Hitoshi Kokumai

1年前 · 1 分の読書時間 · visibility 0 ·

chat 著者への問い合わせ

thumb_up 関連性 message コメント

Secret Credential and Computing Power

Secret Credential and Computing Powerhe lock authenticates the key.<br />
The key authenticates the lock.<br />
<br />
  <br />
<br />
Does the key authenticate<br />
the person who holds it?

When the computing power was very limited, we were only able to use texts, namely, characters and numbers, as the secret credential for identity authentication. Now that the computing power is no longer so limited, we could accept non-text credentials such as visual images, audio sounds and tactile sensations where they contribute to better security and/or better usability.

Humans acquired the ability of reading, writing and remembering texts quite recently - a few hundred years ago for the majority of our ancestors. On the other hand, our ability of seeing, watching, finding, distinguishing and remembering visual objects dates back to 5 hundred million years ago. This ability is solidly inscribed at the deep layer of the brains for all of us.

Separately, we know that cognitive science supports that our episodic memory, much of which is visual, is the core of humans’ internal identity.

Would it be possible to not make use of our episodic image memory for our identity assurance?

----------------------------------

What if secret credentials are taken away from digital identity?

Assume that the password has been removed from digital identity. Then digital identity platforms would have only two authenticators - physical tokens and biometrics.

 Biometrics by its nature requires a fallback measure against false rejection, and only the physical token could be the fallback measure for biometrics in this situation. Here we have only two scenarios.

 (1) authentication by a physical token, with an option of adding another token. Its security effect is plainly illustrated above and below.


 (2) authentication by a biometrics deployed in ‘multi-entrance’ method with a physical token as the fallback measure, with an option of adding another token. Its security is even lower than (1) as quantitatively examined at "Quantitative Examination of Multiple Authenticator Deployment"

 We reckon that quite a few professionals of cyber security and identity management are well aware of these facts but something seems to prevent them from speaking out. Possibly, once they had touted those powerless solutions and recommendations to millions of clients, it might be embarrassing to admit the facts.

 But it’s never too late to return. They are expected to speak out.


Click the link for more   https://www.linkedin.com/pulse/removal-passwords-its-security-effect-hitoshi-kokumai/




thumb_up 関連性 message コメント
コメント
Zacharias 🐝 Voulgaris

It's hard enough to change people's minds, let alone their habits! However, it's always worth trying...

その他の記事 Hitoshi Kokumai

ブログを見る