Access Denied: The Problem with Passwords

Hosts: Matt Armitage & Richard Bradbury
Produced: Richard Bradbury for BFM89.9
 
Richard Bradbury: 
One Zero zero zero zero. No. We’re not doing today’s Mattsplained in binary. It’s taken weeks to talk Matt out of that Idea. We’re talking about passwords, their pitfalls and some of the new technologies that might replace them in the next few years.
Matt Armitage:
•   I still think the binary idea is a winner. 
•   01001000 01100101 01101100 01101100 01101111 00001010 
•   That’s hello in binary.
•   How hard Is that to understand?
•   Who wouldn’t want a half hour of ones and zeroes just before the weekend?
•   No? Ok. Password problems it is. 
•   Let me start by asking you a question.
•   How many passwords do you think you have dotted around the Internet?
 
Richard Bradbury: [replies]
Matt Armitage:
•   I did a little bit of a count up for this show and I have somewhere between 400 and 500.
•   Admittedly, a lot of them are for apps and services that I may have had to register for and then tried out once and deleted the account.
•   But It’s a lot more than I Imagined. 
•   I thought I might have 80 to 120. 
•   But I’m guessing It’s not actually that unusual. That most of us have a few hundred logins and passwords trailing in the wake of our digital voyage. 
•   And do you know what they all have in common, in my case, anyway?
 
Richard Bradbury: Are you about to give away the secret to your password recipe on live radio?
Matt Armitage:
•   Sort of. The thing they have in common is that I don’t know what any of them are. 
•   I don’t even know how many characters are in each one. 
•   It could be 13. It might be 33. 
•   Now, depending on how you look at it those may be good or bad things. 
•   It’s not that I’m some encryption expert.
•   It’s simply that in the course of doing these shows, talking to cybersecurity experts.
•   It was clear pretty early on that it simply wasn’t safe not just to recycle passwords, but to create them myself. 
 
Richard Bradbury: Let’s deal with the recycling passwords issue first…
Matt Armitage:
•   We all hear about data breaches in which logins and passwords are stolen. 
•   We’ve all had those emails and had to go back into the systems to update our information. 
•   What we forget though, is that if Yahoo or some other company tells us to change our password, they’re telling us essentially to protect our account with them. 
•   That’s their focus.
•   That’s where their responsibility – legally at least – begins and ends. 
•   They’re not really interested whether you used that password on another service. 
 
Richard Bradbury: But there may be people who are?
Matt Armitage:
•   Yes, because those stolen data logs often end up being traded on the Darkweb.
•   The sellers might divide them up into parcels, for example, selling people packages of say 10,000 stolen logins and passwords.
•   The hackers know you’ve probably changed your Yahoo password.
•   But they also know that many of us reuse passwords. 
•   In fact a Google poll in 2018 found that over 50% of people reuse some of their passwords across multiple services. 
•   So, they take those logins and see if you’re using the same email, username and password combinations for google, Facebook, Insta. 
•   Maybe even a bank.  
 
Richard Bradbury: But that would assume that the hackers have more knowledge about you than just those passwords?
Matt Armitage:
•   Not necessarily. Especially when we have so many large tech monopolies.
•   You’ve probably got a Facebook, Twitter or Insta.
•   But let’s go back to the bank – of course, this will depend from country to country. 
•   But in the case of Malaysia – how much of a stretch for a hackers to think that someone on their list might have a Maybank, public bank or CIMB account?
•   Obviously, those banks have systems that are probably a lot more secure than a lot of the bootstrapped start-ups you might register with.
•   For example, that three or five or ten strikes and you’re out with the password. 
•   Two or even three factor authentication.
•   When my mum occasionally had problems with some of her software back in the UK, I used to be able use her passwords and logins to go and rectify and set things up for her.
•   Now, a lot of the bigger tech companies instantly recognise that you’re trying to access the account from an unusual location. 
•   So even though I part of those two-step verifications, I can’t access her accounts anymore. 
•   Which is great from a security standpoint, less good for resolving any problems my mum has. 
 
