For your eyes only: New twist on Digital ID could keep you from getting hacked

This week, the security methods used by Apple and other cloud-based software and service providers such as Google and Amazon are under intense scrutiny.

A writer for Wired, Mat Honan, had many of his online accounts compromised and his data destroyed on his cloud-connected Mac, iPhone and iPad after hackers fooled Apple support representatives into re-setting the password on his iCloud account which then alllowed them to gain access to other linked social media accounts.

The hackers then defaced Honan's as well as Gizmodo's Twitter accounts in the process with embarassing racial and homophobic epithets. 

The sordid tale on Wired that Honan tells of his unfortunate experience is a painful one. It is in essence a perfect storm caused by simple human mistakes regarding password security which were exploited by social engineering techniques used by the hackers to eventually compromise his Apple ID account and other linked accounts via weak password reset mechanisms at the cloud providers themselves.

With so many individuals with multiple accounts on so many linked cloud services, it is inevitable that this sort of cybercrime is going to become more commonplace unless new mechanisms are put into place to prevent this form of compromise that Honan experienced.

• Also Read: How to use Google Two-Factor Authentication

One way of dealing with this would be to employ biometrics on all computing devices. I wrote about this at length in February 2011, which eventually led to an appearance on CBC Radio alongside prominent independent security researcher Dr. Markus Jakobsson. 

I spoke with Dr. Jakobsson this week regarding the situation experienced by Honan and he is in agreement with me that biometrics combined with brute-force resistant and difficult to guess passwords (but which are still easy to remember) are still probably the best solution to secure one's online identity.

Also Read:

• Google and Facebook: End Passwords, Get Biometrics Now!
• The Case for Replacing Passwords with Biometrics
• Rethinking Passwords to Adapt to Constrained Keyboards

Among his many publications in the discipline of computer security, Jakobsson has done substantial research in creating algorithms that can determine the probabilty of how easy it is for a password to be guessed or re-set based on basic knowledge about an individual's background and commonly used words, and these methods could be employed by cloud providers almost immediately to help users improve the streghth of their passwords.

But getting biometrics such as fingerprint readers integrated into computing devices is going to take some time.

Apple has already taken steps to integrate such technology into future generations of its Macs, iPhones and iPads by its recent purchase of Authentec. However, it could take a few years before the Cupertino-based consumer electronics and personal computer company gets this technology into the mainstream.

In the interim, Jakobsson has proposed an alternative type of biometrics he refers to as "Visual Preferences".

For lack of a better term I am using the phrase "Mental Biometrics" or "Psychometrics." Whatever it ends up being called, an imprint or a snapshot of a user's personality is taken using a unique mnemonic which is then challenged via an authentication mechanism that uses pictures.

These pictures would be easy for the user to remember, but extremely difficult for a hacker to challenge. During the enrollment process, the user is given a long list of pictures of various objects and activities, and then chooses a series of those which they then have to remember based on what they actually like or dislike.

So for example as in the above illustration, one might like Goldfish, Guitars, Karate but dislike Professional Wrestling. That would be easy for that individual to remember but nearly impossible for a random hacker to know, even based on publically avaliable information.

Jakobsson notes that while it would be easier for a spouse or possibly a close family member, friend or a co-worker to know some of these things, they would not be able to deduce all of them. Thus the mechanism is extremely secure.

• Also Read: Improved Visual Preference Authentication

During the challenge process using this type of mechanism (such as a password reset for iCloud that Honan's hacker encountered) they would be shown a list of pictures, including a lot of ones that the user did not pick, which they would then have to pick from.

Only the user that remembered this particular sequence of pictures during the enrollment process could reset the account. Because these pictures are easy to remember and are unique to the individual's personal preferences, it makes it both measurable (like a biometric) and difficult to crack. 

Jakobsson has told me that this form of authentication is already in use with a major healthcare provider and will be rolled out to a well-known e-commerce infrastructure provider in the near future. So it is entirely plausible that services such as Twitter, Facebook and also other e-commerce/Cloud providers such as Apple, Google and Amazon may follow suit.

Would you feel more comfortable with your cloud-connected accounts if they used "Mental Biometrics?" for challenge mechanisms? Talk Back and Let Me Know.