Can't live with 'em, can't kill 'em

By Economist.com | WASHINGTON, DC

PASSWORDS are a pain. When they aren’t being pinched by hackers—Twitter said it lost 250,000 in February and Evernote, an online notebook service, had to reset 50m after a breach a month later—internet firms are making them harder for users to remember. Many companies, including Apple, now require a password with eight or more characters, with at least one numeral and one letter in upper case. Some insist on a sprinkling of punctuation marks, or even ban using the same character more than once.

Little wonder that the typical internet user employs just seven passwords to manage 25 online accounts. Even those tend to be variations on a theme ("Bageh0t", "Bageh1t", "Bageh2t", etc.). This aids memory but weakens security.

To bolster it, websites fearful of the reputational harm unauthorised access can cause, require “two-factor authentication”, in which a password must be supplemented by independent bona fides, such as a code texted to the user’s mobile phone. This makes life even more tedious for people. In July a group of 14 start-ups launched the Petition Against Passwords, advocating “user authentication that doesn’t require us to remember anything”.

The authors’ indignation needs to be taken with a dollop of salt; most were companies offering alternatives to traditional passwords. But they join a growing chorus. Not a month goes by, it seems, without a newfangled verification mechanism promising to ease the burden on internet users’ overloaded memories. Apple is rumoured to have included a fingerprint reader in its latest iPhone, expected to go on sale later this month.

Besides the usual array of fingerprints and retina scans, other biometric systems are on offer. On September 3rd Bionym, a Canadian firm, launched Nymi, a bracelet which detects the wearers heartbeat. The technology relies on the uniqueness of an individual’s PQRST pattern: the five peaks and troughs that appear in an electrocardiogram (ECG). Its shape depends on things like the heart’s size, shape and position in the body. An elevated heartbeat means ECG of a higher frequency, but does not affect PQRST itself.

Some ideas seem yet more fanciful. The Advanced Institute of Industrial Technology in Tokyo, for instance, has developed a chair which detects the unique shape of a user’s bottom—with 99% accuracy.

Others have plumped for non-biometric wearable technology. Google has been toying with a ring which connects wirelessly to a device to let it know when to grant access. The search giant, together with other web behemoths like PayPal and hardware-makers such as Lenovo and LG, have forged the FIDO Alliance to develop alternative authentication methods employing a panoply of USB sticks, key-fob chips and other tokens (as well as biometric markers).

That, though, which users have so far been loth to adopt. OneID, a Californian firm, dispenses with additional hardware. All it does is install cryptographic keys onto a person’s existing devices and onto its own cloud servers. To log onto to a website integrated with OneID the user simply clicks a button on his device. The company’s software does the rest.

Biometric data can, however, be cloned, as when someone’s fingerprints are “skimmed” from something he touched and replicated (or “spoofed” in the jargon), for example by etching a print onto a jelly mould. Bracelets, rings, smartphones and computers can all be lost or stolen. Consumers can freeze accounts linked to compromised accounts and devices, but sometimes a moment is all it takes for mischief-makers to do damage.

That is one reason for the increasing popularity of two-factor authentication. Clef, a company in San Francisco which backed the petition, has therefore tried to retain its benefits, while removing the tedium. To log into a participating website, a user scan a code that pops up on the login screen. (On mobile devices, he merely taps the Clef login button, which launches the app automatically.) To ensure the device is in the hands of its rightful owner, the app asks for a four-digit code. This is, admittedly, a form of password, but at least it can be safely reused for any website which has adopted the technology.

Some companies have eschewed clever gizmoes altogether, focusing instead on making passwords friendlier, for instance by tapping people’s visual rather than their verbal memory. To unlock many Samsung smartphones users do not enter numbers but draw a doodle instead. A London start-up called PixelPin has users upload an image and select a few objects depicted in it which need to be clicked in order to gain access to a website that employs the system.

For the novel approaches to gain a foothold, however, their inventors need to persuade websites to adopt them. Many are reluctant to do so. Clef has a struck a deal with Wordpress, the internet’s largest blogging platform, but few of its 250 partners are household names. OneID and PixelPin have yet to enlist any large web services or social networks. The FIDO Alliance has more clout, but it too has found it hard to shift attitudes.

That is partly because consumers, for all their whingeing about passwords, are familiar with them and distrustful of newfangled gizmos. A group of researchers led by Frank Stajano at the University of Cambridge catalogued dozens of different schemes to replace passwords over the past two decades. As yet, none has.

Correction, 14th October 2013: This piece originally cited Joseph Bonneau as the lead author of the paper mentioned in the final paragraph. Although Dr Bonneau worked on the paper, the lead author was in fact Frank Stajano. We apologise for the error.