Richard Bradbury: So it comes back to the intent of the hacker?
Matt Armitage:
•   Yes, for the most part they might be trying to see if they can get into say your Spotify account and then sell that on for a few dollars. 
•   But sometimes they’re trying to impersonate you – especially on social media – either to get that person’s friends to transfer money.
•   We’ve all seen the scams. I’m in Bali and I’ve been robbed. I need you to wire me USD100 so I can get a car to the embassy and get new travel documents. 
•   Sometimes, it’s more specifically for ID theft. Posing as the person and asking people for personal details.
•   Phone numbers, addresses.
•   The kind of information that will help them to reset passwords and take over the accounts that will give them access to bank details and other important information. 
 
Richard Bradbury: Is it as simple as making sure that your passwords are different for every single login you use?
Matt Armitage:
•   This comes back to some of the points we’ve made about AI in the past.
•   Predictive algorithms – for example the ones that decide what TV shows or video clips we want to watch are based not just on what we’ve consumed before but what people with similar taste profiles to us have enjoyed.
•   On the last show we talked about the New Zealand tourism social media campaign to stop people trekking to the same Instagram promoted photo opportunities as each other.
•   The reason we need campaigns like that is because we’re not as individual and unpredictable as we like to think. 
•   And that same behaviour comes out when we choose passwords as well. 
•   We choose passwords that relate to our lives: kids names, birth dates, anniversaries, pets names favourite sports teams. 
•   In other words, exactly the kind of information that might be on your Facebook page. 
 
Richard Bradbury: In other words, the longer and more random the better?
Matt Armitage:
•   Yes. Hacking software can use brute force attacks to crack most common words up to eight letters in just a few minutes.
•   Which is why so many sites now require you to use symbols, numbers and upper and lower-case letters in random configurations. 
•   And a lot of us get very lazy about changing passwords from time to time
 
Richard Bradbury: The more passwords we have, the harder it is to manage them…
Matt Armitage:
•   Yes, so keeping all those passwords updated is a full-time job.
•   Even if you’re using one of those password managers that keeps them all for you.
•   There are lots of third-party services out there. 
•   But typically our operating systems have their own password managers. 
•   Keychain on Mac, Google Password Manager, Authenticator on Windows. 
•   And most of those apps can autogenerate random passwords for you, often with variable numbers of characters.
•   Some of these apps work across platforms. Some don’t. 
•   I use a third-party password manager that operates cross platform. 
•   But even then, you have to make sure that your passwords for those apps are well thought out and secure in case someone is able to take control of your computer or device. 
 
Richard Bradbury: Are there any you’d recommend?
Matt Armitage:
•   I wouldn’t recommend a specific one. 
•   See if the free one on your OS or browser works for you, first. 
•   Then do a bit of research. See what fits your needs in terms of features, encryption, where the files are stored.
•   Is it a one-off fee, a monthly fee, free?
 
Richard Bradbury: Are the free ones safe?
Matt Armitage:
•   Again, that’s why I’m not making any recommendations. 
•   There’s a lot of – not necessarily scam or malware – but bloatware out there.
•   Especially in the free app space. 
•   And be careful with anything that’s storing your passwords in the cloud.
•   You increase your exposure. Local storage is best. 
•   Some of the third party managers allow you to store an encrypted file vault on your Gdrive or Dropbox, allowing you to access them remotely and sync across devices. 
•   So figure out what works best for the kind of user you are. 
 
Richard Bradbury: It does seem a bit 2011 to be talking about passwords and managers…
Matt Armitage:
•   That’s kind of the point of the show today. 
•   You can’t really talk about passwords without going over all of this – you have to take precautions information. 
•   Take what I was saying about people choosing passwords related to their lives.
•   You and I interview a lot of people. And part of that process is chatting and putting people at their ease.
 
Richard Bradbury: I don’t think anyone is ever at their ease around you…
Matt Armitage:
•   Which makes it even easier for me to extract information from them. 
•   Nature abhors my vacuum. 
•   People would rather babble than sit silently within my sphere of malignance. 
•   But someone skilled at talking to people – like the Derren Browns of this world – can extract information that could potentially be used to steal someone’s identity. 
•   So, yes, passwords do seem very Internet 1.0 in that sense. 
•   A holdover from a simpler age.
•   After the break we’ll talk about some of the new technologies that are coming in to replace the 12345678 you’re using. 
•   And to any of our listeners,  if that genuinely is your password for anything, I suggest you change it while you listen to these messages. 
 
Richard Bradbury: When we come back – what happens when technology fails your password.
 
