This video has been a long time coming. Like many of you, I’ve gone through the
different stages of passwords. The first is to use banana123 on every site I sign up to.
The second is… to stick to that until I get hacked, and then to change it to
orange123 in the hope that that’s safer. I’ve never ‘got’ how people can devise a
system that gives them a different password per site. I imagine it’s kind of like, if the site
is facebook, you shift your fingers over by one key so that it becomes gsvrnppl… followed by 123.
Just to be sure. Like that’s going to protect you if one of the passwords is ever leaked!
I don’t get the obsession with making passwords impossible to remember. My favourite passwords
have been long, easy to remember ones. Sentences like ‘bananasarelesssecurethanoranges’.
In my mind, this is secure, though my faith is frequently shaken by people who seemingly
think that, because it’s easy to remember and to type, that it must be insecure. Do
they not understand the billions of combinations required to guess that phrase? (Especially if the
last word starts with a capital letter?) And websites don’t help with this notion-
they insist that we must use at LEAST one lower and upper case letter, one number, one symbol,
and one superscript symbol to ensure I absolutely cannot remember it, nor type it on anything but a
scientific calculator. This makes the problem ours, not theirs. Actual security be damned.
So these days, I’ve gone one step further still by deliberately NOT knowing any of my passwords!
They’re all 64-symbol long copy+paste jobs. I still receive audible gasps when I say ‘I don’t
know my password’. Which to me, says more about everybody else’s passwords than it does my own!
And if I’m ever tortured for information, I will be well and truly screwed.
It means that, when I’m in the middle of nowhere and am challenged on the spot to access something
on my phone, I inevitably have to resort to an email reset, which makes me feel my email is
the weak spot of my security. But it isn’t; the weak spot is those sites I sign up to,
who manage to get leaked with alarming frequency because they went and did something stupid like
to store my 64-digit-mega-password in an open txt file somewhere.
In short: I hate passwords. And things have only got worse in recent years.
A website will demand I use an authenticator app, before confirming I got it right but that
it isn’t good enough and that I need to check my backup email, which in turn tells me it’s
suspicious activity and that I must confirm from a SECOND backup email, which asks me for my Mother’s
maiden name which clearly I fabricated because I don’t trust scammers not to know that information
at this point, which in turn asks me to check my phone for a text code, which doesn’t come,
so then I request another one and the first one comes through and I enter that and it’s wrong and
then I have to do the whole process again! Add to that how using a VPN counts as
‘suspicious activity’ and demands I sign into literally every site I’ve ever visited again,
and at this rate… I’m just going to go back to using banana123 again. Beyond a certain point,
increased security just encourages people to be stupid again. I don’t know if I have 2 factor
authentication enabled on a site, because to me, it already feels like at least 10!
The only way it could get worse is if it somehow implemented
blockchain technology in some erroneous way. Rant over. Like I said, this video’s been a long
time coming. Now onto this video’s actual purpose. A passwordless collaboration between LOTS of big
companies, including the important ones, looks to make FIDO a man’s best friend.
Using this new system, when you need to login to a site, something will pop up on your phone
requiring you to finger-print or to face-scan your identity. This system already exists,
but the difference with this is… …it uses blockchain technology.
Just kidding. It uses Bluetooth to confirm that your two devices are physically near
each other when this happens. This is to cut out on phishing attempts from across the internet,
which in THEORY, should finally, prevent 4chan from accessing your amazon account.
I know what you’re thinking: IS THAT IT? Blutooth to prove devices are close to one another?
That sounds like something I could have thought up! But I guess the difficulty isn’t in devising a
new standard, but in getting everybody to use it. And like I said, all the big players are onboard
with this one, so that’s the hard bit done. All the information required is stored as a
single token, on all of your verified devices. So the hope is that you’ll always have something,
somewhere that’s verified, otherwise I’m not sure what happens. What if I’m abroad,
and equipped with only one device? Don’t worry- I’m sure there will be a company somewhere that
devises some remote emergency dual-device restore system of some kind to undermine the whole system!
But what do I know. I’ll put my faith in FIDO knowing what it’s doing. I hate that, up till now,
my PC has been treated like a second-rate citizen. My phone is the one getting all the cool updates,
apps and security confirmations that itself can confim, using nothing but my fingers and FACE.
Meanwhile, my PC isn’t trusted by anything, and it is forever requiring permission from my phone
to access anything I do! This new system looks to even the playing field by finally giving my PC the
permission to confirm stuff on my phone. How it’s going to do that without a webcam or fingerprint
scanner is anyone’s guess. Maybe it’ll ask me for my Mother’s maiden name, which I suspect was
harvested on facebook 10 years ago when I did that challenge to identify what kind of fruit I was.
Yes, I’m cynical, because I’m ignorant. But I’m all for measures being taken
to make life easier for humans. Do you remember all those horrible ‘prove you’re not a bot’ tasks,
which were swapped out for Google’s simple button you clicked to prove you’re a human?
Yeah, that was great… until they realised they could instead use your clicks to train driverless
cars to identify signposts and busses. Let’s hope FIDO doesn’t meet the same, grizzly fate.