hey everyone welcome back to today in tech I'm Julia Beauchamp I'm here with
computer world executive editor Ken Mingis as well as computer world senior
reporter Lucas Mearian today we're talking the future of passwords so stick
around
all right Lucas thank you so much for joining us today so we're talking future
of passwords we all we all know and love passwords perhaps we know and love them
I mean perhaps you know in tolerate them but they are they are useful yeah one
may even say necessary but there's obvious password protocols that we all
know we're not supposed to use the same password for everything your password
shouldn't be password or one two three four yeah yeah that's why I live in
large but let's talk a little about what the phyto Alliance is and why Apple has
been the most recent company to join it so tell us a little bit about that it's
a fast online identity Alliance and basically what they're doing is trying
to eliminate passwords all together by using two-factor authentication and we
all probably have dealt with two-factor authentication in one form or another in
our lives so take a cell phone that our smartphone for example you're logging
into your bank account and the bank account server challenges you to give a
biometric code such as a fingerprint scan or facial recognition or it might
even send you requests for a pin and it might send you that information via a
message or an email and then you have to type that pin in so that's the second
factor authentication so recognises the device you're using that's one and then
second one is to challenge the the public-private key challenge to that
device that you didn't have to answer either be a biometric reader or by
entering a payment is this a situation Lucas and this is what it seems like to
me where technology has finally caught up in a way that with like facial scans
or thumbprint fingerprint scans which are theoretically more inherently secure
than just a memorized code now that we've got that especially on mobile
devices that you know this is where why we're going into a different direction
with passwords absolutely I mean basically you become the password your
face that's exactly it I mean unless you're talking about a pin
and that's we've had that capability for a long time where they can where server
can send you a challenge by offering you a PIN number that you
have to enter in my random PIN number but it's it has to do with as I said
before public/private key encryption and but you're right you're correct and as
far as being able to use a biometric scanner to do this we haven't had that
in the past okay so it's technology's catching up and basically being able to
advance where passwords are going exactly and and I think we were talking
yesterday Verizon recently came out with their
mobile security report and there's some pretty startling statistic I was really
surprised yet that story is online right now in computer world if you want to
take a look at it this is the third Verizon mobile security index right
study I got that right so what-what were you finding there what did they find
oh one of the things is that 81% of all security vulnerabilities all secure
hacks are related to either insecure passwords poor passwords or stolen
passwords well either through phishing attacks or whatnot so passwords really
are a vulnerable method of securing a device that's what that's what phyto was
trying to get rid of and there are a lot of it there's a lot of industry support
behind that I've got a list of members that go from Amazon Facebook Google
Intel Microsoft VMware and then you have financial service companies like Amex
and MasterCard and PayPal and Visa and they're all joining this industry
standards group in order to improve security and actually make it a lot
easier for you to log into their websites and applications well easier
and more secure yeah cuz I was just about to say the argument for
multi-factor is that you know you have these perhaps inherently insecure
passwords or your passwords exposed in a massive data breach and if you have
multi-factor enabled you have if even if someone has your login information they
still have to have that code that's text achior emailed to you but that can
sometimes be a little clunky so how is the federal Alliance aiming to sort of
make it more seamless to have multi-factor authentication well one
example I gave you was just that the fingerprint of course yeah so for
example when I log into my bank first I've already registered and that's one
of the prerequisites of using this authentication method ocation method is
to first login to I'm sorry first register
with a site or service and then once you're registered that's when it can
start happening that's when it recognizes the device that you've used
to register and the information you've given it to register that device so when
now a lot when I login to my bank my bache automatically my mobile device for
example I bring up the application the bank application on my phone and it
immediately asks me to scan my fingerprint so first it recognizes the
device that I'm using and then secondly recognizes I'm the owner of that device
and the bank account holder through that fingerprint now I'm logged into my bank
that's much more simple than happy having go in there and type in my
username and my password and it's more secure because it's covered by
encryption right then you don't have to go back figure out what the code that
texted you was exactly yeah it's interesting too one of the things
that you've had written about it when when this Apple Fido tie-up first came
out was that there's this whole movement to also try to build this into browsers
I think it's the web authentication API yeah yeah exactly so it's already
supported two different degrees by Google Chrome Firefox and Microsoft's
edge right so it we are going to be seeing this with browsers as well to
login so the idea being that if you try to log into a site on a desktop using a
browser the browser will also do the same sort of thing where it's its first
checking to make sure that this this device this computer laptop whatever is
registered and then once it does it can kick off that sort of extra layer of
security when you're trying to login whether it's a you know a text or some
sort of message or some sort of way of proving your you yes exactly okay yeah
okay got it and you can imagine how this might improve security for all sorts of
ways I'm not saying that it will but there are possibilities to improve
security by because now it knows who is logging into that site mm-hmm because
you've pre registered so why now what was the draw for Apple to join the
Fighter Alliance now like you said there's so many other enterprises that
have been a part of it for years so what was the what was the motivation here
Apple isn't a big joiner they are but always late they never joined first
for everybody else to join very slow they like to do their own protocols you
know are you lightning actually that's probably Intel is emitter they adopted
it or I mean a lightning connector yeah
Intel invent stuff it's adopted by one company but yeah it's it's but but
that's a good example of you know you're not gonna see the lightning connector on
all the devices they like to use their own protocols so they're there late in
the process and it's still unusual for them because they're not big multi
vendor standard consortium joiners but I think that they saw the groundswell
