Speaker 1: Brought to you by Toyota. Let's go places. Welcome to
Speaker 1: Forward Thinking. Hey there, and welcome to Forward Thinking, the
Speaker 1: podcast that looks at the future and says they've given
Speaker 1: you a number and taken away your name. I'm Jonathan Strickland,
Speaker 1: I'm Lauren bo and I'm Joe McCormick. And that was
Speaker 1: a good one, Jonathan, thank you. Once in a while,
Speaker 1: I do, I do pick a good one. Well, you
Speaker 1: might have guessed, if you're quite perceptive, from what Jonathan
Speaker 1: just said that today we're going to be talking about passwords. Yeah,
Speaker 1: and not the not the game show password, which is
Speaker 1: unfortunate because I used to love that. I don't know
Speaker 1: what that is. Wow, you well, you're just like from
Speaker 1: the nineteen six Yeah, I was back when I was
Speaker 1: back when I was old, just a lad in the
Speaker 1: year of Our Lord eight hundred and forty two. All right.
Speaker 1: So anyway, oh Joe, now that we've revealed that I am,
Speaker 1: in fact islander and I battle to the end of
Speaker 1: time for the prize, what about passwords did you want
Speaker 1: to bring up? Well, I wanted to look at the
Speaker 1: future of passwords, as we often look at the future
Speaker 1: of things on this show. Because I think the state
Speaker 1: of passwords today is unsustainable. I could not agree with
Speaker 1: you more. Now, the way we typically go about our
Speaker 1: lives today, if we use a lot of online services,
Speaker 1: we use online banking, online credit cards, email, social networking,
Speaker 1: video streaming, you might have, you know, twenty five fifty passwords.
Speaker 1: I mean, who knows how many different things you have
Speaker 1: a password for. Maybe a lot of these things are, uh,
Speaker 1: these kinds of services online where you might only use
Speaker 1: them once a year or even less often. But you
Speaker 1: had to create an account with a password in order
Speaker 1: to do something one time, and so you end up
Speaker 1: with this huge list of accounts and passwords you've created,
Speaker 1: and it is so annoying to remember all these things,
Speaker 1: and sometimes not just annoying but impossible to a certain number.
Speaker 1: And if you are making your passwords sufficiently complex and
Speaker 1: and different from each other, because that's part of the
Speaker 1: thing about passwords, you know, we're not supposed to use
Speaker 1: the same password twice for any of these dozens and
Speaker 1: dozens of accounts. Well you should tell that to the
Speaker 1: millions of people out there who well maybe you're telling
Speaker 1: them right now, So good job, Lauren. The millions of
Speaker 1: people out there who do use the same passwords over
Speaker 1: and over again. And it's worse than that because they're
Speaker 1: not even necessarily using a strong one, right. Most people
Speaker 1: are using really, really sad, horrible weak passwords that are
Speaker 1: super easy to guess. There's actually a digital security company
Speaker 1: called splash Data that releases a list every year of
Speaker 1: what it claims are the twenty five worst passwords of
Speaker 1: that year, and it's gathered from quote files containing millions
Speaker 1: of stolen passwords pos stood online during the previous year.
Speaker 1: That's creepy, That's great, Okay, So obviously a the worst
Speaker 1: password would be probably like the most popular and easiest
Speaker 1: to guess password, the ones that everybody's using. So I
Speaker 1: checked out the list and coming in at the top
Speaker 1: of the pack, where a few winners like one five six, password,
Speaker 1: Quarty six seven, and the highly clever one one one
Speaker 1: one one one. Also making the top twenty five were
Speaker 1: some I thought weirder candidates, such as monkey Shadow and Princess.
Speaker 1: I will I will refrain from commentary about monkey Princesses,
Speaker 1: but now I gotta change my password. Oh no. Another
Speaker 1: one was like let me in. I like that. There's
Speaker 1: this kind of like magical spell kind of quality. Do
Speaker 1: it the thing or it's just the thing you start
Speaker 1: screaming at your computer when you just wanted to work.
Speaker 1: Let me in also has sort of a kind of
Speaker 1: survival horror vibe to it too. There's a lot of
Speaker 1: different ways of looking at this. I started that. So
Speaker 1: the state of password generation when you leave it up
Speaker 1: to the user is really horrible these days. Yeah, and
Speaker 1: this really does manifest in insecurity problems. Well, and even
Speaker 1: if you are diligent, maybe several of our listeners out
Speaker 1: there are really trying very hard to manage really complex
Speaker 1: passwords that don't fall into these simple traps and uh,
Speaker 1: but doing so, they're using different passwords for each one. Yeah,
Speaker 1: this gets hard. I mean it's, first of all, a
Speaker 1: strong password is by definition difficult for you to remember
Speaker 1: because it's complex, al right, It's it's not a single word,
Speaker 1: and any word that's in the dictionary is classically a
Speaker 1: very poor password. It's easy for a computer to guess. Yeah. Yeah,
Speaker 1: it's called a brute force attack. That's when you're just
Speaker 1: essentially or a dictionary attack. That's a specific type of
Speaker 1: brute force attack where you just take a database of
Speaker 1: words which could be simply a dictionary, and you run
Speaker 1: that through when you're trying to crack someone's password, and eventually,
Speaker 1: if you're using a real word, that's gonna pop up. Now,
Speaker 1: a dictionary attack in reality goes well beyond what words
Speaker 1: you're going to find the dictionary. It's gonna come up
Speaker 1: with words that appear on these lists. Like you were
Speaker 1: talking about Joe, those those words, those numbers, whatever, those
Speaker 1: happen to be the worst ones. You can guarantee that
Speaker 1: those are going to be in those kind of databases.
