Let's talk about phones for a minute.
Ever since that fateful day when Steve Jobs took the stage to present the first iPhone,
nothing has been the same. I don't know what people in the year 2000 would think of the
state of our technological culture today. But it's no secret that the domination of
modern smartphones have played a huge part in shaping that culture.
Look. Security doesn't exist in a vacuum. In some instances,
it's useful to think of security as mathematical equations,
things that we can formally prove, or at least prove with some assumptions, designing
our computers and our infrastructure in a way that is as secure as we can possibly make it.
In other instances, this world view isn't enough. Technology is built for human beings,
with human values that shift with the culture over time. And over the last couple decades,
we have found ordinary people increasingly move large and critical portions of their lives to
the digital world: direct lines of communication, banking, work, and so much more. And this shift
in culture makes it all the more important to design our systems in a way that is more secure,
while also not interrupting the flow of daily life as much as possible.
In our designing and engineering, a very common theme pops up: There very
often exists a trade-off between Security and Convenience. This is an idea that needs to be
solidified before we continue our conversation on passwords, and security as a whole, as we,
as well as many organizations, attempt to look for solutions to our security problems.
Let's look to the iPhone for a concrete example. Most phones these days allow you
to unlock it with a 4 digit pin. Other methods exist of course, swipe patterns, 6 digit pins,
facial recognition and fingerprint readers, but we're just going to consider 4 digit PINs for
simplicity's sake. By the way, note that if your phone can be unlocked with two different methods,
for example if it uses a fingerprint reader but also gives you the option to type in a 4
digit PIN, the security of the overall system defaults to the weaker of the two options.
So even if fingerprint readers or Face ID become perfect authenticators over the years,
ultimately your castle is only as strong as the weakest entrance.
A four digit pin has 10,000 possible combinations, meaning guessing at random,
you have a 0.01% chance of guessing correctly on the first try,
and a 0.1% percent of guessing the correct passcode if given 10 tries. But of course,
as humans are, they tend to common PINs, 1234, 0000, 2580, 1111, and 5555 being the most common.
But even if you choose a perfectly random and uncommon PIN,
10,000 combinations is not a lot compared to the numbers we've talked about when
discussing passwords. We've said before that a 6 character password is far too insecure,
especially in this day and age, but even then we were looking at over 700 billion combinations.
So let me ask you the question: Is this secure?
Now this question can be answered in a few ways.
Certainly this iPhone could be more secure. We could just ask a user to type in a password
with letters and numbers and special characters every time they wanted to unlock their phone.
This feature actually already exists now, but if I were to guess,
most of you probably don't use this feature. Even if you didn't know about this feature up until
I just told you a few seconds ago, most of you probably aren't rushing to your security settings
to start making your phones more secure. Some of you, maybe. But a lot of you probably won't.
This Pew Research study is fairly old, but in 2016 the data suggests that only 9% of users unlock
their phone using a password, compared to 25% who used a PIN, presumably of either 4 or 6 digits.
Also note that 28% of people did not use a lock screen at all. Just swipe up, and everything is
open for you or anyone else to use. It’s possible that these numbers have changed over the years,
especially with new, sensitive technology such as paying with your phone for example,
but nevertheless, the feature is still available for those who want it.
And yet, as someone who is fairly mindful of security, this does make sense to me. If you're
unlocking your phone 70 times a day, do you really want to type in a 12 digit alphanumeric password
every single time? Certainly it would be more secure than a 4 digit PIN, But for many people,
the question isn't just about security. The question is, is my device secure enough, relative
to the cost it takes for me to unlock my phone. Does the benefits of mitigating the risk of having
less security on my lock screen and any of the potential damage that may come out of it, outweigh
the cost of putting a little more effort in typing in a longer password dozens of times a day.
For many people, this just wouldn't be a good user experience. To them,
the cost of having lower security with a 4 digit PIN just doesn't outweigh the
convenience of not having to type in a longer password. Most people,
when it comes to this choice about their phone lock screen, choose convenience over security.
