Risk
5/16/2013
03:30 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%
Repost This

The Future Of Web Authentication

After years of relying on passwords, technology vendors -- and enterprises -- are ready for new methods of proving user identity.

The Password Problem

Shared secrets like passwords have been around for thousands of years. In computing, pioneers at MIT set up a password system in the 1960s to help meter users' time on the school's time-share computer system. Even then people gamed the system. The story goes that one of the scientists got hold of a master password from the password repository and handed it around to his friends so they could get more than the four hours per week allotted.

That early hack highlights the inherent problem with passwords: To remain effective, they have to remain secret. And to break the system, a hacker need only get into the main password repository.

It's a "brittle" system, says Phil Dunkelberger, CEO of authentication vendor Nok Nok Labs, that can't adequately protect today's scale of users and nodes connected through cloud- and grid-based computing.

Passwords are particularly problematic for Internet security as frequent hacks and breaches show. Just last month, a breach at LivingSocial, an online coupon company, exposed 50 million user passwords. Such break-ins give hackers the power to masquerade as any number of Internet users online. And when they aren't stealing credentials, cyber thieves use password guessing and cracking tools to compromise authentication systems.

Users themselves frequently assist the thieves, falling for phishing scams and reusing passwords across different sites. "Breaking into the system and stealing the passwords isn't even the biggest problem," says John Bradley, senior technical architect for authentication vendor Ping Identity and an evangelist for open identity standards like OAuth and OpenID. "The biggest problem is that people give them away all the time."

Security leaders for years have said that passwords must be abolished, but the alternatives have fallen flat because they're built on flawed assumptions, Jericho Forum's Simmonds says. For example, challenge-and-response systems assume that attackers can't find the answers to users' established questions. And hardware token systems assume that attackers couldn't steal the tokens or the algorithmic information that powers them.

So far, no one has found an intuitive, affordable way for users to sign in to accounts with the same kind of uniform acceptance as passwords. Even passwords aren't necessarily that easy to use. According to a Ponemon Institute survey sponsored by Nok Nok Labs, 69% of 754 U.S. respondents say they've forgotten a too-long or too-complex Internet password, and 67% have been locked out of a site because of password problems.

Since Web authentication isn't secure or easy, says Emilio Martinez, CEO of Agnitio, a voice-recognition biometrics firm, "we have the worst of both worlds."

chart: Authentication Difficulties: How often do you find yourself unable to do an online transaction because of authentication failures?

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
2 of 6
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
5/21/2013 | 12:41:17 PM
re: The Future Of Web Authentication
"nobody knows you're a dog"
the other 'Net quip is that the Internet is a Fools' Paradise
perhaps so, but that aside there are a lot of not so nice folks out on the net. which is why it is essential to remain anonymous unless the connection has a legitimate need for a real ID such as online shopping.

and NO advertising sites do not fall in that category.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web