Speaker 1: And so if you are doing everything right, you're probably
Speaker 1: having to rely on some other piece of technology to
Speaker 1: manage all those because we're just not equipped to remember passwords.
Speaker 1: Like a really strong passwords going to be at least
Speaker 1: eight characters long, probably longer than that. It's going to
Speaker 1: incorporate upper and lower case letters, it's going to incorporate numbers,
Speaker 1: and if the system allows you will probably incorporate some symbols.
Speaker 1: Not all do so. In fact, there are strong password
Speaker 1: generators that only work with letters and numbers because not
Speaker 1: all systems will accept ye like an AD symbol or
Speaker 1: hashtag or something like that. Yeah, And there are some
Speaker 1: pieces of software that help people deal with this short.
Speaker 1: Some people have like browser plug ins. I use one,
Speaker 1: for example, because otherwise I wouldn't be able. I do
Speaker 1: have a unique password for every single service I use,
Speaker 1: but only because I have this password manager. If I
Speaker 1: didn't have that, there's no way I could do this, right,
Speaker 1: But of course that has limitations also, right, Like that's
Speaker 1: on your machine, But what if you need to go
Speaker 1: use a different machine. Minds web based, so I can
Speaker 1: actually use it as long as there's a browser to
Speaker 1: log in from from any browser you can, or you
Speaker 1: can also use an app on your phone to get
Speaker 1: around this. But at any rate, Yeah, it's not a
Speaker 1: really great solution to the overall problem. It's a good
Speaker 1: bandage exactly. It is a bandage. It's not a it's
Speaker 1: not a It doesn't fix the underlying issue, which is
Speaker 1: that passwords have these limitations, and we're quickly coming to
Speaker 1: a point where to make a password that's workable requires
Speaker 1: so much effort that it defeats the purpose of having
Speaker 1: a password. No one will want to use the service. Yeah. Well,
Speaker 1: I think we should look at one more aspect of
Speaker 1: the state of passwords before we look at the future
Speaker 1: of passwords. There was a c s I D survey
Speaker 1: as a as a data and security company. Yeah, so
Speaker 1: like the company I mentioned earlier was also a secret company.
Speaker 1: So they have sort of an interest in getting people
Speaker 1: this information about how bad things are. Right. It's an
Speaker 1: interesting report. I read through it. It's actually a very
Speaker 1: short report that that lists what they found. They survey
Speaker 1: US adults, so people eighteen and older. They found that
Speaker 1: six people reuse the same passwords on different sites, which
Speaker 1: is a huge problem because if one password is um
Speaker 1: is caught. Like if if hackers are able to find
Speaker 1: that one password and you're using it for multiple services,
Speaker 1: they have access to all the services to use that
Speaker 1: password for. Yeah, that's a bad, bad scene right there.
Speaker 1: They also found that the age bracket of eighteen to
Speaker 1: twenty four year olds was the most guilty of doing
Speaker 1: this at seventies six percent, which kind of goes against
Speaker 1: what you would think. You know, again, we we have
Speaker 1: this perception, or at least maybe I should say I
Speaker 1: have this perception. I am a member of Generation X,
Speaker 1: and I remember growing up with computers, and so when
Speaker 1: I grew up with computers, I became very educated about
Speaker 1: computers because it was a new thing. It was fascinating
Speaker 1: and I really took to it. But my uh, you know,
Speaker 1: my my savvy, my tech savvy is kind of limited
Speaker 1: to in a way, what I was experiencing when I
Speaker 1: was growing up. You know, I still have to learn
Speaker 1: all this new technology stuff that's coming out that other
Speaker 1: people who are growing up right now, that's their world.
Speaker 1: So I have this perception that people growing up now
Speaker 1: are more savvy at using technology and they use it better,
Speaker 1: and they use it more effectively and more securely than
Speaker 1: I do. But that doesn't seem to be the case.
Speaker 1: I did read a statistic that, um, I think from
Speaker 1: the same report that the eighteen twenty four year old
Speaker 1: demographic is more likely to lock their mobile device. Yeah,
Speaker 1: the next sense because it's something that they have with
Speaker 1: them all the time and they use more frequently than
Speaker 1: a computer. Yeah, I mean, still an issue. It's still problematic. Absolutely.
Speaker 1: Um what else? What else did the study find? They
Speaker 1: found that of people used five or fewer passwords for
Speaker 1: all their stuff. Now, they didn't have a follow up
Speaker 1: to say how many services these people typically use. If
Speaker 1: you're using five services and you have five passwords, congratulations,
Speaker 1: you're doing it right. If you use twenty five services
Speaker 1: and you have five passwords, you need to rethink your
Speaker 1: security approach. Um. But they also set found that only
Speaker 1: six percent had twenty or more passwords of the folks
Speaker 1: they survey. Now, again, without knowing how many services you're using,
Speaker 1: you don't know if those that six percent is like
Speaker 1: the actually most secure. But we can kind of draw
Speaker 1: some general conclusions of the respondents say they change their
Speaker 1: passwords once a year or not at all. So, uh,
Speaker 1: just under half never change their password or only do
Speaker 1: it once a year. You're supposed to do it more
Speaker 1: frequently than that. That's another thing that's really irritating about
Speaker 1: passwords is that a lot of services recommend you do
Speaker 1: this regularly. Fun little peek behind the curtain. This morning,
Speaker 1: when I logged in, I had to change my local
Speaker 1: password on my computer. Were mandated to do that. Princess Monkey, Princess,
Speaker 1: It's not just princess. It's okay, I'm going to change
Speaker 1: it before the end of this podcast. Uh. Now, nine
Speaker 1: of the respondents. Despite despite these findings, respondents, to be fair,
Speaker 1: that they weren't aware of what the findings were yet
Speaker 1: felt that their behaviors were secure. That's the worst artistic
Speaker 1: in here, because it means that they think that what
Speaker 1: they're doing is good enough, and it clearly is not.