Closely related to this tradeoff is the idea of managing risk.
Have too loose of a security system and you run the risk of being attacked,
incurring huge and long term losses. Have too strict a security system, and you'll
be unlikely to actually have a successful feature most people will ever want to use.
Let's actually talk about that trade-off though. Because there is a fundamental difference between
the PIN you use to unlock your iPhone versus the password you use to log into, Twitter for example.
At first glance, it might seem that the iPhone is inherently riskier, after all, if you can break
into an iPhone you kinda get Twitter for free, alongside, well, everything else. And, there’s
an element of truth to this; something that is very important to determining how at risk you are.
But there is a fundamental difference here in that you can log into twitter from anywhere with an
internet connection, but you can only unlock your phone if you physically have it in front of you.
Well, I mean, that's not entirely true, it's a little inaccurate. In security,
and in most things in life, it's almost impossible to claim for certain that something is impossible.
Doing so would imply that you've thought of every single possible thing that could ever happen
ever, and when you have large systems, like let's say, iOS or an iPhone, that's not really a thing.
It is demonstrably true that there have been incredibly dangerous vulnerabilities that have
allowed hackers to remotely and completely surveil or take over a phone. We will get into these
topics because, well, it's great content, but for now you can take a tiny bit of comfort knowing
that in most of these cases, they were very targeted and expensive attacks, and with these
kinds of attacks, a PIN or a password wasn’t going to stop them. For the purposes of this video,
we’re just talking about the security of PINs on your phone and passwords on your Twitter account.
The fundamental point I'm trying to make here is that the main entrance of your
Twitter account is on the internet, the main entrance of your phone is in your pocket.
This is CRITICAL when you're analyzing your risk. In our previous videos, when talking about
cracking passwords, we were referring to websites that were on the internet. The same internet that
is available to billions of people around the world, any of them a potential hacker, free of
national jurisdiction and oversight, free to try and attack anyone from anywhere on the planet.
Your phone on the other hand? The number of people who can attempt to break in is limited to the
number of people who might come within a meter of you. They would have to pickpocket you or steal
the phone right out of your hands, likely in broad daylight, most likely where others, including you,
might catch them. There's also a risk that your kids or siblings or family members or friends
are also potential attack vectors, that you may have to consider, but
this is very clearly a much smaller group of people you have to manage.
This isn't to say that your phone shouldn't be secure against them either. I don't necessarily
want my friends and family to have access to my phone, but I'll take them any day of the week
over some random organized criminal somewhere on the planet who wants to drain my bank account.
Anyways, once this physically nearby person gets their hands on your device,
then and only then, are they able to attempt to break your 4 digit PIN. In the case of
pickpocketers and thieves, this of course is on a very strict time limit. The world may have been
different a decade or two ago, but most people these days will notice that their phone is missing
incredibly quickly. In which case they will be able to track their phone from another device
and lock it remotely, requiring a full password instead of just a PIN to try and unlock it again.
If you can avoid all that, then there's breaking into the phone itself. This step is obsolete if
you already know the PIN of course, but if you don't, you probably know that your phone will
lock you out after a certain number of failed attempts. To break in, you will need to know
of a software vulnerability that Apple or Google doesn't know of, and in many cases will require
specialized hardware. The fact that this kind of hardware even exists might be concerning,
but the fact that any friends or family who are most likely to be within grabbing distance from
your phone will generally speaking not have these tools, should also factor into the risk profile.
Also take into account the scale of attack that can be done on say a database of passwords versus
on a single phone. Hackers can silently and remotely break into a database of millions
if not billions of users' passwords, and if those passwords are unhashed or hashed
without salts, those millions and billions of accounts are immediately compromised.
If a pickpocket steals your phone and has all the tools to break in,
they will have managed to break into one account. If that one person is you,
that of course would be tragic, but the point is it's not a million at the same time.
