From Baruch New Media
Jump to: navigation, search

Authentication

"Authentication" refers to a process which verifies the identity of a person or software in order to help protecting the privacy of a unique individuality and securing otherwise sensitive information.

Password protection.jpg

Problem

While authentication technology is continuously improving, hacking prowess is also increasing as well. Many individuals have had their online accounts hacked or compromised at least once. Possible causes are that users create a weak password or use the same password across multiple online accounts, or it can be on the company's side in which it relates to the form that the user's password is stored on the website.

In 2013, there were two main problems regarding authentication. The first one was an instance of user privacy vulnerability at Adobe. It was a matter of great concern and shock to many people and was also an alert to many companies when Adobe announced that over 3 million of their users' private information was leaked to the public. Due to this incident, many firms were able to find out that a lot of Adobe's customers also used the same password for their websites as well. This incident helped to encourage more internet users to use different passwords for different online accounts on various websites. [1]

The second news is the lack of security on the Google Chrome internet browser. Elliot Kember, a software developer, blogged about how Google Chrome stored the user's password as plaintext which is the easiest form that can potentially be hacked into by malicious individuals. Kamber explained how it easily could be done just by logging onto one's computer, going to Chrome, and then to "Password settings". Every password that is stored on Chrome will appear on the screen as plaintext. [2]

New Technology

As the hacking problem is increasing, many companies have been developing advanced technologies to use in the authentication process to help minimize the risk of losing important information to hackers. The security and privacy of data became a very important matter and computer scientists as well as data scientists are finding new and innovative ways to prevent hackers from infiltrating private information and breaching company databases.

Blockchain

Introduced in 2008, Blockchain technology allows the transactions of data without the need for trust or for a central authority. A blockchain is a distributed ledger technology (DLT); transactions between two parties are efficiently recorded in a verifiable and permanent way. Data in a blockchain is not stored in a single location. Everyone participating in the blockchain owns the same information. Transactions are recorded as blocks with time stamps and is added onto the "chain" when the data is verified by everyone. Blockchain is reliable, transparent, faster, simpler, and safer. [3]

Yubikey

Press-key.jpg YubiKey body-602x412.png

Yubikey was created in 2007 by a newly found technology company called “Yubico”. Yubikey is a mini chip that looks similar to USB, but smaller. It is also known as a two-factor authentication which means that it has something that a user knows and something that a user has. For someone to steal a user’s information, that person needs to have the Yubikey chip, and he needs to know the user ID as well. The thing that makes Yubikey stands out from others is the master password function. The master password or One-Time Password (OTP) function is a 44-character and single-time use password with 128-bit encrypted public ID. It combines a user ID along with unique code and counter. Yubikey is a friendly and easy use device. A user can plug the chip into the USB spot, and the device is ready to be used. [4] [5]

Bracelet

Bionym-1.jpeg Bionym-Lifestyle.jpeg

Bionym Inc. Developed a new authentication technology called Nymi. Nymi is a plastic bracelet that uses a person’s heartbeat to replace a password. The bracelet encodes a user’s electrocardiogram (EKG) and uses that as a passcode for the bracelet to start accurately functioning. When a person wears Nymi, it will sync his/her heart beats to the device then measure whether a person who wears the bracelet is the original owner of it. If the electrocardiogram matches with the data in the bracelet, then the user can start using it. The bracelet was created not only for a password related purposes but mainly for all authentication purposes. It can be used to replace a car key, unlock the house, and control the bank account. Nymi can be easily active by touching the silver button on the bracelet for a while until it vibrates. Once the bracelet vibrates, that means the verification is confirmed, and the device can now be used or is currently in use. Yet, Nymi is in the market. However, people can pre-order Nymi on Bionym website, and the bracelet should be shifted sometime in 2014. [6]

Tattoo

Motorola-tattoo.jpg

Motorola is currently working on a new project of having an electronic tattoo on people’s skin as an authenticable tool. Motorola vice president, Regina Dugan, announced to the world that her and her technology team are developing an effective and realistic tattoo to use for identification purposes as an alternative way of traditional way of authentication. This tattoo will have temperature sensors, ECG sensors, EEG/EMG sensors, photo detectors, wireless antenna, and wireless communication oscillator. With this electric tattoo, the users don’t have to worry that they might forget their passwords or lose the authentication device anymore. Although, the tattoo is hard to remove, it is not permanent. This idea is still in developing process. [7] [8]