Speaker 1: But you know, it's kind of like the the surveys.
Speaker 1: I don't know if you guys have ever looked at
Speaker 1: the ones about the supertaskers, where like the supertaskers, everybody
Speaker 1: thinks that they can multitask. There's like it's like two
Speaker 1: of the population, but believe they are in that two percent,
Speaker 1: which doesn't work. It's kind of like that, I can't
Speaker 1: remember the percentage now, but there's this overwhelming percentage of
Speaker 1: drivers who believe they are above average drivers. Right, it's
Speaker 1: all those other idiots on the road that they are
Speaker 1: the problem. Right. Yeah, Now you might wonder, out of
Speaker 1: these people, how many of them had actually experienced any
Speaker 1: issues with their accounts being compromised, having a security issue. Yeah,
Speaker 1: more than one in five. And now, granted, security issues
Speaker 1: can become a a problem even if you are doing
Speaker 1: everything correctly. If something on the back end is compromised,
Speaker 1: then you know, you don't have any control over that.
Speaker 1: But we're focusing mainly on the stuff that we as
Speaker 1: end users would have some sort of control or some
Speaker 1: sort of interaction in order to unlock our services. Right,
Speaker 1: So I think now we should transition to looking at
Speaker 1: the future of passwords. What is this gonna look like
Speaker 1: for the the user of the future when you log
Speaker 1: onto your machine, or maybe you're not using a computer,
Speaker 1: when you're just trying to get access to some kind
Speaker 1: of sensitive information or private service, what are you gonna do? Well, there,
Speaker 1: we can look at some of the more recent developments,
Speaker 1: some things that are are currently happening, and then kind
Speaker 1: of build out from there. I think that will work.
Speaker 1: And so one of the stories I wanted to mention
Speaker 1: was a guy named Sam Crowther and Australian who came
Speaker 1: up with a clever app that uses pictures for your passwords.
Speaker 1: So if you were to sign up for a web service,
Speaker 1: you would open up this app. You have a collection
Speaker 1: of pictures there, and you think, the picture of a
Speaker 1: hamburger that's gonna be my Gmail password from now on.
Speaker 1: You know, you don't tell people that clearly, but when
Speaker 1: you press the little hamburger picture, it actually generates a
Speaker 1: five hundred and twelve character long password that's so long
Speaker 1: that there is not any you know, foreseeable problem with
Speaker 1: that getting cracked. Unlessquantum computers come online tomorrow, in which
Speaker 1: case it's total different. Yeah, it's a different conversation. But
Speaker 1: at any rate, Uh, you know, behind the scenes, what's
Speaker 1: going on is just a password that's being generated. But
Speaker 1: it's a password that's so strong that there's just no
Speaker 1: human who would be able to learn it. Um, you know,
Speaker 1: at least no, let me say, a very small population
Speaker 1: of humans. Perhaps I shouldn't underestimate human ability, but it
Speaker 1: was I thought it was a really clever and elegant
Speaker 1: solution this idea. And the pictures are going to always
Speaker 1: be displayed in a different layout when you open the app,
Speaker 1: so you're looking for the Hamburger picture, but it's not
Speaker 1: always going to be in the same place. That way,
Speaker 1: if someone sees you use your phone to access a
Speaker 1: web service or whatever, uh, and they see, generally speaking,
Speaker 1: where that person touched the screen, that's not going to
Speaker 1: be useful information the next time that that app is open.
Speaker 1: So if someone does get hold of your phone, they
Speaker 1: won't necessarily be able to access the services. Um. The
Speaker 1: best part about the story was that the guy is
Speaker 1: eighteen years old. He's a young and who came up
Speaker 1: with this idea. Very clever. Wow, And to imagine what
Speaker 1: I was doing, I was creating very weak passwords and
Speaker 1: act when I was When I was eighteen, I didn't
Speaker 1: even know about the world. The World Wide Web didn't
Speaker 1: exist when I was eighteen, and I didn't know much
Speaker 1: about the Internet at all. So I really wasn't making
Speaker 1: weak best words to a couple of years. You hadn't
Speaker 1: had the opportunity to get your identity still, No, no,
Speaker 1: I would take a couple more years. Oh yeah, the
Speaker 1: Industrial Revolution still had to happen. Kay. Sorry, sorry, Ok,
Speaker 1: you guys are so lucky. You took it too far.
Speaker 1: You guys are so lucky. I left my katana at
Speaker 1: my desk, all right. Um, there there are, of course
Speaker 1: services that let you log in UM directly through something
Speaker 1: like Gmail or Facebook. You know, as long as the
Speaker 1: computer that you're on is signed into one of those services,
Speaker 1: the system just checks for that log in and then
Speaker 1: signs you in automatically UM, which is of course less
Speaker 1: secure than entering a separate, awesome password for every website
Speaker 1: that you're on. But but I think that that's kind
Speaker 1: of the direction that a lot of people are thinking
Speaker 1: of going as as we start moving into the future. Yeah,
Speaker 1: I'd say on the opposite end going forward, something that's
Speaker 1: going to be less convenient but more secure is two
Speaker 1: factor verification, which Gmail does have available if you enable it.
