas some people would not have trouble with them.)

        Seriously - 2-factor or "multi-factor" authentication would solve it; doesn't have to be complicated, just effective and practical.

        Multi-factor can be very practical and RSA had this soft-token, multi-factor method in place eons ago! Basically it is like the questions of "favorite grade-school teacher," but inolves a LARGE NUMBER of such questions on the order of 20 or more - intially, when you set up, let's say, a bank account, you MUST answer ALL 20 or 30 questions.

        Now, when you go to do on-line banking, if you can't answer SIX of those properly, then you are not who you say you are. And the 'SIX' can be configured to be more or less.

        For DoD, we used 12 to 15 'soft keys' - i.e., you had to answer 12 to 15 of your chosen 40 questions.

        http://tiny.cc/w3esiw - Multi-factor authentication is all that's needed. No 'bio;' no pics.
        bitdoctor
  • Very interesting

    I picked a fingerprint reader years aqo for about fifty bucks.
    It worked but would have been trivial to circumvent. It was a neat toy, and it did keep children off my machine.
    The visual thing looks like a winner. I could in theory remember: guitar, cat, book, flowers.
    Thanks for the article.
    Ed
    ofrmgfo
  • I like the photo idea

    I agree with the poster who objected to having a retina scan or fingerprints stored with a vendor or service provider, but I think the photo idea would work. There's no reason why your photo preferences, or even the available choices, would have to be the same across providers. I've worked with a payroll service who already does this - you enter your username and password, then click on one of 40 photos that you configured when you enrolled. There's no issue remembering the photo, and I can't see any reason why a similar system wouldn't work elsewhere (online.paychex.com).
    1DaveN
  • You choose wisely . . .

    So, is this like the "Dalai Lama" method of authentication?
    ZukeA
  • Visual Recognition

    Already use this with BofA and PayPal.
    Ninth Crusade
    • PayPal? Not unless it happend in the last day or so

      What are YOU smoking? PayPal does not use this, unless they just implemented it in the last 2 days. Unless you mean a "verified image" - like a SINGLE IMAGE - that is a totally different thing, and my bank uses it, and maybe PayPal and several others. It basically registers a specific 'image' (picture) of some item to go along with your particular computer and sign-on. That's it. It is not at all like what they are discussing here - the 'single image verification' serves a number of purposes, one of which is that, if you are at a "phishing" page that looks like BofA or PayPal, you won't see the cool image that goes along with your sign-in, so you will be assured it is 'not' the real sign-in page.
      bitdoctor
  • April Fools

    Apple doesn't have security issues LOL. I do feel sorry for everyone involved. That's no fun. Yea the problem with locking the door securely when the windows are wide open does nothing. Using the same password in multiple places also makes you vulnerable as you are only as protected as the weakest link. Email addresses are the hub though. Break into that and you can reset most other services. I use google's two step system and occasionally I get a random verification request that I didn't initiate meaning someone is trying to hack it. Even key loggers will have a tough time with that system. Almost everyone I know has had their Yahoo account hacked as it is so weak on man in the middle cookie exploits and such.
    LarsDennert
  • Multi phase log in

    I do not feel that websites should have access to any of my biometric information. It's bad enough that my DNA, and fingerprints are logged with the government and a few selected contractors but supplying that, or like info, to the "web" seems to dilute the validity of the information. For as sure as it is implemented it will be hacked. It's not a matter of if, it's a matter of when. I've been dealing with digital security since "Tempest" was discovered and their are only two truisms. The only thing that will never change is that things change and no matter how tight the security is there is a hacking risk. Multi phase is better than the present but I don't feel biometrics is the answer. If I had the answer I would not be working for a living.
    kagnew
  • Remembering the sequences may be difficult

    I might be able to remember the images but trying to recall the sequences of the images from various web sites might prove to be difficult. What if the images are provided in a different sequence and I only selected them in the order that they were presented?

    What if I am lazy and chose not to scroll down the list of images to see all the available ones and only selected the 'favorites' from the top visible images, and the next time I come back the list is not in the same order? Nothing guarantees that the list will always be in the same order, thus giving you visual cues from surroundings. And not all sites will have the same lists I suppose.

    Now I am not only maintaining lists of sites & passwords, but also sites, passwords, and visual data structures {likes:fish,cat,karate,cookies}{dislikes:wrestling}, just so I can remember the order in which I selected the visual objects.

    And If I forget this visual order, what will be the method for resetting your 'password'? There will still need to be some policy for managing this to allow a legitimate user to their data while preventing a illegitimate user from that data.

    So we are back to the same place where Mat found himself this past week. Vulnerable to attack if the user claims he has forgotten his visual password and needs it reset.
    danl65
    • Don't need to remember the sequence, only the topics.

      As I mentioned before, you don't need to remember actual pictures, onlyt what those pictures contained. And in systems already using this method of authentication, order is not important.
      mheartwood
      • Realizing the written word is a poor vehicle for communication,

        I beg to differ.
        I believe I well understand your point, however it's not my understanding that the author made that point clear in the article. (In fact, based on the words in the article, it's arguable that he didn't even consider your point as an option).

        Here's an extract from the article:
        "Only the user that remembered this particular sequence of pictures during the enrollment process could reset the account."
        I'd liken the article to a politician's speech: extolling the "improvement" but lacking details or forethought concerning implementation.
        While it's not clearly stated by the author, I understand that sentence to mean that not only would the same pictures be displayed, but the original sequence must also be matched. (Is that a "double whammy" on the ease/difficulty of this method)?

        Additionally, it mentions only the enrollment process. What would be required if/when I decide to change my passsword months after the enrollment process, even if only for my own reason? Would I make a new selection of pictures, the sequence of which I must then remember?

        While it may seem like a viable alternative to today's security methods, it seems obvious that more thought must be given here. We alswo need to put this article iin proper perspective, i.e. it's a magazine article and not even a "white paper".
        nowon
  • spelling

    Good article; but you misspelled publicly (publically) and available (avaliable.)
    I appreciate accurate information.

    Multifactor authentication is an important security matter; but who will trust the authenticators?
    jay911