Pill

Motorola-pill.jpg

Regina Dugan is continuously looking for a better way of verifying identity by creating an authentication pill. She said that the pill is similar to vitamin supplement. People can it daily to replace other types of authentication. When a person swallows a pill into the body, the pill will create an 18-bit ECG signal inside the body that can pick up the connection from outside the body. By taking this pill, a person can be considered as an authentication token. The entire body can send and receive a signal from a phone, a tablet, etc. Again, this idea is also in the beginning process and it is not a legal way of authentication in the United States yet. [9]

User Authentication: Smartphones

The possession many would perhaps posit as something they couldn’t function without is their smartphone. Throughout the years the smartphone has morphed from being a device that can simply make/take calls, send/receive messages, store telephone numbers, and access the internet. Nowadays the smartphone can do much more. For many, it is the prime storage unit for most of our valuable personal information. People oftentimes store addresses, bank information, and intimate photos on their handhelds, to name a few. This being said, it is of utmost importance that individuals keep what is stored on these devices confidential.

Lockscreen.jpg

Throughout the recent years, smartphone companies have placed user authentication at the forefront when developing their newer devices. In a time not so long ago, all it took was a swipe to unlock a smartphone. The first main addition to the smartphone that added the necessary security people wanted was the PIN code feature. This feature was recognized as a fast and easy way for daily authentication [10]. The phones that wielded that newer feature were the very first models of the iPhone and Samsung Galaxy. The PIN code began with a four-digit maximum. This was certainly an advancement from the simple swipe because a potential intruder would have to guess from about 10,000 possibilities to access your smartphone [11]. With the introduction of the PIN some years ago, there was more certainty that the person accessing the phone was definitely the owner. However, some loopholes were still prevalent, forcing the leading smartphone companies to push on in their advancements.

The PIN quickly became outdated due to several reasons. To begin with, many people choose PIN numbers that are easy to remember since they have to memorize this code to access their phones on a frequent basis. Because of this fact, PIN numbers tend to be predictable, perhaps consisting of consecutive numbers, a birthdate, patterns etc. A second reason society needed more than the PIN number was because people often unlock their phones in public, amongst others. If you unlock your device in a semi-public setting you are susceptible to having your PIN code exposed to strangers. This “shoulder surfing” is something that is unwanted and people you don’t know could see what digits are being tapped to unlock your device.

The technological advancement that solved the issues discussed above was the creation of fingerprint scanners. The first and most archaic way fingerprints were used to unlock phones was through optical scanners. This kind of scanner captured an image of the fingerprint the user chose to select using LED lights and algorithms to capture certain patterns [12]. This feature was seen as early as 2011 from the company Motorola but it was made mainstream by companies such as Apple and Samsung two years after its birth [13]. The age of fingerprint scanning hasn’t completely become obsolete since it is still heavily used today. There have been updates though, to increase its effectivity.

Capacitive Scanner Diagram

The kind of scanner most have in their smartphones now is the capacitive scanner. A diagram of how it works is seen in the illustration above. Capacitive scanners are found in the most advanced devices on the market. Unlike its predecessor, it doesn’t rely on just an image. The capacitive scanner uses a plethora of capacitor circuits to collect various data about a fingerprint. To explain, the optical scanner does find and remember certain qualities of the fingerprint. What is captured using an optical scanner is more of a 2-dimensional picture. The capacitive scanner stores a 3-dimensional picture of the fingerprint. It remembers distinctive and unique attributes about the fingertip used to unlock the phone making it nearly impossible to bypass if you aren’t the owner of the device.

Face.jpg

Recently, phones such as the iPhone X and the Samsung Galaxy Note 8 has gained interest and appeal from the masses over both of these new devices experimenting with a different and more secure form of user authentication. Facial recognition was introduced by both companies in 2017. To unlock your phone using facial recognition, your device can remember particular qualities found on your face and use them to unlock your phone. Facial recognition software observes the geometry of the face by measuring the space between the eyes and the distance from one ear to the other. Apple calls their use of this technology "Face ID" in its devices. The company has stated that the probability of a random individual unlocking your iPhone X using Face ID is one in 1 million [14].

Ultrasonic In-Display Fingerprint Scanners

SamsungGalaxyS10FingerprintScanner.jpg

Having been under development since the development of the Samsung Galaxy S8, the Samsung Galaxy S10 and S10 Plus devices are one the first smartphones available with an ultrasonic in-display fingerprint sensor. Unlike the existing fingerprint scanners that are photographic or capacitive-based, ultrasonic fingerprint scanners use of very high-frequency ultrasonic sound to scan the user’s fingerprint when a finger is rested onto the scanner.

