Passwords are like the cockroaches of the internet.
They really, despite all of our best efforts, are very hard to kill off.
And companies have been trying to do it for years.
The average office worker in the United States must keep track of between 20
to 40 different username and password combinations.
With so many passwords to remember, it's no wonder why many of us use the
same ones over and over, or have a running list of passwords saved somewhere
on our computers, phones or notebooks.
Passwords are a very serious and expensive security risk.
It's why companies like Microsoft, Apple and Google are trying to reduce our
dependence on them. But the question is, can these companies break our bad
habits? Passwords, by themselves, are just not that
secure. In a 2015 interview with John Oliver, Edward Snowden explained just
how easy it is to crack a typical password.
Bad passwords are one of the easiest ways to compromise a system.
For somebody who has a very common eight character password, it can
literally take less than a second for a computer to go through the
possibilities and pull that password out.
I think we're going to have a no passwords future because it just gets rid
of a lot of problems.
You never know when the bad guy has your password, at the end of the day.
That's Kevin Mitnick. He's pretty well known in the hacker community.
I started off many, many years ago as a black hat hacker.
I wasn't hacking to cause harm or to make money.
It was all about the intellectual challenge, curiosity and seduction of
adventure. And then I pushed the envelope, and I pushed it so far, I became
the world's most wanted hacker.
And I was pursued by federal law enforcement agencies.
And they eventually caught up with me and I ended up serving five years in
federal prison. Nowadays, Mitnick says he's an ethical hacker, assisting
companies to identify their security vulnerabilities and helping to fix
them. And finding your usernames and passwords, it's much easier than you
might think. There's a site out there called weleakinfo.com.
So what weleakinfo is, it's a site that has aggregated a bunch of data
breaches. And so what happens is the data, namely your username and
passwords that are on these data breaches, get aggregated because they're
publicly available.
And there's sites like weleakinfo, that kind of make it like a Google, where
you can actually just put in an email address of yourself or a friend, and
all the prior data breaches that contained your username or your email
address, it actually reveals the password.
All it takes to find the site is a quick Google search, and users can get
access to more than 10,000 data breaches for as low as $2.
And it's not even the only website to offer these services.
Simply put, passwords are not fit for purpose for today's networked economy.
They present challenges to consumers in the sense that they're either hard
to remember or they're too easy to remember, in which case are easier to
mimic and steal. For businesses, they represent a huge liability, in the
sense that the vast majority of data breaches are caused by passwords,
either passwords that slip from an employee and expose a database or allows
other bad actors to get into their systems.
So passwords present challenges across the board.
A report that looked at 2,013 confirmed data breaches found that 29 percent
of those breaches involved the use of stolen credentials.
In another study, researchers found that the average cost of a data breach
in the U.S. was more than $8 million.
And even when passwords are not stolen, companies can lose a lot of money
resetting them. Our research has shown that the average fully-loaded cost of
a help desk call to reset a password is anywhere between $40 or $50 per
call. Generally speaking, a typical employee contacts a help desk about
somewhere between six and ten times a year on password-related issues.
So if you just do the simple multiplication of six to ten times times $50
per call, times the number of employees in your organization, you're talking
significantly hundreds of thousands of dollars or even potentially millions
of dollars a year. And that's just really the IT operations costs, that's
not really factoring necessarily the productivity cost that gets lost by the
user having to wait for maybe 20 minutes, 30 minutes or even longer to
actually have the password issue resolved to their satisfaction.
In large companies like Microsoft, Apple and Google with upwards of 100,000
employees each, these costs can quickly add up.
A former Microsoft executive told CNN in 2018, that the company spends more
than $2 million dollars each month in help desk calls, helping people to
change their passwords.
With the details of our personal and professional lives increasingly
residing in the digital realm, those costs are likely to grow.
The first use of the computer password dates back to the early 1960s at MIT.
At the time, computers were these huge contraptions that could only manage
the work of one person at a time.
This limitation frustrated Fernando Corbató, who came up with the computer
time sharing system.
CTSS was an operating system which distributed a computer's processing power
so that multiple people could use it at once.
This naturally led to the issue of privacy.
So Corbató created the password.
Ironically, the first computer to use passwords was also the first one to be
hacked. One of the researchers in Corbató's lab found that he needed more
time to complete his work than the weekly hours allotted to him.
So he printed out all the passwords stored on the system, and used them to
log in as his colleagues.
The conventional rules of password creation adopted by companies, federal
agencies and universities were attributed to a document released by the
National Institute of Standards and Technology in 2004.
