6

Google's Trust API has already been tested out in “several very large financial institutions” in June. It apparently uses a combination of multiple weaker indicators such as biometric indicators as well as some less obvious ones: such as gait, typing style or screen swimpe technique. These will then form part of a final decision to verify you are who you say you are. Are such measures really necessary?

1 Answer 1

4

These measures will greatly reduce the impacts, and or attempts to circumvent them. The issue with passwords are, no matter how much you try to educate anyone, it rarely works. Individuals prefer comfort over security, as indicative by making a password: "P@ssw0rd1" to meet complexity requirements. As long as there are passwords, people will keep creating passwords that are weak, and attackers will continue to break them. Moreso as the power of computing goes up, and pricing on creating a powerful machine to break passwords, goes down.

Psychologically, we want things right now. The moment we type something in. "Bandwidth is too slow. This page took 3seconds to load, it usually takes 300ms" We have slowly been groomed to receive instant gratification, and or, to perform tasks with lightning speed. "Have to log in to upload this report by X deadline." No one wants to spend the added time typing in something overtly long, and complicated. Forcing them to remember: "4%6DMoeTr,$^" won't work as the user will write it down. Forcing complex passwords leads to conformity: "Finethisismypa$$word1" which has not worked.

By Google and others using other variables, the attack surface becomes more difficult to tackle from an attack perspective. An attacker would have to know the proper set of variable to trick systems into authenticating. The issue I can see from the biometrics (machine learning) when dealing with typing will come via the following: "What happens if I break my arm, and am typing one handed", "what happens if I type my password one handed because I am on the phone or eating a sandwich." Swipes, same applies. What happens if I come back from a bar, and after a few drinks my swipes error out. Can I not make a bank transfer?

There is still a way to go including Google having to account/store even more data on individuals which leads to even more potential privacy abuses. "We know he/she is left handed, is likely a drunk due to the false positives every Friday night, and is a horrible speler!" (purposely mispelled). Any company looking to do away with passwords is on both the right path, yet also on a path to having too much information on an individual. Is it necessary? Yes it is. Cybercrime is billions of dollars in lost money, sometimes broken dreams (someone's account getting wiped out). Anything that can tackle this is on the right path

2
  • Reducing the dependency on passwords is a fine goal. Making sure Google is able to track individuals even better may not be the best method though.
    – Jacco
    Jul 1, 2016 at 20:02
  • I'd like to see details in terms of: • A high level description of the biometrics password strengths. • How the corporate biometrics system works in distributed environments. • How authenticity, integrity and confidentiality triads could be enforced. • Details of any trials or supporting technologies and standards Jul 1, 2016 at 20:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .