Alternatives to password authentication technique (Research essay)

The common belief is that passwords have become the weakest spot in modern security chain (Febrache, 2016). Several years of research concluded that passwords have essential security problems and may frustrate a considerable number of users (Bonneau et al., 2012). The aim of this essay is to review existing authentication techniques, evaluate their main differences and demonstrate the importance of password authentication in the near future.

 

The most popular authentication technique is entering a user name with a password However, majority of passwords are weak: easy to remember, thus, easier for dictionary and rainbow table attacks, since they consist of words and not of random symbols (Evans, 2018). Nonetheless, passwords have a list of advantages: they do not require a physical token; they are easy to learn, it is easy to understand how passwords work; and can be used on all platforms. Main disadvantages of passwords are: memorising effort, threat of physical observation, threat of phishing, threat of dictionary or rainbow table attacks (Bonneau et al., 2012).

 

There are three main approaches to authentication: to use the information user keeps in memory, for example password, pass phrase; to use a physical object, for instance plastic card, mobile phone; to use user’s behaviour or biometrical data, such as fingerprint, face scanning. However, such approaches are only more secure if they are combined together (Febrache, 2016). This is referred to as two/three factor authentication, for example an online payment, when bank sends user a code in SMS before the transaction is made, though user has entered the details of the physical token or banking card. Such approach guaranties higher level of security.

 

Some popular alternatives to passwords are graphical passwords, biometrical authentication, using password managers (Bošnjak and Brumen, 2019). Graphical passwords are considered to be easier to remember and to reduce memorizing effort. However, it requires more storage space and more time to authenticate. Moreover, graphical passwords are still weak against dictionary and brute-force attacks (Suo et al., 2005). Biometrical authentication is easy-to-use, and it eliminates the need to memorize information. However, the most concerning problems are possible data breaches that may lead to reidentification of users and deployment challenges. Most platforms are not able to implement and use biometrical authentication yet (Bošnjak and Brumen, 2019). Password managers minimise memorizing effort but suffer from lack of deployability, that affects convenience of use. Furthermore, using password managers either restricts user to one device or to one particular service. Moreover, it makes a user use a third party which may have that security implications (Bošnjak and Brumen, 2019).

 

In summary, current alternatives to passwords are not seemed to solve security problem and to replace passwords in near future. For instance, graphical passwords do suffer from the same security threats as text passwords. However, the most common problem of alternative authentication approaches is low deployability. There are a number of devices that cannot support biometrical authentication such as stationary desktops without webcam and other equipment, except a keyboard and a mouse. The most effective way of authentication may be developed by combination of different approaches of authentication and introducing two and three step verifications, but ultimately passwords are here to stay.

 

Reference:

Bonneau, J. et al. (2012) ‘The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes’, in. 2012 IEEE Symposium on Security and Privacy, San Francisco, CA, USA: IEEE.

doi:10.1109/SP.2012.44.

 

Bošnjak, L. and Brumen, B. (2019) ‘Rejecting the death of passwords: Advice for the future’, Computer Science and Information Systems, 16(1), pp. 313–332. Available at: https://doi.org/10.2298/CSIS180328016B (Accessed: 27 October 2021).

 

Evans, L. (2018) Cybersecurity: What do you need to know about computer and Cyber Security, Social Engineering, The Internet of things + An Essential guide to ethical hacking for beginners.

 

Febrache, D. (2016) ‘Passwords are broken – the future shape of biometrics’, Biometric Technology Today, 2016(3), pp. 5–7. Available at: https://www.sciencedirect.com/science/article/pii/S0969476516300492 (Accessed: 27 October 2021).

 

Suo, X., Zhu, Y. and Owen, G.S. (2005) ‘Graphical passwords: a survey’, in. 21st Annual Computer Security Applications Conference, Tucson, AZ, USA: IEEE. doi:10.1109/CSAC.2005.27.