The documents suggested that users should have a minimum of eight character
passwords and that those passwords should include at least one uppercase
letter, one lowercase letter, one number and 1one special character, and be
changed regularly.
But in 2017, NIST rewrote the password rules.
This time, the agency suggested using long, easy to remember phrases instead
of crazy characters, and only changing your password if it might have been
hacked. Passwords have come a long way since the 1960s.
With innovations such as fingerprint readers and face scanning on
smartphones, verifying your identity now often goes beyond just entering a
password. This comes in the form of two-factor and two-step authentication.
There's three forms of authentication.
One is what you know, such as a password or a pin.
The second thing is what you have.
So possession of a device in your hands.
And a third means of authentication is who you are, like a biometric.
The password alone is the highest risk way of authenticating.
And that that leads to phishing and data breaches and all the nefarious
things we see on the web today. Any form of two-factor authentication is
better than passwords alone. What I want to note, though, is that not all
two-factor authentication is created equal.
Things like getting SMS messages, so a text message with a pin code, is both
inconvenient but also can be spoofed and is not a foolproof means of second
factor authentication. NIST even restricted the use of one-time passwords
being sent over SMS as a means of two-factor authentication.
For something to be two-factor versus two-step, the authentication elements
must come from two separate categories.
An example of two-factor authentication is withdrawing money from an ATM.
First, you insert your bank card, something that you possess.
And then you were asked for a pin, something that, you know.
Biometrics are the newest form of authentication and have risen in
popularity thanks to smartphones that include fingerprint readers and
face-scanning cameras.
Meanwhile, digital assistants like Siri, Alexa and Google Assistant have
advanced voice recognition technologies.
In fact, a number of banks, including Chase and Barclays, now allow their
customers to verify their identity using voice biometrics.
When customers call in, their voice is automatically matched to a previously
recorded voiceprint, that's made up of more than 100 characteristics such as
pitch, accent and shape of your mouth.
One organization that's been at the forefront of bringing two-factor
authentication standards to the masses is the FIDO Alliance.
The FIDO Alliance, which stands for, Fast Identity Online, is a consortium
of more than 250 companies who are working together to reduce the industry's
reliance on passwords by standardizing two-factor authentication.
This past year, we've seen FIDO become a core part of the Android and
Windows operating system, meaning that any Android 7 or later handset or any
Windows 10 machine can leverage actual onboard biometrics for that device.
So a fingerprint reader, a face scanner, whatever it might be, to log in
rather than using passwords.
Other companies that work with the FIDO Alliance include eBay, Facebook,
Twitter, PayPal and Bank of America.
Even the U.S. government has adopted the standard.
FIDO's big advantage over other standards comes down to where it stores
users' personal information.
The core problem with passwords is that they reside on a server.
The problem with that is that when it sits on a server, they can be stolen
by a hacker. Additionally, someone can impersonate you quite easily, either
by phishing your credentials or by buying your credentials off the Dark Web
and then trying to stuff them into the account.
Everything FIDO does is local on the device, which does a couple of things.
One, it's easier.
But perhaps most important, it protects your privacy.
So you can always change your password if it's hacked.
But you really can't take your face back.
You can't take your fingerprint back.
So it's very important that companies that are using biometrics use
local-match biometrics, meaning match-on-device, which is what FIDO supports
to protect user privacy and have enhanced user experience.
Microsoft has been hinting about getting rid of the password for years.
Let me move over to my Surface Pro 4.
I don't know if you noticed what happened.
It recognized that I was just standing in front of the computer and it
logged me in. And this is the power of Windows Hello.
Where it does the face recognition and logs you right in.
I mean, think about one of the biggest issues of security is passwords.
So one of the things that we are working on is a world where passwords are
not going to be the ones that, you know, get hacked.
But you really have other biometrics that really help us secure our
computing interfaces.
Microsoft sees 6.5
trillion hacking incidents per year.
That's why 90 percent of its employees can now log into the corporate
network without a password.
We are on a mission to be password less.
We've built password less technology into the OS.
And we tell customers, of course, that it's much more secure than actual
passwords because about 70 percent of phishing attacks today still are
caused by stolen passwords.
So what we've recommended is that customers use biometrics.
At Microsoft, we use Windows Hello for business.
I look at my computer to log on in the morning.
That's how I authenticate. If I'm on my phone, I'm using my thumbprint.
We don't see our passwords anymore because that is, the user and the
password or the weakest link in your security system.