Speaker 1: And I haven't enabled online which is Facebook or something, Yes, yeah,
Speaker 1: that's exactly right. Yeah, And and in fact I haven't
Speaker 1: enabled on that too, which means every time I try
Speaker 1: to log into my Gmail or Facebook account from a
Speaker 1: different computer, I also have to make sure I have
Speaker 1: my phone with me, because two factor verification is all
Speaker 1: about sending an extra message on some other medium than
Speaker 1: what you're going through in order for you to be
Speaker 1: able to verify you are who you say you are.
Speaker 1: So if I put in my Gmail password, I try
Speaker 1: and sign into any of the other computers here at
Speaker 1: the office, and I put in my password, I know
Speaker 1: my password. Everything's cool. I hit enter. That doesn't get
Speaker 1: me into my account. What does is Gmail will send
Speaker 1: me a text message onto my phone which will have
Speaker 1: a code in it, and I have to put that
Speaker 1: code in before Gmail will allow me access to my account.
Speaker 1: So the thinking here is that you have to have
Speaker 1: two things, not just something that the person knows the password,
Speaker 1: but something that the person owns smartphone, so it's it's
Speaker 1: an idea that is supposed to increase security because the
Speaker 1: likelihood of someone having both of those things is lower
Speaker 1: than having just access to one or the other. Right,
Speaker 1: So that does address half the problem the security concerns,
Speaker 1: but it doesn't really address the convenience factor, right, And
Speaker 1: that's where Google is starting to play with a few
Speaker 1: automatic versions of two step verification. Their employees, for example,
Speaker 1: use these little USB dongles that, when when they're plugged
Speaker 1: into a computer, will authenticate the user. They've also been
Speaker 1: talking about Android phones ability to to unlock themselves when
Speaker 1: they're in the bluetooth presence of a device that belongs
Speaker 1: to the same owner, like, for example, a smart watch. Cool.
Speaker 1: So well wait a minute, so if someone stole both devices,
Speaker 1: that would suck. That would suck really hard. M However, Well,
Speaker 1: it's really the same thing with with with two step verification,
Speaker 1: Like if if someone has if someone has your address
Speaker 1: or your your your password and your phone, uh and
Speaker 1: the and your phone is unlocked, then it's you forget it.
Speaker 1: I mean it's that this sort of security measures they
Speaker 1: have to work on a baseline, uh uh, you know,
Speaker 1: belief that the physical machines are at least secure. If
Speaker 1: you have had a physical machine stolen, then there are
Speaker 1: a lot of issues here, and it's not you know,
Speaker 1: this is just for we have to make sure that
Speaker 1: the baseline is what is safe, you know, and then
Speaker 1: we can start to look into further issues, like if
Speaker 1: someone takes your phone. A lot of these phones also
Speaker 1: go into a sleep mode that have to you know,
Speaker 1: they require an access code or some other form of
Speaker 1: verification or to wake up. So that's the security measure
Speaker 1: for those devices. Yeah, it helps. It's not necessarily a
Speaker 1: perfect system. Um. As of October, though, you can totally
Speaker 1: buy a US Speaky of the sort that Google's employees use,
Speaker 1: and if you pair it up with Google Chrome on
Speaker 1: your physical computer, you can use it to log into
Speaker 1: your Google account, which which is a pretty nifty little
Speaker 1: piece of technology considering it's running for like eighteen bucks
Speaker 1: retail or something. It's not bad. So is that is
Speaker 1: that only for Google accounts though? Yes? So I wonder
Speaker 1: if something like that would ever be possible to log
Speaker 1: into all your accounts. I'm sure you could get something
Speaker 1: like that. I mean, they're like when I was talking
Speaker 1: about my web based password manager, you could probably get
Speaker 1: a physical us beat stick type thing that essentially follows
Speaker 1: the same same pattern. But then if you lose that,
Speaker 1: then you're in trouble. So it's you know, having a
Speaker 1: physical thing to lose makes it tricky, uh that you know,
Speaker 1: it's not a it's not the ideal solution because again,
Speaker 1: if you if you were to misplace it, like I know,
Speaker 1: my wife has a security dongle that she uses for work,
Speaker 1: and if that gets misplaced, then it becomes fine where
Speaker 1: the dongle went day. Okay, Well, obviously having a device
Speaker 1: on you to unlock all your digital services as convenient
Speaker 1: as long as you don't lose the device. So what
Speaker 1: about having a physical object that you can't lose, like
Speaker 1: say your eyeball or your hand. Well, I mean you
Speaker 1: can lose an eyeball, but but guys try not to write.
Speaker 1: So there's been more likely to lose a hand or
Speaker 1: an eyeball depends. If you're a pirate, it's a shot
Speaker 1: so um. But if you're an though, if you're a ninja,
Speaker 1: it's it's you know, ninja pretty much, it's all or nothing.
Speaker 1: You know, you don't see a lot of one armed
Speaker 1: ninja's running around or ninja I should say, since the
Speaker 1: plural is the same as the singular. But at any rate,
Speaker 1: we're talking about biometrics, right, and we have systems like
Speaker 1: this that are already active, right, like like iOS devices. Um,
Speaker 1: the latest iPhones have actually from the iPhone five s forward,
Speaker 1: they have a sensor that detects uh, finger presence and
Speaker 1: then they scan it to make sure that you are
Speaker 1: who you say you are, so that unlocks the phone.
