Perimeter
9/16/2011
05:26 PM
Rob Enderle
Rob Enderle
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Intel Demonstrates Potential Password-Killers

Intel presented two possible ways it plans to make passwords obsolete

I've never been a fan of passwords. For some time we have known that trivial passwords can be remembered but are easily compromised, and folks who write down complex passwords make them easy to find and copy. In fact, way back in the 1980s while I was working security audits in IBM, we’d regularly argue that passwords were largely an ineffective way to secure anything that was truly sensitive -- and that was long before the Internet.

Well, Intel might have come up with something that is on the cusp of eliminating passwords and making those of us who buy the next generation of PCs and tablets far more secure.

We all carry cell phones, and an increasing number of us carry smartphones, so why don't we use a cell phone as a second factor to validate we are who we say we are? At its recent developer conference, this was actually a compelling demonstration by Intel and could be done with an app on a smartphone, a unique text message generating a one-time key, or even a clickable (on the cell phone) message that validated the person who was logging in also had the cell phone tied with the account.

With that one move, the user's password could be the number one or "password," and it would be far more secure than the cryptic mess we advise users to have today. But Intel didn't stop there: It showcased a BIOS-based technology that would allow a Web page to bypass the buffer and send an image directly to the graphics system on a registered PC. The demonstration entailed the use of a randomized virtual keypad where a PIN number would be entered. Anyone cloning the screen would only see a black box, and while he might see the cursor, he would have no idea what the cursor was pointing at and couldn’t repeat the PIN. This pretty much eliminates buffer attacks as a way to get access to this class of identification information.

Now if the PIN was also single-use and sent to the cell phone, the level of security that could be provided to the user would likely exceed significantly what most high security systems provide today and be consumer-friendly.

We’ve been trying -- largely unsuccessfully -- to kill off passwords for decades. Intel is one of the few firms with enough power to actually make this happen, and the technologies it showcased were compelling. Given how entrenched passwords are, I doubt we’ll see them go away before 2025, but Intel might make them redundant in two years. And that's good enough for me.

Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6212
Published: 2014-04-19
Unspecified vulnerability in HP Database and Middleware Automation 10.0, 10.01, 10.10, and 10.20 before 10.20.100 allows remote authenticated users to obtain sensitive information via unknown vectors.

CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2013-6215
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 10.01 and 10.10 allows remote authenticated users to execute arbitrary code via unknown vectors, aka ZDI-CAN-1977.

CVE-2013-6218
Published: 2014-04-19
Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors.

Best of the Web