Microsoft introduced Windows Hello to customers in 2015 with its devices
running Windows 10. Windows Hello allowed users to ditch the password and
log into their devices with just their face, fingerprint or pin.
Like FIDO, Microsoft has said it stores user biometrics on the device
instead of on a cloud.
In 2018, Microsoft announced that it would support logging into Windows 10
with FIDO2 compatible devices, such as hardware keys made by Yubiko.
We've been on a mission to eliminate passwords altogether.
And, you know, we're focusing on passwordless log in experience that's both
secure and the user friendly.
And we've seen a lot of success with our authenticator app for consumer.
And so we'll bring that to Azure AD.
Microsoft Authenticator is an app that allows users to take advantage of
two-factor authentication on any device, not just those running Windows 10.
Alex Simmons, Vice President of Microsoft's identity division, said in a
tweet that the company has more than 80 million unique monthly users that
sign in with a passwordless method.
Apple's been encouraging the use of biometric authentication since it came
out with Touch ID on the iPhone 5S back in 2013.
The company called Touch ID the gold standard for consumer device biometric
protection until it introduced Face ID on the iPhone X in 2017.
And the data for Touch ID has been 1 in 50,000, meaning that the chance that
a random person could use their fingerprint to unlock your iPhone has been
about 1 in 50,000 and it's been great.
So what are the similar statistics for Face ID?1
1 in a 1,000,000. Back in 2016, Apple also introduced Auto Unlock, a feature
for MacOS. Today, when you first approach your Mac to use it, the experience
is something like this. You open it up, you're confronted with a password
field, and you type and then maybe mistype, and then retype your password,
and then you're in and using your Mac.
But you know, for many of us, we already have a device securely
authenticated to our wrists that already knows who we are and could tell our
Mac. And so then, when we open our Mac, it could be a little bit more like
this. In its guidelines to app developers, Apple stresses that apps should
support biometric authentication whenever possible and that apps should only
ask for a username and password as a fallback, if the first method fails.
Google has also been working to make passwords a thing of the past.
The company has required its employees to use physical security keys since
early 2017, and has seen a huge reduction in phishing.
In August of 2018, the company released Titan to consumers.
Titan is a physical key that allows users to take advantage of two-factor
authentication on their computers or smartphones.
In 2019, Google announced that phones running Android 7 would all come with
a built-in security key using Bluetooth.
A few months later, Google extended that function to iOS devices, meaning
that iPhone and iPad users could now use their secondary Android smartphones
as a security key whenever logging into their Google accounts on an iOS
device. While Microsoft's Windows 10 devices and Google's new Android
devices are FIDO2 certified, Apple has been slower to adopt the standard in
its products. Even though Touch ID and Face ID made biometric authentication
the norm for unlocking our phones, Apple's devices are still not FIDO
certified. But Apple is making strides.
Of late, Apple's been supporting FIDO technology both on iOS and on MacOS.
So the latest versions of their operating system support FIDO, meaning that
if you're accessing a website that supports FIDO on an Apple device, you'll
be able to leverage FIDO authentication as well.
The Department of Justice has also been moving away from password
authentication. The agency adopted a single-sign-on method back in 2017.
One of the reasons why passwords persist is that they are universal, they
can be used by anyone.
There are no limitations.
There's no special hardware requirements.
You don't have to have a certain kind of phone or certain kind of laptop.
Anyone can use passwords. There are a few key challenges to really moving
beyond being dependent on passwords.
One of them is technical, and that's FIDO has been seeking to address.
And we've now created the technical standards that are web standards for
authentication that does not depend on passwords.
Another challenge is behavioral.
And we've been trained with this risky way of authenticating using
passwords. We'll have to be untrained to use simpler, but new mechanisms for
logging in. So I think there'll be some behavioral changes that need to take
place, some education.
You know, the good news is these are changes are for the better and for the
simpler. And so, we think that people will embrace these changes at the same
time as new technologies roll to market to enable us collectively, on the
whole, to move beyond passwords.
Experts say that getting rid of the password will be a long journey,
especially when it comes to getting people to ditch their bad habits.
The consumer approaches will be very much opt-in.
In other words, if users actually want strong authentication, companies will
be able to provide it to them, but just because it's available, doesn't mean
that every customer is going to go for it.
You may now need to start collecting information about the user like a
mobile phone number that you need to use to communicate with them.
And perhaps users don't want to provide that information or they're
reluctant to. On the consumer side, I believe passwords will be slower to
get rid of. Which also means that the risk of breaches of consumer sites
will persist for the foreseeable future.