| Data got breached left and right, how to protect our passwords ? |
|---|
| Follow the trend | or | do the right thing ?! |
|---|
By Ni , Min [ Frank ] of GATE Cyber Technology
[ More detail + Sample app : https://gatecybertech.com/gatecomparison.html ]| Password Problem Wake Up Call | ⚠️ |
|---|
|
I remember it used to be every few months there were news about data breaches, and people would be surprised and scared. But nowadays, almost EVERY day I read about data breaches and ransom attacks, and it's like a normal thing, being a part of life, no surprises and people would just pretend nothing happened.
Why ?! Because hackers are getting more sophisticated and the breach frequency gets higher and higher, what's worse : people felt there is nothing they can do about it, so they've become used to it !
Experts tell users to protect their passwords by doing the following :
That's the trend, and it is assumed "correct" to say "Zero Trust" and follow the above advice. But after years of following that advice, look at what happened :
So, what is going on ?! Well, here's what I see and what I think is happening, let me know if you think differently.
We are now facing modern hackers with the following tactics to steal user passwords :
And because of the weakness in the current password system, all the other problems follow : requirements of uppercase, lowercase, numbers, special characters, must be at least 8 digits long, and must change the password every 2–3 months... Which makes it hard for users to remember, so instead of solving the problem, the requirements made the situation worse. The requirements are user-UNFRIENDLY, because users can't remember all of them, they have to write them down which will cause more exposure to passwords.
Some of the requirements may help defeat random guessing passwords, but they CAN NOT protect users from password interceptions.
Then comes password manager, and the user would put all his eggs in one basket, yet when the master password gets breached, all passwords are stolen.
Some might ask : "How about a multifactor authentication ?" Well, as you can see in the video below, if a hacker can steal the 1st answer, then he can also steal the 2nd answer, so the more facts you expose, the more secrets he will steal from you. The point is not how many secrets there are that you know, but how NOT TO EXPOSE them during authentication.
When you login, you might see something like this :
Username : admin
You might think your password is hidden; no one will be able to see it. But that's a false sense of security; it only obscures the password on the display and protects you from a casual observer, but if a hacker is zooming in on your keyboard with a hidden camera from a distance [ in a window across a street ], he can still see whatever password you typed in. Also, if there is a keylogger, it records every character you enter; they won't be "********", because if every character is "*", then how can the server authenticate you ?
The key logger might record your input like this :
admin [ Enter ]
So, wake up! Don't let a false sense of security in the current authentication system lead you into a data breach !
There are 3 elements in the user authentication field :
Since there is a weakness in the current password system, there is a trend to replace password with the other 2 elements, i.e. use biometrics + a device to authenticate user. There is even a trend to go passwordless, such as Passkeys.
THIS IS VERY DANGEROUS ! Because a hacker can get hold of user biometrics data and device, then login WITHOUT the user's consent. Imagine in a 007 / "Mission: Impossible" scenario, the hacker can get close to the user as a boyfriend/girlfriend, setting up some hidden cameras, record all his communications, especially the master password of his password manager, copy his fingerprints, then use the stolen biometrics data and login to his device while he is in the shower or unconscious [ drunk or asleep ]. I would imagine it's possible to use a hidden camera and point at the user while he IS conscious [ but not knowing that a hidden camera is using/borrowing his face ] to login.
Key fob and mobile phone-based approaches which mainly rely on objects, may be lost, stolen or imitated. Fingerprints, facial recognition or iris scans are difficult to recover after data loss.
Therefore the 3rd element [ password ] in the user authentication process is still VERY important, it's the knowledge that the user has, and it shows his intention when the user logs in with this knowledge. The problem we are facing is how to authenticate the user WITHOUT EXPOSNIG THIS KNOWLEDGE.
Now is the time to update the password technology to adapt to the modern digital world. In order to solve the password problem, we need to first find the cause. Here are 2 things that can cause passwords compromise :
If we can fix these 2 weaknesses, we can protect users from most password problems. Let's start with the 2nd problem, after we solve it, we might also solve the 1st problem as an added benefit.
Let's assume my username is : "Frank" and my password is : "a1w6" [ it might stand for something easy for me to remember but hard for a hacker to guess ]
So, in our current login system, I'll log in like this :
Because of the dangerous digital environment we are in, we cannot be sure whether we are intercepted by a hacker or not; therefore, we must assume the worst-case scenario and come up with a solution that can withstand and survive such a hostile environment. So, let's assume our login sessions are being watched and recorded.
With that said, to the hacker who is watching me log in, my password is VERY OBVIOUS : a1w6
This is the weakness of the current password system; it exposes user pins during the login process; therefore, we need to come up with a way to NOT EXPOSE our pins. How about something like this ?