Speaker 1: So if I pick up my wife's iPhone and I
Speaker 1: put my thumb on that it won't activate because it
Speaker 1: knows I'm not my wife life. Um. So these are
Speaker 1: systems that rely on something that is unique to you
Speaker 1: to act as a verification and authentication. UM. So it
Speaker 1: could be a fingerprint, it could be something a little
Speaker 1: more secure than fingerprints, because you can lift a fingerprint
Speaker 1: and you can recreate it using something like latex. But
Speaker 1: if you are scanning beneath the surface of the skin
Speaker 1: for things like the layout of blood vessels, which is
Speaker 1: the way a lot of these verification devices are working now, uh,
Speaker 1: that's a lot harder to to replicate, right if you
Speaker 1: don't have access to the person's actual figure. Of course,
Speaker 1: there must be something that's preventing this from going all
Speaker 1: over the place, right, I would imagine systems like this
Speaker 1: are kind of expensive and difficult and not worth the
Speaker 1: trouble in a lot of cases. Uh, they're definitely finicky.
Speaker 1: The technology right now is a little bit on on
Speaker 1: the delicate end and comes back with a lot of
Speaker 1: false negatives, right Yeah. Yeah, it's one of those things
Speaker 1: where you want something to just work, and this does
Speaker 1: not always just work. And also it's just it's one
Speaker 1: of those things where depending on the implementation, it may
Speaker 1: be very limiting. Like if it's something like an eye scan,
Speaker 1: then you're working with a camera that you need to
Speaker 1: stare into. Not a lot of people really find that
Speaker 1: particularly enticing. Uh. There are some other implementations that are
Speaker 1: kind of exciting that involved biometrics that aren't you know,
Speaker 1: a physical feature. I mean there's some like the shape
Speaker 1: of your ear has been referenced as a potential way
Speaker 1: of testing, you know, being a way of identifying somebody.
Speaker 1: But there are others like your heartbeat. The actual electrical
Speaker 1: impulses that your heart makes when it's beating, no matter
Speaker 1: what rate we're talking about, are distinct and that is
Speaker 1: very difficult to replicate. So if you are if you
Speaker 1: get a device and you map it to the electrical
Speaker 1: impulses of your heartbeat, you can be fairly certain that
Speaker 1: that device is going to be, you know, geared to
Speaker 1: you and you alone. Uh. There is in fact a
Speaker 1: device that's in development that does this, called the Nemi
Speaker 1: wrist band in why am I and and maybe it's
Speaker 1: ninety but I didn't know. It's supposed to work this way,
Speaker 1: and it's supposed to detect the electrical activity of your
Speaker 1: heart and then map it to whatever. So you could
Speaker 1: use this not just to activate systems, but also imagine
Speaker 1: walking up to your house and it unlocks automatically because
Speaker 1: it knows you're coming, because the heartbeat says it's you. Yeah.
Speaker 1: It's pretty neat, also clever, because you would have to
Speaker 1: be alive as your approach exactly exactly. So, So for
Speaker 1: all of those folks out there who are thinking I'm
Speaker 1: just gonna be producing a whole lot of pirates, poking
Speaker 1: out as and cutting off hands doesn't work for this one.
Speaker 1: I gotta have that heartbeating. I mean, everybody who's played
Speaker 1: Resident Evil four understands that you can just take the
Speaker 1: eyeball and use that for the retinal scanner, right right,
Speaker 1: yeah's somehow I doubt that would work in real life.
Speaker 1: Minority Report did the did a similar thing right where
Speaker 1: they the guy had his surgery to replace an eye
Speaker 1: so that he could get x us to a place. Yeah,
Speaker 1: Loki pulled that trick, y'all in like the Avengers. So
Speaker 1: let's let's let's all forget about that one. Okay. Well,
Speaker 1: one thing I think about this though, is that with biometrics,
Speaker 1: you're having to do some analog to digital translation where
Speaker 1: you're having to take a system where it's gonna scan
Speaker 1: something about your body. You know, you're the pattern on
Speaker 1: your fingerprint, or the patterns of the blood vessels under
Speaker 1: your eyeball, or your skin, or your heart rate, and
Speaker 1: in all these cases it's got to turn that into
Speaker 1: data that can be used as a password. Are there
Speaker 1: ways that we could just start with digital data that
Speaker 1: would basically be the same as biometric Well, there might be.
Speaker 1: I want to talk about the password tattoo and the
Speaker 1: password pill. Okay, okay. The tattoo thing that we're talking
Speaker 1: about isn't like a physical tattoo. It's not tattooing a
Speaker 1: barcode on you. But well, I mean it's physical. It's
Speaker 1: not a permanent it's not a permanent tattoos, That's what
Speaker 1: I mean. It's it's one of the tattoos stick ers
Speaker 1: that we've talked about a few times on the show.
Speaker 1: One of the little stretchy circuitry stickers, right, yeah, sort
Speaker 1: of the second skin thing. It's it's not like my
Speaker 1: monkey princess tattoo on my right cheek. Right. So, at
Speaker 1: D eleven, which was the All Things Digital conference in May,
Speaker 1: of the Motorola researcher and form A Darper director Regina
Speaker 1: Dugan gave an interview where she talked about the hassle
Speaker 1: of passwords and a couple of future authentication methods, namely
Speaker 1: the two I mentioned here. So one example, of course,
Speaker 1: was these temporary password tattoos. And this is based on
Speaker 1: stretchable circuits, which we've talked about on the show before,
Speaker 1: that you can embed circuitry in these. I mean, I
Speaker 1: can't think of a better way to explain it. They're
Speaker 1: temporary tattoos. You stick them on your skin and they
Speaker 1: stay there. It's it's almost like a sticker, but it's thinner. Yeah,
Speaker 1: And of course so they can have a little embedded
Speaker 1: antenna that can communicate with devices nearby. So all you'd
Speaker 1: really need to have would be in the morning, you
Speaker 1: put on one of these stickers and it has your
Speaker 1: password verify a SIN on it. So you go around
Speaker 1: and you've got this on your body wherever you're at
Speaker 1: a device that you need to log into. And so
Speaker 1: that's one way. But here's another way. You could take
Speaker 1: a pill in the morning, like like a chill pill, no,
Speaker 1: like a password pill. So Ducan brought up that there's
Speaker 1: a company called Proteus Digital Health. They got FDA clearance
Speaker 1: to create an edible sensor, and I think the original
Speaker 1: idea was to use it for medical purposes, but it
Speaker 1: could also be used for digital authentication. So you take
Speaker 1: one in the morning and then you've got access for
Speaker 1: the rest of the day. Basically, the way it would
Speaker 1: work is that you swallow this tiny pill and the
Speaker 1: acids in your stomach activate the electrical component in the pill,
Speaker 1: so they sort of act as the electro light there.