BREAK
 
Richard Bradbury: We’re looking at password tech on Mattsplained this week. With a bit of luck listeners have either changed their passwords during the break or put the podcast on hold while they updated. But you teased us with a password fail.
Matt Armitage:
•   Yes. A really fascinating article on the Guardian website called the Tyranny of Passwords by Sirin Kale. 
•   She references a story that some of you may have heard about a German programmer called Stefan Thomas. 
•   Which links in to all the GameStop, outsider share trading activity.
•   Which has also seen the price of Bitcoin explode this year on Its wild ride into the scariest parts of the Investor ecosystem. 
•   Thomas was paid in bitcoin for a video about cryptocurrency a decade ago. 
•   Those 7000 Bitcoin were worth approximately $240m when the story about losing the password broke In January. 
•   They’ve since increased in value by almost $100m.
•   Yet they’re of no more use to Thomas than the ones and zeroes I started this show with.
 
Richard Bradbury: He forgot the password?
Matt Armitage:
•   He forgot the password to the bitcoin wallet.
•   He had copies of the password on 2 old hard drives. 
•   But technology has moved on and he can’t access the drives anymore. 
•   He had one more copy on an IronKey - an encrypted thumb drive. 
•   And that’s the one he’s lost the password for. 
•   After 10 incorrect password attempts the device essentially destroys the data on It. 
•   So far, he’s tried eight of his most commonly used passwords…
 
Richard Bradbury: Most commonly used passwords?
Matt Armitage:
•   There you go. The first half of the show wasn’t such a waster of time after all.
•   Even though Thomas is a programmer, it’s obvious that he’s he’s not not following password best practises. 
•   Or at least he wasn’t back in the day. 
 
Richard Bradbury: How do you survive losing what’s edging towards half a billion dollars?
Matt Armitage:
•   The reports suggest that Thomas is more sanguine than suicidal, which is good. 
•   The last time I lost a $100m I was livid for at least 10 minutes. 
•   Then I found it again, it was under the ang pows.
•   I don’t think Thomas has given up hope.
•   And he’s had various offers from crypto crackers to help him recover the Information for a share. 
•   But with all those hundreds of logins and passwords out there, this is something that pretty much all of us could face.
•   Although not in the hundreds of millions of dollars.
•   For example, if I forgot the password for my password keeper, what would happen?
•   These services are specifically designed so that someone can’t remotely reset it for you.
•   So, the thing that protects my passwords from hackers has no effective protection from me. 
 
Richard Bradbury: Wasn’t there another case of millions In Bitcoin being lost?
Matt Armitage:
•   The Guardian quotes an estimate from cryptocurrency data firm Chainalysis that around 20% of the current supply of Bitcoin Is either lost or Its owners are locked out of their access. 
•   That’s 3.5m bitcoins worth close to $50,000 apiece. That’s a lot of zeroes…
•   A bitcoin miner In Wales called James Howells has been trying to retrieve a hard drive containing the key to his coins that was accidentally thrown out in 2013.
•   He suspects the drive Is somewhere in a landfill In Newport, but to date the local council has shown no Interest In helping him to locate It.
•   He’s even offered 25% of the sale value of the coins to the council, so far to no avail.
•   The value - probably in a similar ballpark to Stefan Thomas. 
•   Close to $300m at today’s rates. 
 
Richard Bradbury: So, If securing your passwords Is dangerous and not securing your passwords Is even more dangerous, what’s the solution?
Matt Armitage:
•   I’d be tempted to say don’t ask me, If that wasn’t the entire purpose of the show. 
•   Obviously, we’re already moving into an era where passwords can be replaced by biometrics. 
•   A lot of our phones and other devices have fingerprint scanners.
•   The technology has evolved, and the chips and sensors are relatively cheap. 
•   In fact, the irony is, that it may be harder to remotely get into phones protected by a fingerprint than it might be to crack the passwords for all your other services. 
•   But I don’t think fingerprints are where we’re heading.
•   We’re seeing that expansion of facial recognition software coupled with machine learning systems.
•   The technology is advancing – though as anyone who uses consumer grade facial recognition to open a phone or tablet knows, it can be easily thrown off by changes in your appearance or background lighting. 
 
Richard Bradbury: Could someone just hold up a selfie you posted to Instagram and hack a device that way?
Matt Armitage:
•   It was certainly possible to spoof some older facial recognition systems in that way, but most now have what’s called a liveness component built in. 
•   So that it’s obvious that it’s a living, breathing human that the camera is seeing. 
•   In fact, we’re seeing a trend away from so-called active liveness systems to passive systems. 
•   Spoofing of some active systems – which look for eye blinks for example – has been possible by creating a mask of a person’s likeness or even a printout with the eyes cut out.
•   And the spoofer blinks through the eyeholes, tricking the system into thinking it’s the real you.
•   It wouldn’t work for me: I haven’t blinked since 2001.
 
Richard Bradbury: How would a passive system work if it isn’t looking for movement?
Matt Armitage:
•   This is where is gets murky. Tests have shown some of the emerging passive systems to be faster and more accurate. 
•   And to have lower rejection rates and false negatives.
•   However, the companies involved are very loath to explain exactly how their systems work because…
•   Our old friend proprietary algorithms. 
•   The gist of it seems to be that the systems are neural networks that have been trained on large databases of photos and real images. 
•   So, they analyse what’s in front of them and identify the characteristics that represent an actual person rather than a facsimile. 
•   And then it produces a liveness score which determines whether you or I are more likely to be a real person or not.
 
Richard Bradbury: Are you saying I’m not a real person?
Matt Armitage:
•   If the computer says no…
•   Facial recognitions systems are already used widely across China. 
•   Alipay and WeChat Pay are spending hundreds of millions of dollars to install their facial recognition payment systems across the country.
•   And the BBC reports that China state media claims that over 750m people will be using facial recognition payment systems by 2021. 
 
Richard Bradbury: That still raises the question of the relevance of facial recognitions systems in a time where we’re all wearing masks.
Matt Armitage:
•   Well, we’ve previously reported that companies in China, as part of the country’s pandemic controls, had developed facial systems that were accurate with masks on.
•   The idea being that remote temperature sensors in public place could detect if someone had a fever and then identify them.
•   And similar systems are coming to other countries. 
•   A system called PopID in the US enables you to link your bank card to their system, so it’s a gateway rather than a ewallet or payment system like some of the others.
•   PopID is also working on an update that will be accurate for to pay while wearing a mask.
•   The company also has a hand gesture service: you can set certain hand gestures to trigger tips of varying percentages.
 
Richard Bradbury: The bigger question is should we be using biometric systems like this from a privacy point of view?
Matt Armitage:
•   Sure. These are just technology solutions. We should be able to be in a position to at least have those conversations about how to use this kind of technology. 
•   Because there are other, even more outlandish sounding systems being developed. 
•   For example, biometrics based on the unique shape of your ear. 
•   Or even, as we talked about a few months back on our show about gait analysis,
•   Machines can learn to identify you from the way you move. 
•   So, the issue then becomes who has this information and where is it stored.
 
Richard Bradbury: Cloud versus local?
Matt Armitage:
•   Yes. We’re already seeing this fightback against Big Tech over privacy issues.
•   How much data they have on us and how they use it.
•   Look at companies like Alipay, Amazon, Google, Apple. 
•   And just to be clear – I’m not alleging anything nefarious. 
•   But how much of a picture of your life do you want to give these companies?
•   You may already be using voice activated devices by these companies that listen to you at home. 
•   You watch movies and TV shows and play games on their entertainment platforms. 
•   You buy pretty much anything it’s possible to buy from groceries to garden sheds through their apps. 
•   And now you’re asking them to be the gatekeeper of your identity. 
•   For some people, it’s not a problem. For others it is. 
•   But we should get a chance to decide which direction to go in.
 
Richard Bradbury: Can you give us some examples?
Matt Armitage:
•   We’ve already seen some of the tech companies fighting against state overreach against governments that want access to user data.
•   Now we’re seeing governments trying to control tech overreach, and limit what those companies can do with that same data.
•   Sometimes these fights are occurring in the same countries between the same companies and legislators, which is truly bizarre. 
•   What’s obvious is that we should be rethinking our approach to passwords and securing our identities. 
•   Otherwise, in a few years’, time we may all have unmanageable quantities of physical passwords that we can’t remember or secure.
•   What I’d like to see is that we get to some middle ground where we can enjoy the convenience of paying with a smile or a twitch of the earlobe.
•   But with that data being held locally, on our own devices, through some kind of encrypted algorithmic handshake.
•   Rather than that data being held on centralised servers where it might be hacked, misused or shared with Big Brother and Big Tech.