When I log in, I enter a group of symbols for each pin in my password, and then let the server verify each group and see if my pin is in it, like this:
Therefore, the result is, I entered the following sequence as my password when I logged in : #+a9 q1$# 3w&! +=@6
On the server side, it knows that my password has 4 pins, and they are : "a", "1", "w" and "6"
So to validate my password, the server will go through my login sequence and check to see if each group of my symbols includes the proper pin in the right order, like this :
After the server checked that all 4 groups have the correct pins in them, the server authenticates me to log in.
Next time when I log in, I enter a different sequence like this : @a0& p%1: w~5$ ^6=g
The server can do a check like the above to validate that all my pins show up in my sequence and let me log in.
Yet, it's inconvenient for the user to type the different sequences every time he logs in. How about letting the server generate several sequences and display them on a graphical user interface [ GUI ] and then letting users select which sequences to enter ? It's much simpler. We can display a table of 3 x 3 tokens [ buttons ] to the user. The server can generate 9 groups of symbols and fit the symbols in each corner of each token/button in the 3 x 3 table. The user can follow the order of his user pins and select which token/button to enter by pressing the token/button on the GUI table.
But now comes another issue, if you are careful enough, you will realize that if the hacker records both of my login sessions, and does a comparison, he can still figure out some of my pins, like this :
Now, the problem is how to obscure the user pins EVEN IF multiple login sessions were intercepted by the hacker ? I came up with a solution : add a missing pin concept. It works like this : since the server knows what my pins are, it can generate a tokens/buttons table for me to select which token/button to enter when I log in. This will make it easier for me as a user to enter the sequence, it can generate a 3 x 3 token table, and each token has 4 symbols which will show up in each corner of the token, my user pins are mixed in with other symbols, so they are not obvious to the hacker. But the server can select SOME [ no guarantee that every pin will show up every time ] of my user pins to show up in the tokens table. Every time I log in, I'll see maybe 2, 3 or all 4 of my user pins in the generated tokens table. If a user pin is not showing up in the table, USER CAN AND MUST select a random/wildcard token in place of that missing pin; that way, even if the session is intercepted by the hacker, he won't be able to tell which one is a user pin, which one is not. The missing pin concept will make the hacker's work much harder. This interception-resistant authentication system is called GATE, short for Graphic Access Tabular Entry.
Also, to make the GATE system more user-friendly, all available symbols are grouped into 4 categories. Each category of symbol will only show up in a fixed corner on any token. The 4 categories are : [1] Numbers , [2] Characters , [3] Signs , [4] Other symbols. The positions of the above groups are fixed in any token, so numbers will always show up in the upper left corner, characters will always show up in the upper right corner of a token, etc. This may help user to quickly locate and enter his pin from the tokens table.
All pins show up may look like this : All pins show up
Details are here : How GATE Works
Now we have come up with an interception-resistant user authentication system which can solve most of the current password problems :
Not only is GATE exponentially more secure than the current login system, but GATE is also more user-friendly. Users can use short and easy to remember passcodes to quickly login, without the need to depend on biometrics. Users have full control of their intentions to log in when they want to log in, hackers cannot steal a device and bypass the user to log in. It is the knowledge of the GATE passcode that the user has but hackers won't have access to and therefore can't bypass.
During account registration, users can select from a large variety of symbols [ customizable by the organization that implements GATE ] to create their passcodes. Since the available symbols in the GATE system include many more symbols beyond keyboard characters, users can fully use their imagination to come up with creative, easy to remember and yet hard to guess passcodes, like the following :
As you can see, there are plenty of ways to come up with easy to remember GATE passcodes. When user logs in, pins in the user passcode will be mixed in with other available symbols to be obscure. Therefore, GATE is secure by design, special symbols are already part of the pre-designed system, this makes GATE user-friendly yet very secure.
So, to summarize, passwords have been used for a long time. Now hackers have more sophisticated ways to intercept and steal them. We need better ways to protect ourselves from interceptions. The trendy thing to do is to follow the so-called experts' advice and do the 7 things mentioned at the beginning, but that won't solve the main problem we are facing, which is password exposure during the login process, those advice will only make it harder for users to come up with and remember their passwords. Biometric system would raise tension with privacy interests. And when biometric data gets stolen, how to recover from that ?!
Passwordless is not a good choice either, because somehow in the passwordless process, there is still some user pin involved, if that process is intercepted [ just like password interception ], the system can still be breached. Also, the passwordless approach depends on devices, whoever has control will have access, it assumes that the device owner will always have control of the device, but that's often not the case, plus hackers can use SIM swap to take over user accounts. The right thing to do is to come up with an interception-resistant authentication process, be prepared that our authentication process WILL BE intercepted and face the reality, even if/when the login session is intercepted, we can still safely authenticate without exposing our passcodes. You may not be a decision maker when it comes to what authentication system to use, but you may help in RAISING OUR COLLECTIVE CONSCIOUS BY SHARING THIS INNOVATION, the more people know about it, the sooner we will wake up to see that there is a solution to the current password problem, and we can make our digital environment safer. I contacted NIST, no response ! I even tried to arrange a demo for Gartner, but they are not interested in taking a look and the reply was "Thanks, and good luck with your product!". Hope with your help this message can reach some decision makers like Bill Gates [ he should like the name GATE, I guess. ] and Elon Musk or companies like Google, IBM, Apple and Dell.