So is your phone secure? Completely secure? No. Vulnerabilities will
exist in almost every aspect of life that humans touch. The question is,
is it secure enough. With that in mind, the plan that phone companies take is simple:
Give users the tools to adjust how much risk they want to incur in exchange for convenience,
educate everyone about what those risks are, and ultimately let them decide for themselves.
But wait! As a designer and an engineer, there's a lot of room to innovate to make better,
more secure products. Your goal when designing something is to implement
ideas that bring a lot of security relative to the cost of taking those extra measures.
Here, take a look at this. I've laid out a chart detailing the different potential measures you
can use to secure your phone. Items towards the right are considered more convenient,
while those towards the left are less convenient. Items towards the top are considered more secure
or with lower risk while those towards the bottom are less secure, with higher risk.
In this bottom right corner, we have no lock screen. Just swipe up to open your phone.
This is incredibly convenient, so points on that, but obviously not very secure.
Anyone who gets their hands on your phone will immediately have access to, well, everything.
On the opposite corner, the top left, we have long passwords consisting of randomized characters.
This of course can be incredibly secure, but requires you to not only remember this string
in your head, but also have to type it in every single time you want to open your phone. There are
methods to generate secure passwords that are both secure and a bit easier for humans to remember,
but typing in a password will still be a hassle for most people, even if they remember it.
The bottom left corner is irrelevant. You certainly don't want the worst of both worlds.
But of course the ideal here is the top right corner. Some of the most popular features out
there are incredibly convenient to use, while also being quite secure, sometimes even more secure.
State of the art finger print readers and face ID unlock may have their issues,
but are incredibly convenient and can't be stolen as easily as a PIN can just by looking
over your shoulder. Other features like, keeping your phone unlocked while you're in your home
means you remove those security features altogether for convenience's sake,
but in a relatively low risk location, especially if you’re living alone. Stopping your phone from
locking immediately and instead waiting for a minute serves a similar purpose, removing security
features for those times when you unlock your phone multiple times in a short period of time,
but while it is clearly still in your hand and in a fairly low risk state.
Note again that I very closely tie these ideas of risk and security,
because they go hand in hand. The higher the risk, the more I am willing to pay with resources like
time and convenience to mitigate those risks through security. Higher risks can include both
high impact areas, for example your bank account being more important than your Webkinz account,
but also areas with higher probability of an attack, such as being in a public
space or anything on the internet vs being alone in the safety of your home.
The same kind of analysis can be done with many areas of security.
Let's talk about authenticating yourself to an online account.
We've already talked about passwords in previous videos. If you don't securely store your
passwords, using techniques like hashing and salting, passwords will be quite insecure,
but quite convenient to use and also to develop.
Remember, users tend to pick fairly guessable passwords, so even if you invest some of
your development time on properly storing your passwords, although you’ll be much more secure,
ultimately these passwords will be limited by how strong the user makes them, which is usually not
great. For many people, the more convenient their password is, being shorter and easier to remember,
the more insecure it is. Not only that, these users are generally one phishing
email away from handing off their password to a suspicious email link claiming to be Apple.
Of course, choosing long, randomly generated passwords is much more secure.
There's a little bit of an extra cost associated with that, using a password manager,
but overall, something that I personally do and find convenient enough.
But of course techniques like Multi-Factor Authentication, for example sending people
a notification on their phone or a text message to verify their login,
is even more secure than just a password. But of course,
with that extra layer of security also adds an extra layer of inconvenience.
Where's all this leading? Well, we've talked a lot about passwords,
which, even with great techniques, can still be pretty insecure as a whole.
How can we use some of the security of physical devices to our advantage to help
us log into our accounts on the internet with the technology used in multi factor authentication?
And on top of this, is there a way to avoid needing passwords altogether in a way that
is both convenient, but also secure? Soon, we'll discuss some of the innovations surrounding multi
factor authentication, and some of the ideas circulating about passwordless authentication.
For now, thank you so much for all the support for the channel, we're growing fast and we love
that you're here! Always love to read about how these videos are helpful to you in the comments.
Oh, and if your friends are trying to unlock your phone without your permission. Just tell them no.