Now Password is A Hardware Commodity

We have all known for long that your spouse’s name followed by a few numbers isn’t a good enough password anymore- and now even Google acknowledges in its new research. Later this month, IEE Security and Privacy Magazine will publish a new research paper by Google that suggests a few alternatives to your old school passwords. These alternatives include physical devices combined with some other screen unlock forms, which are likely to simplify the entire process of password protection while making it more secure.

Some of the possible systems listed in the report include smart phones with embedded chips, which turn out to be quite convenient as everyone will be carrying a cell phone otherwise also. Then there are certain unusual suggestions as well, such as delivering using finger ring. Consumers, especially those with a business-oriented mindset, would prefer if the ring looks a bit professional, while the idea is quite innovative.

Initially, however, Google is working on the YubiKey cryptographic card and programming it in such a manner that it will empower users to directly log into their web-based Google account as soon as the card is inserted into the USB drive of their computer. The best part is that the account doesn’t require any form of software download or installation. All it will need is an upgraded version of Google Chrome. This card, along with Google’s authorization and authentication services, will eliminate the tedious password process and CAPTCHA code verification that make logging into websites and apps a crane in the neck.
Google is not the only mobile application development company that has thought of developing such systems. Several other vendors have also launched their versions, to create ripples in the marketplace. Blizzard’s Battle.net Authenticator provides secondary temporary passwords for users which they can use along with their existing passwords, as an additional protection measure. Similarly, Google users can take the advantage of a two-step login authentication process. In this process, a message is sent to your registered mobile number that contains your temporary password alongside other login details. The only issue with regards to these methods is that they are vulnerable to phishing attempts wherein a fraudulent company claims to be managing your account, thus tricking you into giving them your account credentials.

The inception of direct authentication via physical devices eliminates all potential phishing threats, while simplifying the password process as it can do without a password in scenarios that require low protection and simple password in scenarios that demand high security. The risk of the device being stolen or lost still prevails, but such errors are easy to track and tackle as compared to hacking attempts and malware issues.

Online security scenario is definitely stepping up. Vendors are trying to render a more secure online environment to make consumers feel safeguarded. Measures such as two-step authentication are effective, but have again made the security process tedious as compared to the times when only your pet’s name would do or you would not even bother to login at all. This effort of introducing hardware-based password will bring back the innocence and simplicity to the web, but will take time to get popular amongst the populace, especially the less tech-savvy population. Google, with its reach and market influence, might do it successfully, but if sources are to be believed, Google will be launching a worldwide protocol for device-based authentication, that will be independent of its very own services, and will require nothing more than a browser to support it.