We don't have to live with the current outdated authentication system that EXPOSES our passwords during the login process. That's no longer acceptable, we need a change to protect our privacy, and with urgency ! Don't think that someone else's password exposure has nothing to do with you, in the modern world we are all connected, that someone who has his account breached might work for a bank, and his account breach might lead to the bank account breach which might expose your financial info, or he may work for a hospital and the breach might lead to your health records being on sale on the dark web. Remember a few years ago there was a ransom attack on gas pipeline that caused gas prices to go up ? It affected us all. This is a wake-up call ! Let's wake up to the cruel reality of password exposure and demand a change !
It's common sense not to leave password files in plain text, right ? But how about the login/authentication process ? It is now in plain view every time someone goes through the login process. Shouldn't it also be obscured/encrypted ?! A chain is only as strong as its weakest link, now THIS WEAKEST LINK IS THE LOGIN PROCESS, isn't it ?! Don't leave passwords in clear view [ like in the current authentication process ] and hope no one sees them, as long as the login process exposes user pins, hackers WILL somehow find a way to intercept it. So obscure it is the best approach. Be secure by design, not by having a lot of requirements and make it hard for the users. We are all users, right ?! I'm fed up with those password requirements. The more requirements there are, the less I can remember my passwords. That causes a vicious cycle. Look at what users are saying : PASSWORD RANT
What we need to do is to change from : Keypad 789
This change will likely eliminate 80% of data breaches : "81% of the total number of breaches leveraged stolen or weak passwords – 2020 Verizon Data Breach Investigations Report" The list is endless. Data breach is now a part of life, it cannot be wished away. The question is : when it happens, are you prepared ?! The way things go, cyber-attacks will only get more frequent and more sophisticated, your login sessions are very likely to get intercepted by hackers, no matter how hard we try to patch potential holes in software or hardware, things are often beyond our control [ if you go to a hotel or attend a conference, it might have hidden cameras ... ], you can do everything right within your control, but a lot of times it’s someone else’s fault that causes your information to be stolen, and when that happens, would you like to be caught like this : Username [ Frank ], Password [ My$ecret! ]. Or would you like to be caught like this : GATE Passcode Is Interception-resistant ^_^ ?! Isn't it time to wake up and see what the main problem is ? IT’S PASSWORD EXPOSURE DURING AUTHENTICATION. Don't sleepwalk into another data breach, avoid another ransom attack ! Next time you go through a login process, ask yourself : If a hacker behind a hidden camera is watching me right now, am I making it easy for him ? Would he say "another easy pick" and laugh all the way to his bank ?!
As we can see, the weakness of the current system vs. the strength of the interception-resistant GATE system is very obvious. Still have doubts ? How about a side by side comparision and see which one is more secure and yet still more user-friendly ? Let's assume we are facing the same security threats in both cases : User login sessions will be intercepted/recorded by hidden cameras or key loggers, and the login sessions are facing phishing attacks. In the case of current login system, users are following the advice of "experts", so they have long and complex passwords, they also change passwords every month. In the case of GATE system, a short passcode is used for the same period. After 3 months, the result looks like the following :
Fixed passwords have the advantage of easy to remember, one-time passwords have the advantage of hard to hack, GATE passcode is a fixed passcode to the user, but from the hackers' perspective, it changes every time, GATE passcodes have the best of both worlds, short and easy to remember, yet secure and hard to hack.
Software and hardware developers, how would your customers appreciate it and how competitive would you be, if this award-winning innovation was incorporated into your products ?!
Companies and organizations, how many cyber threats can you fend off, if GATE is on your side to protect your sites from data breaches and ransom attacks ?! What we need now is "Password 2.0" : an obscured, interception-resistant authentication, an evolution to the password authentication process !
Sophisticated Phishing Campaigns Target the FCC and Crypto Firms So, here's the question again : How to protect our passwords ? Follow the trend or do the right thing ?! You can help by sharing this innovative GATE concept and make it harder for the hackers, the more people know about the interception-resistant GATE process, the safer we will all be ^_^ !
[ Gate Cyber Technology ] #password #passwordmanager #phishing #privacy #dictionaryattack #passkey #passwordless #login #authentication #accesscontrol #crypto #web3 #encryption #facialrecognition #fingerprinting #irisscanning #IAM #login #ibm #microsoft #google #apple #dell #billgates #elonmusk |
