By Eric Renaud-Oracle on Jan 14, 2015
Author: Prateek Mishra
As business and citizen services, entertainment and social life all become digitized and virtualized, passwords emerge as a key piece of data to be used for stealing information and online resources. In the past, this was a possibility and an occasional occurrence but in recent years the Apple Celebrity Photo breach , JPMorgan  and Pharmaceutical Company  data breaches have demonstrated the increasing scale and range of password-based threats to businesses. It is interesting to observe that each of these three breaches demonstrates a *different aspect* of the "password problem": ability to guess or reset passwords, password re-use and subsequent discovery from a website with weak security controls, and last, phishing attacks targeted at executives or administrators.
Pundits, bloggers, security gurus and journalists have all declared passwords "dead".
The Motorola login pill , the heartbeat monitor  and device hardware  are just a few of the many claimants jostling for a tryout as password replacements. So are we finally at a point where passwords will no longer be used to login to your employer or at your online medical portal?
To get some perspective, it helps to step back and review the overall context in which passwords are used and the different parties involved. For the business or service provider, passwords are a *scalable* and *low-cost* way to control access to services. For the user, there is a familiarity and ease with the *ceremony* of password use and the overall *user-experience*. Finally, both businesses and users share a conceptual and visual understanding of login page, user registration, forgotten password service and so on.
A successful new model for authentication must address these issues. While business costs and administrative overhead are important, a predictable and easily learnt user-experience is critical and for obvious reasons. The best authentication model is useless if customers or employees find it difficult to use. This is the key reason why it has proven so difficult to transition away from passwords - even after many years of effort - Bill Gates  had called for their removal almost a decade ago!
As we are all aware, one significant technological change in the past five years has been the worldwide availability of phones - smart phones (now widespread in the developed world) and wireless feature phones (in the developing world). And perhaps herein lies the future of authentication. We all know how to use a phone and its services, and we are being trained to download and install applications. Phone features are constantly being improved and a foundation for innovative ways to authenticate.
The popularity of a phone-based "authenticator app" which provides TOTP (Time-Based One-Time Passwords) to augment existing password systems is a great example. The technology is well-known and was standardized in RFC 6238  by IETF (the folks who helped define most of the protocols for the internet such as HTTP and SMTP). As an open standard, it has been reviewed by leading experts in the field and so we can have some reasonable expectations of its robustness and quality.
Many websites and vendors now provide such an app: for example, the Oracle Mobile Authenticator can be installed on Android  devices or an iPhone  and works in concert with the Oracle Access Manager. Once a user has installed the authenticator app, they are guided through a registration process which connects the app to their online account. Notice that a password is still required for this step. The app generates six digit (pseudo) random numbers, in a sequence specific to the user, typically changing to a new number every 30 seconds.
At subsequent logons, in addition to their password, the user is prompted to enter the current random number displayed by the app. Even if the password has been compromised and is known to an attacker, the attacker will be unable to login to the user account.
Clearly this "password+otp" model has its limitations. An attacker could "phish" both the password and the code and within a few seconds login into the user account. A more sophisticated attacker could extract information about the random number generator from the app or the target website and simulate the random number sequence used by the app.
Nevertheless, this model protects against a common attack - where the password was guessed or discovered at a previous time. The level of security sought by a business should be based on the value of the resource and types of attacks against which it is trying to protect itself. The goal is to *impose costs* on an anticipated class of attacks, versus achieving some security ideal. The password+otp user-experience remains a familiar one, though individuals do have to learn the extra step of viewing the app on their phones to retrieve the current number, and entering into a login screen.
Passwords aren't dead but they are going to be less important in the future. They will provide only one component of user authentication, though the conceptual and visual model of the login page will be retained. There are going to be lots of experiments, some profound and some silly (authentication tattoos anyone?), that companies and researchers will bring forward. The recent iPhone 6  fingerprint scanner and Keychain integration is an intriguing sample: how can it be integrated with the familiar login experience and might it become a universal feature of smart phones in the future?
About the Author
||Prateek Mishra is Technical Director at the Identity Management Division, Oracle. His group participates in standards and open source activities, including OAuth and OpenAz. He is best known for his pioneering role in conceptualizing and creating the SAML identity standard.|
|Prateek can be reached via LinkedIn|