Endpoint

6/30/2016
09:30 AM
50%
50%

Passwords To Be Phased Out By 2025, Say InfoSec Pros

Behavioral biometrics technology and two-factor authentication are on the rise as safer alternatives, according to a study.

A study of 600 security professionals by mobile ID provider TeleSign has revealed that customer account protection is a major worry for businesses, with 72% of those interviewed saying passwords will be phased out by 2025. More and more companies, says the report, are replacing passwords with behavioral biometrics and two-factor authentication (2FA) with 92% of security experts claiming this will enhance account security considerably.

“The vast majority of security professionals no longer trust the password to do its job,” said Ryan Disraeli of TeleSign because 69% of the respondents said they did not think usernames and passwords provided enough security. Account takeovers (ATOs) were a huge concern for 79% even as 86% worried about ID authentication of web and mobile app users with 90% having been hit by online frauds in the last year.

More than half (54%) of the organizations say they will move to behavioral biometrics in 2016 or later whereas 85% said they would implement 2FA within the next 12 months. Eight out of the 10 respondents believe behavioral biometrics will not degrade user experience.

Read the full survey here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
FerencN295
100%
0%
FerencN295,
User Rank: Apprentice
7/1/2016 | 11:29:18 PM
Re: What will they replace passwords with?
Are these biometric data stable?

Not at all. Illnesses and accidents may damage them.

What can leprotic users do who lose their fingerprint?

Let's supose I'm identified using my retina's patterns but I get an old age macular degeration?

Or, just like a recent Hungarian news: I am standing among my loud school-leaving pupils in front of a 7x24 pizzeria which is in a huge building. An angry dweller pours on me a bucket of concentrated H2SO4. 

 

I am afraid that in such cases the victim would be refused to reach the services.

 

 
Phil C.
100%
0%
Phil C.,
User Rank: Apprentice
7/1/2016 | 5:40:34 PM
Silly predictions
This prediction is not unlike a late-1950s article in Popular Mechanics predicting a flying car in everyone's garage.  I'm still waiting for that flying car.
SunCoast Connection
50%
50%
SunCoast Connection,
User Rank: Apprentice
7/1/2016 | 5:30:12 PM
Re: Behavioral Biometrics
This raises a very interesting question.  What is an identity?  An MRI-level biometric combined with a small tissue sample?  What about corporate accounts, and access control where the same biometric is used for multiple accounts.

  I have noted that it is difficult to update or reset biometrics when changing access control levels.  You want your doctor using the same body or EEG to access your medical records as she uses to log onto FakeBook?

Access will need to be controlled with symbols.  We have been using language for something up to 100,000 years, and we have not deprecated it yet.  Beyond that, we have added everything from heraldic signet rings to the aformentioned biometrics, but there just isn't really a mutable key that is also self-validating.  We don't have any metric in science that is not based on some other condition or context.

In the meantime; please... forget you ever heard the term "password".  Please... stop writing ACL systems that have a restricted structure.  Please... start using "Pass Phrase".  `See dog run.` is more secure than `Y3aR^wo000`, especially when it comes to inadvertently securing yourself out of your own system.
will_a
50%
50%
will_a,
User Rank: Apprentice
6/30/2016 | 12:20:02 PM
What will they replace passwords with?
There are three components for robust user authentication:
  • Something you have (e.g. your phone)
  • Something you are (e.g. fingerprint scan)
  • Something you know (e.g. password)

Biometrics are not a replacement for passwords; they are better used a replacement for usernames.  Passwords realistically aren't going away unless we replace it with some other form of secret knowledge.  The only existing one I'm aware of is the 'knowledge' of one's private key as used in PKI based authentication, but I don't think it's a viable mass-market solution.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/30/2016 | 11:07:44 AM
Biometrics
Did this survey ask if any company is moving to physical biometrics as a form of authentication?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/30/2016 | 10:59:06 AM
Behavioral Biometrics
Would there be authentication via 2FA then behavioral biometrics to confirm identify afterwards? I presume that the BB would set off alerts based off user interaction and doesn't necessarily have the abiilty to authenticate you.
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.