Speaker 1: And then when the pill gets activated, it starts to
Speaker 1: give off a coded electrical signal, which she compares to
Speaker 1: an E C G signal like an electro cardiogram. UH
Speaker 1: and so after you've taken the pill, all you have
Speaker 1: to do is touch something and your body automatically enters
Speaker 1: the electrical code. Uh supposedly, how safe. I'm wondering what
Speaker 1: the mechanism is for that that activation. That's kind of crazy.
Speaker 1: I mean, she compares it ECG. So it's got to
Speaker 1: be electrical impulses that are emanating from this pill inside
Speaker 1: your body. But when you come in contact with the
Speaker 1: thing at activates, that's what's getting me. I guess maybe
Speaker 1: if it's constantly broadcasting and then everything else is essentially
Speaker 1: a receiver, once you get within close enough contact, then
Speaker 1: there's a connection based or something like that. Otherwise, I
Speaker 1: can't imagine it being like turning you into electro. I mean, yeah,
Speaker 1: I take a pill for that. Well, I would take
Speaker 1: a pill to turn into electro. I just don't think
Speaker 1: that's what this is, all right, I'm sorry, Joe. Please,
Speaker 1: she confirmed it's so you turned into electric okay, all right,
Speaker 1: well never mind objection. She did not. But apparently apparently
Speaker 1: this is safe. She claimed you could take many of
Speaker 1: them and it wouldn't harm you. So that way, for all,
Speaker 1: they can't overdose on passwords. You can't overdose on passwords,
Speaker 1: but not on password pills. Okay, of course, the thing
Speaker 1: that I was wondering about it was are there going
Speaker 1: to be situations where if people are taking password pills,
Speaker 1: are there going to be potential identity thieves like scraping
Speaker 1: septic tanks and sewage treatment plants to find active pills
Speaker 1: to exploit. Yeah, it gives a whole new meaning to
Speaker 1: the word fishing. Yeah. I would imagine that these things
Speaker 1: have to have a limitation on their power source, so
Speaker 1: some kind of self destruct. I would just imagine making
Speaker 1: their way through the digestive tract of a of a
Speaker 1: human being, they probably wouldn't be in the best working
Speaker 1: condition by the time they came out the other end. Yeah,
Speaker 1: I don't know, but I'd have to assume that's part
Speaker 1: of the design. Yeah. If it weren't, that would be
Speaker 1: a bizarre oversight. Well. Also, I would imagine you could
Speaker 1: also create your hard enough to create something like this.
Speaker 1: I mean, the other issue with this is that how
Speaker 1: do you have at work on a on a regular
Speaker 1: basis regular basis, But assuming assuming that this is not
Speaker 1: for just a temporary one time pass, if it is,
Speaker 1: that's great. I mean that that makes perfect sense for
Speaker 1: this implementation. But if you're talking about prolonged use, like
Speaker 1: it's something that you log into every day, then you
Speaker 1: would have to have access to that same pill every time.
Speaker 1: Oh yeah, that's the idea. You take it every morning,
Speaker 1: so there's an actual physical repository of the password that
Speaker 1: lets you into your system. Somebody gets into your medicine, right,
Speaker 1: that's the real issue. I'm not I'm not so much
Speaker 1: worried about going through the sewage as I am getting
Speaker 1: access to the bottle of magic pills that gives you
Speaker 1: access to all my stuff. That's what I would worry about.
Speaker 1: I don't know. It's a good question. Okay, maybe maybe
Speaker 1: as a pair with some other security I'm not sure.
Speaker 1: At any rate. Um, you wouldn't hold on you're saying
Speaker 1: no to the pill. You wouldn't take the password pill.
Speaker 1: I would totally take the password pill. I'm just you know,
Speaker 1: for for if someone needed to let me onto an
Speaker 1: air force base for one day in order to i
Speaker 1: don't know, like report about cool stuff that that was
Speaker 1: technologically happening there, then that would be really great. That's interesting.
Speaker 1: It also sounds like a great way to tweet about
Speaker 1: ephemero while you should be working my personal My personal
Speaker 1: philosophy is that whenever I visit a military base, I
Speaker 1: don't automatically swallow something someone hands me. Okay, now we're
Speaker 1: getting off topic. I'm sorry, No, No, I've got another
Speaker 1: place I want to go with this. A lot of
Speaker 1: people aren't going to be very cool with the idea
Speaker 1: of taking a pill or even wearing a tattoo. You know,
Speaker 1: I guess to some people it just seems kind of invasive.
