Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

BLOG: Usable identification - the key to a world without passwords

Ian Yip, Security specialist, NetIQ | Nov. 27, 2013
Security is the enemy of usability.

In the case of authentication however, there is the cost consideration that was not present in the consumer identity federation equation. How can we put stronger authentication factors in the hands of consumers in a cost effective manner? Ideally, we would make consumers buy these tokens, but who would want to do that just for a bit of extra security and a more disjointed user experience? Enter large, well-known consumer brand with the requisite influence.

Apple, the king of making technology usable is that organisation. Their announcement of the Touch ID fingerprint sensor on the iPhone 5s is the latest (and loudest) in a recent spate of devices that have the potential in helping achieve the right balance of usability, cost and security at scale. Rich Mogull's article on TidBITS is the best one I've read if you want to understand some of the security aspects.

Beyond Cupertino, there are a few recent developments that will hopefully be caught up in the Apple authentication snowball that is rolling down security mountain:

Nymi is a device which wraps around our wrist and uses our unique cardiac rhythm to authenticate and identify us to things around us. There are unknowns around how or if this will actually work, including some more knowledgable about cardiac rhythms than I, who remain sceptical. Dave Kearns however, is a little more enthusiastic, as are most other people on Twitter. I for one, hope it actually works because the potential scenarios are interesting, exciting even.

Let's not forget about the impending barrage of smart watch releases over the next year, starting with Samsung's Galaxy Gear. Apple of course, has also been working on the rumoured iWatch. Even car manufacturers like Nissan are clamouring to wrap themselves around our wrists. While smart watches aren't inherently security devices, they are effectively another token that could be used in the authentication process. For example, the fact that a smart watch is mine and is paired with my smart phone (or car in the case of Nissan) at the point of identification (authentication) gives the system identifying me a level of assurance that I am who I claim to be.

As with any new technology, there are potential security implications that need to be analysed and I'm sure this will be done by many when the devices are made available to the general public. But Apple Touch ID, Nymi, smart watch manufacturers and other wearable devices we have yet to hear about have the potential to make security invisible.

Security is the enemy of usability. Studies have shown that when presented with a secure option or an easy option to perform a task, people almost always choose the easy option. The trick is to make the easy option also the secure option. The devices mentioned aim to make our lives better. The fact that they have the potential to make our lives easier while improving security is exciting.

Here's to a future where we don't need passwords, but can stay secure while remaining blissfully ignorant of that fact.


Previous Page  1  2 

Sign up for CIO Asia eNewsletters.