Google sees one password ring to rule them all

Google researchers have proposed a USB key, or even a finger ring, to solve the problems with website passwords

Google thinks it might have found an answer to the vexing problem of forgotten or weak passwords: "physical" passwords, which might come in the form of a piece of jewelry such as a ring.

In a research paper, two of its engineers write that current strategies to prevent the hijacking of online accounts, including the two-step identity verification system, are insufficient, partly due to the constant threat of attacks that exploit new bugs.

Google highlights phishing, in which hackers dupe account holders into revealing sensitive information by making them sign into a fake account login page, as one of the biggest security threats of today.

"It's time to give up on elaborate password rules and look for something better," the authors say. The research paper, by Google's Eric Grosse and Mayank Upadhyay, is to be published Jan. 28 in the publication IEEE Security & Privacy. It was first reported on by Wired earlier Friday.

At the core of Google's proposal is an idea it says has been used by businesses but has found little success among consumers: an encrypted USB-like device that people would use to log into password-protected websites and online accounts.

Google says it is working on an internal pilot with an experimental USB device that users first register with multiple websites where they have accounts. A compliant browser would make two new APIs (application programming interfaces) available to the website to be passed down to the attached device.

"One of these APIs is called during the registration step, causing the hardware to generate a new public-private key pair and send the public key back to the website," the paper explains. "The website calls the second API during authentication to deliver a challenge to the hardware and return the signed response."

The method wouldn't require any software to be installed, though users would need to be using a Web browser that's compliant with the effort, Google said. The registration and authentication protocols would be open and free, and the device would connect with a computer's USB without needing any special OS device drivers.

Basically, the Googlers envision a single device that people can slide into a USB slot and then use to log into any number of online accounts with a single mouse click.

Because carrying around another device may not prove popular among consumers, Google suggests the authentication device could be integrated into a smartphone or even a piece of jewelry. The device would be able to authorize a new computer for use with a single tap, even in situations in which the phone might be without cellular connectivity.

The technology aims to improve upon the company's current, optional two-step verification system. With that system, when users want to log into a Google service from a new computer, they're prompted to enter a code sent to their preregistered mobile phone, granting them access to the site.

The company says its experience with that system has been good, though it too can be abused by account hackers. After they steal a password and break into an account, they sometimes set up a two-factor authentication using their own phone number, "just to slow down account recovery by the true owner," the Google engineers wrote.

Google admits its proposed USB key approach is "speculative" and that it will need to be accepted on a wide scale. But the firm said it is eager to test the device with other websites.

"User device registration with target websites should be simple and shouldn't require a relationship with Google or any other third party," the engineers write. "The registration and authentication protocols must be open and free for anyone to implement in a browser, device, or website."

Google didn't say if or when the experimental system might make it into use. "We're focused on making authentication more secure, and yet easier to manage. We believe experiments like these can help make login systems better," a spokesman said via email.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Internet-based applications and servicesonline safetydata breachAccess control and authenticationscamsIdentity fraud / theftinternetdata protectionsearch enginesmalwareGooglesecurity

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Zach Miners

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?