Skip to comments.Google Wants to Replace All Your Passwords with a Ring
Posted on 03/12/2013 1:24:54 PM PDT by Red Badger
The worlds largest search engine is now experimenting with jewelry that would eliminate the need to remember dozens of passwords.
As part of research into doing away with typed passwords, Google has built rings that not only adorn a finger but also can be used to log in to a computer or online account.
The search and ad company first revealed its plans to put an end to passwords in an academic paper published online in January (see Googles Alternative to the Password). The effort focused on having people plug a small USB key that provides their credentials into a computer. The possibility of using special jewelry in a similar manner was mentioned in that paper.
At the RSA security conference in San Francisco last month, Mayank Upadhyay, a principal engineer at Google who specializes in security, became the first person at Google to speak in public about that research. He said that using personal hardware to log in would remove the dangers of people reusing passwords or writing them down. He also thought people would feel some familiarity with the approach. Everyone is familiar with an ATM. What if you could use the same experience with a computer?
Upadhyay said that Googles trial was focused on a slim USB key that performs a cryptographic transaction with an online service to prove the keys validity when its plugged into a computer. The key also has a contactless chip inside so that it can be used to log in via mobile devices.
Tokens like the ones Google is testing do not contain a static password that could be copied. The cryptographic key unique to the device is stored inside and is never transmitted. When the key is plugged in, it proves its validity by correctly responding to a mathematical challenge posed by the online service it is being used to log into, in a way that doesnt produce any information that could be used to log in again.
Speaking after the session, Upadhyay said that the company also had a prototype ring that could take the place of a password token, although he didnt give details on how it works. Some people are not comfortable with a [USB] token, he said.
Google is already talking with other companies to lay the groundwork for using the technology to access different services and websites. Its extremely early stages, and were trying to get more partners, said Upadhyay. Talks have already started with the FIDO Alliance, a consortium that in February launched technology intended to enable new methods of secure log-in that rely less heavily on typed passwords (see PayPal, Lenovo Launch New Campaign to Kill the Password).
The other cool thing, which were really pushing for, is that its just built into the browser, so that you dont have to bother installing middleware or anything else, said Upadhyay. We want to have the case where you could just go to your friends house and it just works.
Google already offers a more secure log-in service called two-factor authentication, which involves a person entering a one-time code sent to their cell phone each time they log in. However, only an estimated 1 percent of Googles users have adopted it, and Upadhyay says most people consider it too much effort to use.
Upadhyay didnt say which company supplied the hardware at the core of the new trial, but the features he described are identical to a USB security key called the NEO made by Yubikey, a California company that launched in late 2012. Consumers can buy a NEO for $50, although companies buy them in bulk at lower prices.
Uh, huh. And when that ring gets stolen, or “borrowed” by your kids ... ???
For years I’ve had a chip in my brain stem so I can receive my marching orders directly from the Manchester Union Leader and the Wall Street Journal editorial page.
I prefer Google’s 2-step model instead. You get an app for your phone and then it provides one time passwords when you login. Works well and you don’t need anything intrusive.
"The Ring! I can't believe you fell for the oldest trick in the book! What a goof! What's with you man? Come on! You know what? Here let me give it back to you."
[throws it down the grate] "Oh, look, you fell for that too! I can't believe it, man!"
Bill Loeb is dead, and the paper ain’t the same. Could’ve been worse, at least you didn’t go with National Review.
The end of anonymity online, and also one short step from an implanted chip.
Just buy one of these:
First smile of the day! Thanks!
Better get one of these......
Shall I name mine “The Precious”, or “Isildur’s Bane”? Decisions, decisions .....
Retina scans will be next........
Oh I’m sure that Google would just love to get all my passwords loaded into a device they designed.
It’s never going to happen though.
Sauron hoping to create millions of Nazgul?
"Ash nazg thrakbatuluk, .....
Agh burzum-ishi krimpatul!"
I am SURE that little USB ring is COMPLETELY waterproof, shockproof, etc., so you can wear it all the time, shower with it, work with it, swim with it, etc., right?
And it will almost NEVER be lost, stolen or misplaced.
Uh, how about when it gets stolen, broken or dropped in the toilet? How do you log on to report it stolen and get a new one? How many tax dollars will be spent to give another bling-bling to the welfare scum and how much will the working stiffs have to fork over for it? No, thanks.
Hotlinked, of course, to your gene sequence, Social, federal LE and DHS files, and RW 4D location at that instant.
Don’t use Google! It’s a spy agency! I sent an email to a friend talking about his getting an emergency generator for his home. 15 minutes later I sent another email, and there were ads for generators on the right side of the page.
Use this search engine, which doesn’t track your id, ip, and no cookies;
Better than rectum scans.
All your password belong to us!
There’s already little thumb print readers that do the same thing. It doesn’t really replace your passwords so much as enter them for you.
No mugger has ever stolen people’s rings, of course. </S>
It probably is actually. Probably it’s just a RFID, the actual USB part is a RFID reader that detects you have the appropriate RFID.
As for not losing it, well that’s on you.
“Everyone is familiar with an ATM. What if you could use the same experience with a computer? “
ATMs are a pain in the ass to use!
I won’t wear a ring and don’t want to carry any hardware, keys in my pocket are bad enough.
Well now, only need a portable implant to respond to the challenge so that no man could buy or sell without the 666 association.
Wow, a magic decoder ring for real! The ones I used to send in cereal box tops for always turned out to be lame.
With a retinal scan, you press your eye against the scanner.
With a a rectal scan, you press your ... well you get the idea.
The next time you see someone missing a finger it will be some idiot that fell for Google’s ring and the thief cut off their finger to get their ring!
What ding-a-ling thought this one up??
The people at Google have obviously never worked around machinery.
Still a stupid idea.
Thieves will be able to rip your RFID code off your ring; they already have problems with that with RFID credit cards. You have carry them in metal wallets to protect them from readers.
Anything readable WILL be ripped off by today’s hackers and thieves.
Oh, my no. We have a particularly stubborn vendor who insisted on using it after I'd replaced the servers it used to attach to. Ever try to find a parallel card that will fit a blade server? They finally - and grudgingly - came up with a "newfangled" USB key that had to be reseated at every reboot. We're now on an open-source competitor. Sheesh.
It’s not really a big deal. The fact is the reader will be connected to your computer, if thieves have gotten access to your computer already they don’t need the ring. They can just take the computer and use any of the million ways to get around/ learn your passwords at their leisure.
Sounds great, until Frodo-like amputations start to show up as a common crime MO.
No, hackers can actually pull RFID codes from the chip without accessing the computer. It really is a stupid idea.
But that gives them nothing. Now they have the RFID, without the reader on the other side all they’ve got is a big long number. It’s not like the credit cards where there are readers all over the place. For this the reader controls access to your computer, go to some other computer with something spoofing as your RFID and nothing happens.
In India there is a project to photograph everyone’s pupils in the near IR for ID purposes. That’s 1.8 billion people!
lol .. Yup !
Hal, open the pod door.
Check out this decoder ring:
I like these better:
“Uh, huh. And when that ring gets stolen, or borrowed by your kids ... ???”
Well, that wouldn’t be a problem in “the hood”, since no one would be able to figure out which ring is the hot one.