Posted on 03/12/2013 1:24:54 PM PDT by Red Badger
The world’s largest search engine is now experimenting with jewelry that would eliminate the need to remember dozens of passwords.
As part of research into doing away with typed passwords, Google has built rings that not only adorn a finger but also can be used to log in to a computer or online account.
The search and ad company first revealed its plans to put an end to passwords in an academic paper published online in January (see “Google’s Alternative to the Password”). The effort focused on having people plug a small USB key that provides their credentials into a computer. The possibility of using special jewelry in a similar manner was mentioned in that paper.
At the RSA security conference in San Francisco last month, Mayank Upadhyay, a principal engineer at Google who specializes in security, became the first person at Google to speak in public about that research. He said that using personal hardware to log in would remove the dangers of people reusing passwords or writing them down. He also thought people would feel some familiarity with the approach. “Everyone is familiar with an ATM. What if you could use the same experience with a computer?”
Upadhyay said that Google’s trial was focused on a slim USB key that performs a cryptographic transaction with an online service to prove the key’s validity when it’s plugged into a computer. The key also has a contactless chip inside so that it can be used to log in via mobile devices.
Tokens like the ones Google is testing do not contain a static password that could be copied. The cryptographic key unique to the device is stored inside and is never transmitted. When the key is plugged in, it proves its validity by correctly responding to a mathematical challenge posed by the online service it is being used to log into, in a way that doesn’t produce any information that could be used to log in again.
Speaking after the session, Upadhyay said that the company also had a prototype ring that could take the place of a password token, although he didn’t give details on how it works. “Some people are not comfortable with a [USB] token,” he said.
Google is already talking with other companies to lay the groundwork for using the technology to access different services and websites. “It’s extremely early stages, and we’re trying to get more partners,” said Upadhyay. Talks have already started with the FIDO Alliance, a consortium that in February launched technology intended to enable new methods of secure log-in that rely less heavily on typed passwords (see “PayPal, Lenovo Launch New Campaign to Kill the Password”).
“The other cool thing, which we’re really pushing for, is that it’s just built into the browser, so that you don’t have to bother installing middleware or anything else,” said Upadhyay. “We want to have the case where you could just go to your friend’s house and it just works.”
Google already offers a more secure log-in service called two-factor authentication, which involves a person entering a one-time code sent to their cell phone each time they log in. However, only an estimated 1 percent of Google’s users have adopted it, and Upadhyay says most people consider it too much effort to use.
Upadhyay didn’t say which company supplied the hardware at the core of the new trial, but the features he described are identical to a USB security key called the NEO made by Yubikey, a California company that launched in late 2012. Consumers can buy a NEO for $50, although companies buy them in bulk at lower prices.
Tech Ping!.............
Uh, huh. And when that ring gets stolen, or “borrowed” by your kids ... ???
For years I’ve had a chip in my brain stem so I can receive my marching orders directly from the Manchester Union Leader and the Wall Street Journal editorial page.
I prefer Google’s 2-step model instead. You get an app for your phone and then it provides one time passwords when you login. Works well and you don’t need anything intrusive.
"The Ring! I can't believe you fell for the oldest trick in the book! What a goof! What's with you man? Come on! You know what? Here let me give it back to you."
[throws it down the grate] "Oh, look, you fell for that too! I can't believe it, man!"
Bill Loeb is dead, and the paper ain’t the same. Could’ve been worse, at least you didn’t go with National Review.
The end of anonymity online, and also one short step from an implanted chip.
First smile of the day! Thanks!
Better get one of these......
Shall I name mine “The Precious”, or “Isildur’s Bane”? Decisions, decisions .....
Retina scans will be next........
Oh I’m sure that Google would just love to get all my passwords loaded into a device they designed.
It’s never going to happen though.
Sauron hoping to create millions of Nazgul?
"Ash nazg thrakbatuluk, .....
Agh burzum-ishi krimpatul!"
Howzat?
I am SURE that little USB ring is COMPLETELY waterproof, shockproof, etc., so you can wear it all the time, shower with it, work with it, swim with it, etc., right?
And it will almost NEVER be lost, stolen or misplaced.
Dumb idea.
Uh, how about when it gets stolen, broken or dropped in the toilet? How do you log on to report it stolen and get a new one? How many tax dollars will be spent to give another bling-bling to the welfare scum and how much will the working stiffs have to fork over for it? No, thanks.
Hotlinked, of course, to your gene sequence, Social, federal LE and DHS files, and RW 4D location at that instant.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.