behind this one and you know I think honestly they they believe it's a good
standard for authentication any sense whether or not you know obviously the
idea of security and mobile devices comes up a lot when you incorporate in
corporate land when you're trying to manage all these devices is there any
sense and this may be beyond what you've reported on so far but I'm just curious
if you know that something like you know the multi-factor authentication that
we're seeing roll out is going to lead to more secure devices and work making
them easier to basically provision and manage yeah that's actually another
trend that's going on I've written about Universal and probably the endpoint
management so Yammer um that basically manages all your endpoints so from
laptops and desktops to mobile devices and what tablets whatever and companies
like MobileIron are now incorporating the same security they had for desktops
into the UM software for all endpoints so I think eventually yeah you're going
to see this for corporate use as well to secure worker devices okay and it's it's
kind of brilliant I mean it's it's a great way of doing it
because each Corporation can have its own public private key authentication so
basically only people would be able to access services that that company would
be employees who have been already vetted basically exactly
and it's an open standard so developers can can use can can modify it for
whatever uses they need okay this no we were talking you know before we went on
the air about the idea of I was asking how does this relate to zero trust and
what is zero trust I mean I know that's not exactly a specific two passwords but
it is about security and levels of security could you just talk for a
second about what zero trust is and how that figure figures into this sure so
zero trust basically means to put a very high level let's say that I'm an
authorized worker who's authorized to login to a corporate system let's say
it's a database but while I'm in that database I start to do something that's
outside the security parameters like I want to copy and paste information in
that database and then email it to somebody and that's not something I'm
supposed to probably no no no no what 0 trust does is it uses machine learning
and artificial intelligence to recognize my behavior and then either warn me or
completely shut me down so log me right out of that site so it actually watches
you as you're logged in to make sure that you're not doing things that
outside the perimeter parameters of that company security protocols
ok so zero trust basically it's sort of an adjunct to them once you're in and
you've been authenticated and prove that you're you that's a next layer above it
that's AI ml sort of power to watch what you're doing exactly sort of wall you
off from things and either stop you or warn you if you try to do something it
doesn't think you should be allowed to just like the soup Cote okay so
everybody has can get the soup but you know if you don't if you don't meet
those days you know what's the right way no soup for you no data for you so
transitioning a little bit back to sort of these security keys obviously the
like you said Lucas the biometric keys are pretty common and commonplace for
anyone like you said with a bank account we're all probably kind of used to them
but I'm a little more interested in to learn about how enterprises are going to
implement this I mean not all physical laptop devices here's mine off camera
has a biometric ability so what are some other ways that they can implement
security keys so we did talk about the pin already so a challenge
okay the other one is they've got this cool little USB dongle companies are
third parties are creating these dongles that you can plug into a USB port and
press a little button and it gives it offers up the private key to the public
key challenge to log you in okay the other cool thing about the dongle is
that if you lose your password it can help you recover it by doing the same by
plugging into the USB port pushing a little button and authenticating you
mmm-hmm that's the other thing so I want to know how far away are we from this
being a completely common place and be from never having to type in another
password right now there it's it's an option on a lot of these sites so but I
think it will gain traction over the next two to three years and I'm hoping
you know over the next one to five years we won't ever have to use passwords well
it is interesting you know when you think about mobile devices in particular
with like face ID there are a lot of sites now that because I'm logged in on
my phone you know the first thing it does when I go to login is does a face
scan yeah so clearly you know and I have a feeling as a lot of these things sort
of emerge from from you know users at home who are bringing their devices in
mobile devices is where it's gonna start before it spreads yeah that's a good
point yeah yeah and I really love it I mean from my bank account I immediately
signed up for it and it makes it so much easier it's moving you're on a mobile
device you don't want to have I hate first of all I don't know how I hate to
save Millennials but I'm gonna say Millennials okay boomer it's true okay
here we go okay but we type so fast but I'm sitting there I'm a picker ww1w my
name and password into a mobile device in order to login on my bank account so
it's so nice to just be able to do a quick thumb scan and okay grams and
begin I know for the record as a millennial yes I type fast but also I
enjoy face ID oh yes I think I might almost be a genzou so there you go
any other thoughts before we let you go about the future of passwords where
we're going I just I think this is a really smart technology and I understand
why all of these kind of industry bellwether companies are joining it
makes a lot of sense especially in light of some of them from
we just saw the Verizon mobile security threat report it's shocking I mean we
one of the things in the report was that I think was four out of ten companies
active resistant yeah he had a sacrifice security for things like making sure
they achieve revenue to save some money yeah save some and save some time and
yeah and because it's complex security can be complex yeah so obviously more
security is gonna be a good thing especially something that's simple to
use you know you have to make it easy to use or people aren't going to use it
that's all for me yeah okay well quick quick programming note Lucas is gonna be
sliding over to the IDC side of the company very shortly so the next time we
have him on it'll be a research analyst studying storage infrastructure saw your
first look at the one I have you know people chided me when I first started
coming and uh you got the storage beat but you know what I really it storages
is evolving faster than processors that's good it always has and I so I
think that's more interesting and not more interesting I shouldn't say it but
just as interesting to you it's more interest it is it's more interesting to
me and so I've always loved storage good ok so we will be having Lucas back at
some point to talk about what's coming in storage obviously there's a lot going
on yes so for now Lucas thanks for being here
juliette thanks for being here yeah a quick reminder if you're watching us on
the youtube channel please subscribe to the channel so you can follow along with
the different episodes and see what's coming up for now I think that'll do it
thanks for watching