Sunday, January 11, 2009

Beyond Passwords: Lessons from the G1

When my wife came home with the new T-Mobile G1 (the Google Android-based HTC Mobile phone), I took a peek at it and thought it was pretty cool.

One thing that caught my attention immediately was the password feature to unlock the phone. Instead of typing in a PIN like I do on my Windows Mobile phone, my wife uses her finger to make a pattern on the grid. Instead of a PIN that someone can guess with enough tries (granted, my phone wipes itself after 8 tries) you can put in a patter on the grid which is nearly impossible to "guess"... that got me thinking.

With all the hacking that's happened in the past several weeks, most notably the annoying Twitter hack that filled up my news inbox... and all the associated "passwords" talk that went around - I wondered what would happen if Twitter had this same kind of security as my wife's G1. Interesting.

What I have been saying for at least 2 years now, and I'll repeat here again is this: passwords are so 5 years ago. Designers of software and systems need to move beyond passwords, no matter how complex, because they're all useless. So many attacks, password-stealing trojans and other attacks would be thwarted if the designers of these systems simply thought a little more intelligently about the security of their system.

Sad, really... a consumer-based handset has better security than most high-technology, high-volume, high-net-worth, high-security web sites.

3 comments:

Stephan Wehner said...

You wrote, "What I have been saying for at least 2 years now, and I'll repeat here again is this: passwords are so 5 years ago."

Sorry, could you provide some pointers to alternatives?

Stephan

Rafal said...

@Stephan - Yes, I would welcome the move to more complex or less 'breakable' mechanisms of authentication such as this one that the G1 uses. The term "password" has come to mean a simple word or numerical combination, which is terribly inept. Here then, are some alternatives I think are viable (aside from the one the G1 uses):
1) http://blogs.techrepublic.com.com/hiner/?p=439 - under "Vidoop’s legitimate alternative to passwords"
2) http://www.newscientist.com/article/dn9016 - a great idea from PassFaces
3) http://www.itbusiness.ca/it/client/en/home/news.asp?id=49115 - even something as trivial as a "pass phrase"

There you have 4 legitimate options, that I feel should be adopted more and more simply because passwords cannot be legitimately trusted anymore.

I'm actually going to do a write-up on this shortly so if you're interested in discourse, or contributing please email or IM me.

Vaclav said...

Hi Rafal.
Yes, indeed the current system of passwords is so .... inadequate. Just because you make it longer and more complex, doesn't make it safer.
I have two blog posts on that exact topic.
http://www.pcis.com/web/vvblog.nsf/dx/would-you-give-me-your-password-for-a-candy
and
http://www.pcis.com/web/vvblog.nsf/dx/can-you-spot-the-password

Vaclav

Google+