Speaker 1: It seems like something they wouldn't want to do. So
Speaker 1: I think we should come back and look at the
Speaker 1: idea of passwords that are based on behavior. Yeah, I've
Speaker 1: got one that researchers at Rutgers School of Engineering have
Speaker 1: been working on lately. It's it's a system for letting
Speaker 1: users draw free form gestures on touch screens in place
Speaker 1: of creating traditional passwords. They found that study participants have
Speaker 1: been pretty good at recalling the gestures that they created,
Speaker 1: and that visual eavesdroppers if if you follow my meaning,
Speaker 1: like someone like looking over your shoulder trying to collect
Speaker 1: your password as you put it in, Uh, they've been
Speaker 1: pretty poor at reproducing those gestures accurately enough. To trick
Speaker 1: the system. So it could be a definite step up
Speaker 1: from either you know, pass codes or like even connect
Speaker 1: the dots swipes that are in use for mobile touch
Speaker 1: screen devices today. Um, and if touch screen happens to
Speaker 1: really invade home computer use, that could be pretty rad. Yeah,
Speaker 1: you can see how for an individual like muscle memory
Speaker 1: could set in, especially if you enter something a bunch
Speaker 1: of times and it becomes second nature to do it
Speaker 1: so easily. Yeah, yeah, yeah, you can. You can use
Speaker 1: any number of fingers and and and create a gesture
Speaker 1: on any portion of your screen. It's a pretty it's
Speaker 1: a pretty cool a little little system. I like that.
Speaker 1: But what about behavior that's even more subtle, such as
Speaker 1: behavior you don't even realize you're doing. Sure, as it
Speaker 1: turns out, Yeah, the way we type is actually kind
Speaker 1: of identifiable to us, and in fact, it has been
Speaker 1: used in actual systems today already. Yeah. So if you
Speaker 1: want to look at an old analogy to this, you
Speaker 1: could look at handwriting analysis. Yeah, I mean, everybody has
Speaker 1: a sort of unique way that they create letters on
Speaker 1: on the line. And even though you might not write
Speaker 1: the same word exactly the same way every time, if
Speaker 1: you have a large sample of writing. You can you
Speaker 1: can you can draw at least some you know, like
Speaker 1: within a percentage of certainty whether or not it's you know,
Speaker 1: something that was written by an unknown person fits in
Speaker 1: with a known database of of of writing similar to this,
Speaker 1: except now we're talking about systems, you know, typing specifically
Speaker 1: systems where very minute measurement can be taken between the
Speaker 1: way you type certain phrases. You know, how quickly you
Speaker 1: transition from letter to letter, how long you hold down
Speaker 1: particular keys, and it may be that with certain fingers
Speaker 1: you hold down certain keys longer than others, and it's
Speaker 1: not like it's long enough for it to register as
Speaker 1: multiple UH entries. So you're not you know j J
Speaker 1: J G j G j J j oh in a
Speaker 1: t H spelling my name UM the traditional spelling, right, yeah,
Speaker 1: So at any rate, you know, there's like sixteen j's
Speaker 1: and then you get the O uh no oh sorry,
Speaker 1: So at any rate, you you the typing you do
Speaker 1: is is going to be identifiable back to you. And
Speaker 1: like I said, there are some examples of this. UH
Speaker 1: Corsera has, which is online learning service, has what they
Speaker 1: call a signature track authentication method in which students type
Speaker 1: a particular phrase. So it's a simple phrase. It's not
Speaker 1: a password. This is something that you know, maybe multiple
Speaker 1: students have. It's it's all about the way you type it,
Speaker 1: not what the phrase is. So if the phrase is
Speaker 1: something simple like the moon is made of cheese, and
Speaker 1: you type in the moon is made of cheese, and
Speaker 1: you calibrate this enough times, you type it in enough
Speaker 1: times where it gets the rhythm that you type in
Speaker 1: the way that you you are typing these letters, then
Speaker 1: every time you need to authenticate that's you, because you're
Speaker 1: you're turning in a school assignment, so you have to say, hey,
Speaker 1: this really is me, it's not someone doing work for me.
Speaker 1: You type in the moon is made of cheese. It
Speaker 1: compares it against all the other entries that it's authenticated
Speaker 1: as being you, and if it fits, everything's golden, and
Speaker 1: if not, something's wrong. I would think though that it
Speaker 1: might have an unfortunate effect on grades and astronomy classes. Well,
Speaker 1: you know, considering that that was just a random phrase
Speaker 1: that I came up with in my head and not
Speaker 1: one that necessarily reflects what the content is in Corsera,
Speaker 1: I think we're fairly safe now of course, typing is
Speaker 1: just one behavior that many of us do, especially if
Speaker 1: you're trying to access online services, you're probably typing in
Speaker 1: some way. But it's just one behavior that we do
Speaker 1: that's identifiable back to us. Right. In reality, everything you
Speaker 1: do is weird. Yeah, now that's true. I am constantly
Speaker 1: reminded by that whenever I write public trans transitness. Well,
Speaker 1: everything every one of us does is weird, which makes
Speaker 1: it even more exciting. On Martha, Uh yeah, the walking
Speaker 1: is another thing that's peculiar to whomever is doing the walking,
Speaker 1: like the gate, the way we hold ourselves, you know,
Speaker 1: our our posture, our shoulders, the length of our stride,
Speaker 1: how quickly we tend to move, how much force we
Speaker 1: use when we step down. Are you a heavy stepper
Speaker 1: or do you have like I think of toddlers. They
Speaker 1: always sound to me like they weigh about ten times
Speaker 1: more than they really do because the way they run. Yeah, yeah,
Speaker 1: I know, right, like all of I can't tell you
Speaker 1: how many of my models of Tokyo have been destroyed
Speaker 1: whenever my young relatives visit. So you're saying, like, potentially
Speaker 1: your computer could be like the salesperson at the shoes
Speaker 1: store who says, walk down to the other end and
Speaker 1: come back kind of except in this case, they're not
Speaker 1: looking to see if your shoes fit. They're just looking
Speaker 1: to see if you are who you say you are.