The way that this technology works is by using sound pressure waves to read the surface of the user’s finger to create a 3D image. Through an ultrasonic pulse being transmitted against the finger when slight pressure is applied, some of this pressure is absorbed and some of it is bounced back to the sensor as a 3D reproduction of the distinctive characteristics of one's fingerprint. The scanner creates an image of finger's ridges, pores and other details that are unique to each individual's fingerprint. There is also a sensor detects the intensity of the returning ultrasonic pulses at different areas of the scanner. The ultrasonic sensor has about a 1% error rate, which is similar to the more common in display scanners. [15]

As reviewed by The Verge, the S10’s fingerprint scanner is highly responsible to a user’s touch, and just placing the correct finger on the bottom one-third of the device’s screen will allow for the phone to be unlocked in a quick manner. The intensity of placing one’s finger onto the scanner also does not matter, as even a light touch will unlock the device. [16]

One drawback of this new technology is that not all glass and polyurethane screen protectors will work with the ultrasonic scanner. Samsung has attempted to minimize this downside by pre-installing a screen protector onto their S10 line of smartphones. [17] The Samsung Galaxy S10 starts at $899.99, and the larger screened Samsung Galaxy S10 Plus starts at $999.99.

References

  1. Yadron, Danny. "After Adobe Hack Other Sites Reset Passwords." The Wall Street Journal.11 Nov 2013: < http://blogs.wsj.com/digits/2013/11/11/after-adobe-hack-other-sites-re-set-passwords >.
  2. Kobie, Nicole. "Google Puts a Stop to Chrome Password Snooping." Technology, News, and Reviews. 5 Nov. 2013. <http://www.pcpro.co.uk/news/security/385192/google-puts-a-stop-to-chrome-password-snooping>.
  3. Rosic, Ameer. "What is Blockchain Technology? A Step-by-Step Guide For Beginners". <https://blockgeeks.com/guides/what-is-blockchain-technology/
  4. "KeePass & YubiKey." KeePass. Web. <http://keepass.info/help/kb/yubikey.html>.
  5. "Technical Description." Yubico Technical Description Comments. Web. <http://www.yubico.com/products/yubikey-hardware/yubikey/technical-description/>.
  6. Subramanian, Courtney. "NewsFeed." NewsFeed Nymi Bracelet Turns Heartbeat into a Password Comments. 4 Sept. 2013. Web. <http://newsfeed.time.com/2013/09/04/nymi-bracelet-turns-heartbeat-into-a-password/>.
  7. Gross, Doug. "Google Patenting an Electronic 'throat Tattoo'" CNN. Cable News Network, 13 Nov. 2013. <http://www.cnn.com/2013/11/12/tech/innovation/google-throat-tattoo/>.
  8. Woollaston, Victoria. "The Hi-tech Tattoo That Could Replace ALL Your Passwords: Motorola Reveals Plans for Ink and Even Pills to Identify Us." Dailymail. N.p., 30 May 2013. Web. <http://www.dailymail.co.uk/sciencetech/article-2333203/Moto-X-Motorola-reveals-plans-ink-pills-replace-ALL-passwords.html>.
  9. Botezatu, Loredana. "Motorola Presents Authentication by Tattoo and Pill." HOTforSecurity RSS. N.p., 4 June 2013. Web. <http://www.hotforsecurity.com/blog/motorola-presents-authentication-by-tattoo-and-pill-6342.html>.
  10. https://www.medien.ifi.lmu.de/pubdb/publications/pub/zezschwitz2015chi_a/zezschwitz2015chi_a.pdf
  11. https://www.esecurityplanet.com/mobile-security/unlocking-smartphones-pins-patterns-or-fingerprints.html
  12. https://www.androidauthority.com/how-fingerprint-scanners-work-670934/
  13. https://www.moneysupermarket.com/mobile-phones/timeline-new-phone-features/
  14. https://us.norton.com/internetsecurity-iot-how-facial-recognition-software-works.html
  15. https://www.androidauthority.com/how-do-ultrasonic-fingerprint-scanners-work-666053/
  16. https://www.theverge.com/2019/2/20/18232113/samsung-galaxy-s10-plus-fingerprint-sensor-screen-reader-ultrasonic-protector
  17. https://mashable.com/article/samsung-galaxy-s10-s10-plus-pre-installed-screen-protector/#jxoCTvDH_PqX