Total Soft Tech
  • Home
  • Products
    • Acqua
    • Houra
    • Med+
    • Vitta
  • About Us
    • Total SoftTech Company Profile
    • Who We Are
    • Management Set Up
    • Management Team
    • Words from the CEO
  • Careers
  • Contact Us
  • Privacy Policy
  • Home
  • Products
    • Acqua
    • Houra
    • Med+
    • Vitta
  • About Us
    • Total SoftTech Company Profile
    • Who We Are
    • Management Set Up
    • Management Team
    • Words from the CEO
  • Careers
  • Contact Us
  • Privacy Policy

Blog

HomeSoftware NewsGoogle sees one password ring to rule all
9a9aa311e93a896b73df914601aa5a48

Google sees one password ring to rule all

by Soloiston 21 January 2013in Software News No comment

Google researchers have proposed a USB key, or even a finger ring, to solve the problems with website passwords

Google thinks it might have found an answer to the vexing problem of forgotten or weak passwords: “physical” passwords, which might come in the form of a piece of jewelry such as a ring.

In a research paper, two of its engineers write that current strategies to prevent the hijacking of online accounts, including the two-step identity verification system, are insufficient, partly due to the constant threat of attacks that exploit new bugs.

Google highlights phishing, in which hackers dupe account holders into revealing sensitive information by making them sign into a fake account login page, as one of the biggest security threats of today.

“It’s time to give up on elaborate password rules and look for something better,” the authors say. The research paper, by Google’s Eric Grosse and Mayank Upadhyay, is to be published Jan. 28 in the publication IEEE Security & Privacy. It was first reported on by Wired earlier Friday.

At the core of Google’s proposal is an idea it says has been used by businesses but has found little success among consumers: an encrypted USB-like device that people would use to log into password-protected websites and online accounts.

Google says it is working on an internal pilot with an experimental USB device that users first register with multiple websites where they have accounts. A compliant browser would make two new APIs (application programming interfaces) available to the website to be passed down to the attached device.

“One of these APIs is called during the registration step, causing the hardware to generate a new public-private key pair and send the public key back to the website,” the paper explains. “The website calls the second API during authentication to deliver a challenge to the hardware and return the signed response.”

The method wouldn’t require any software to be installed, though users would need to be using a Web browser that’s compliant with the effort, Google said. The registration and authentication protocols would be open and free, and the device would connect with a computer’s USB without needing any special OS device drivers.

Basically, the Googlers envision a single device that people can slide into a USB slot and then use to log into any number of online accounts with a single mouse click.

Because carrying around another device may not prove popular among consumers, Google suggests the authentication device could be integrated into a smartphone or even a piece of jewelry. The device would be able to authorize a new computer for use with a single tap, even in situations in which the phone might be without cellular connectivity.

The technology aims to improve upon the company’s current, optional two-step verification system. With that system, when users want to log into a Google service from a new computer, they’re prompted to enter a code sent to their preregistered mobile phone, granting them access to the site.

The company says its experience with that system has been good, though it too can be abused by account hackers. After they steal a password and break into an account, they sometimes set up a two-factor authentication using their own phone number, “just to slow down account recovery by the true owner,” the Google engineers wrote.

Google admits its proposed USB key approach is “speculative” and that it will need to be accepted on a wide scale. But the firm said it is eager to test the device with other websites.

“User device registration with target websites should be simple and shouldn’t require a relationship with Google or any other third party,” the engineers write. “The registration and authentication protocols must be open and free for anyone to implement in a browser, device, or website.”

Google didn’t say if or when the experimental system might make it into use. “We’re focused on making authentication more secure, and yet easier to manage. We believe experiments like these can help make login systems better,” a spokesman said via email.

 

for more information where Total Soft Tech Solutions Inc. gets its news.

visit link below:

www.computerworld.com

Share this article
0
0
0

Written by Soloist

The author didnt add any Information to his profile yet

previous article

Microsoft to raise Windows 8 upgrade prices

next article

Obama takes forceful stand on climate & tech

Leave a Comment

Cancel reply

You must be logged in to post a comment.

News

  • Games and diversions dominate mobile apps use
  • Will more smartphones support Facebook Home?
  • Dell to release new Windows tablets later this year
  • Oracle brings data center fabric to Sparc systems
  • Groups say ICANN unprepared for gTLD launch

About Us

  • Careers
  • Management Team
  • Management Set Up
  • Who We Are
  • Words from the CEO

© Copyright 2015 - Total Softtech Solutions Incorporated.