Speaker 1: Have you ever noticed someone walking like, let's say, I
Speaker 1: think of this. I always think of my college days
Speaker 1: on college campus. Lots of people, right, lots of people,
Speaker 1: a lot of people. You know, can't necessarily pick out
Speaker 1: faces and a crowd, especially if they're facing away from you,
Speaker 1: but you might recognize someone just by the way they're walking.
Speaker 1: That's kind of what we're talking about here. Systems that
Speaker 1: would do this Now, granted, these sort of systems would
Speaker 1: be useful in some applications, but not others. I don't
Speaker 1: think every time you want to access your email that
Speaker 1: you want to asse up your computer and then you know,
Speaker 1: do a power walk right in front of it. That
Speaker 1: probably is not going to be your your first choice.
Speaker 1: But it is interesting that we can map these sort
Speaker 1: of behaviors to your identity. It might be really good
Speaker 1: for for entry into a building. For example, Yeah, as
Speaker 1: you walk up, it already unlocks because it knows it's you. Okay.
Speaker 1: I think we should each predict what we think is
Speaker 1: going to be the future of passwords. And I'm going
Speaker 1: to say, for me personally, what seems the most plausible
Speaker 1: is a sort of two step verification that's a combination
Speaker 1: of the password tattoo, the temporary tattoo, I mean, which
Speaker 1: is pretty non invasive and easy, and then also selecting
Speaker 1: an image. Okay, I do like selecting an image. I
Speaker 1: think that that's a really clever thing for because because
Speaker 1: it's so uh difficult to reproduce it it's not you know,
Speaker 1: a string of characters that's short, right, but it's also
Speaker 1: so easy for the user. I mean, it takes half
Speaker 1: a second. I think we will all be issued a
Speaker 1: familiar unique to us, which will then grant us access
Speaker 1: to whatever castle, dungeon, or fortress that we are trying
Speaker 1: to enter. Play a lot of DND over the weekend,
Speaker 1: so we're living in D and D, but we also
Speaker 1: possibly have like a like a subtle knife damon kind
Speaker 1: of thing. Yeah, exactly, Yeah, we're talking. You know, that
Speaker 1: was kind of thinking of his Dark Materials trilogy. I've
Speaker 1: got to admit um to be more serious. I think
Speaker 1: biometrics really are going to be well. I do too.
Speaker 1: I can finally get my monkey Princess password. That's a
Speaker 1: real monkey princess. I knew it. I was in here
Speaker 1: with a couple of Mrs Coulters. Well, at any rate,
Speaker 1: I really think biometrics to be really, I think biometrics
Speaker 1: are going to be, uh, really the one that wins out,
Speaker 1: at least in the short term. I mean, I've I've
Speaker 1: had computers that have had fingerprint scanners. You know, there
Speaker 1: are smartphones on the market right now that have them.
Speaker 1: We're seeing more and more of those devices come up
Speaker 1: and more of those systems come up. I think that's
Speaker 1: really gonna be, at least for the near future. The
Speaker 1: solution in the far future, well, you're talking about especially
Speaker 1: in the possibility of an era of of quantum computers.
Speaker 1: You're talking about era where it's gonna be way more
Speaker 1: of a tricky situation to create a truly secure system,
Speaker 1: even if people are behaving the way they're supposed to,
Speaker 1: So then it's harder for me to make a prediction
Speaker 1: DNA sample actually your geno. No, I'm actually totally ready.
Speaker 1: Like I've said this in public on the Internet before,
Speaker 1: like at times of extreme stress with passwords that if
Speaker 1: I really did just have a USB stick where I
Speaker 1: could prick my finger and it would read my DNA.
Speaker 1: I would sign up for that like today. If I
Speaker 1: never had or another password, I think there'll just be
Speaker 1: a spit cup. But oh well that's even nicer, yea
Speaker 1: the horrible totalitarian future. Yeah, I was thinking cheek swab
Speaker 1: because that's just funny. Everybody at the office comes into
Speaker 1: nine am swabs. Well, you know, guys, this has been
Speaker 1: a fun conversation and uh and we're about to have
Speaker 1: another fun conversation in a moment, So I think we're
Speaker 1: gonna have to wrap this up because I don't know
Speaker 1: how silly we're going to be in the second episode
Speaker 1: that we record. But guys, this is actually has been
Speaker 1: a really entertaining and interesting discussion and we we enjoyed
Speaker 1: looking into it. If you guys have any suggestions for
Speaker 1: future topics for the podcast for the videos yours, you
Speaker 1: should let us know. Send us an email that addresses
Speaker 1: FW thinking at how stuff Works dot com. Check us
Speaker 1: out on Google Plus and Facebook and Twitter. Over at
Speaker 1: Twitter and Google Plus, where f W Thinking just searched
Speaker 1: that in Facebook will pop right up. Don't forget to
Speaker 1: go visit fw thinking dot com. If you've never been,
Speaker 1: go check it out. It's an awesome site. We've got
Speaker 1: tons of stuff there and we will talk to you
Speaker 1: again really soon. For more on this topic in the
Speaker 1: future of technology, visit forward thinking dot Com, brought to
Speaker 1: you by Toyota. Let's Go Places,