Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/27/2012
04:23 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Mozilla Persona Aspires To Kill Passwords

Mozilla system promises Web authentication without site-specific passwords. User's browser will generate a cryptographic 'identity assertion' that expires after a few minutes.

11 Security Sights Seen Only At Black Hat
11 Security Sights Seen Only At Black Hat
(click image for larger view and for slideshow)
The password is dead, again.

Mozilla on Thursday said that its Persona Web authentication system, which eliminates the need to enter site-specific passwords at participating websites, has entered its beta phase and is ready for general deployment.

Passwords should have died long ago. No less than Microsoft chairman Bill Gates declared them dead in 2004. But as a Microsoft researcher noted last year, passwords still have a pulse.

"Despite countless attempts to dislodge them, passwords are more widely used and firmly entrenched than ever," said Cormac Herley, principal researcher in the machine learning department at Microsoft Research, and Paul C. van Oorschot, professor of computer science at Canada's Carleton University, in a research paper.

Were passwords to die, online security might improve. That's the theory anyway, if you assume that there's nowhere to go but up, that cybercriminals won't adapt, and that technology rather than humanity represents the weakest link in the chain. At the very least, the end of passwords would eliminate the possibility of having your password posted on pastebin.com following a data breach and having to explain to friends and colleagues why choosing "password" as your password seemed like a good idea at the time.

[ Read Google Autonomous Cars Get Green Light In California. ]

Like other single sign-on systems--and there are many--Persona promises to allow third-party websites to authenticate users without requiring them to ask for usernames and passwords.

"Instead of per-site passwords, Persona lets users log into sites with just two clicks after completing a simple, one-time process for each of their identities," Mozilla explains on its website. "This is safe, secure, and built on top of public key cryptography. Instead of a password, the user's browser generates a cryptographic 'identity assertion' that expires after a few minutes and is only valid on a single site."

Persona, says Mozilla, is easier to use than OpenID, another authentication system, because it is based on the user's email address rather than a URL generated by OpenID.

Email addresses have two distinct advantages. First, they're pseudonymous and thus provide more privacy than single sign-on systems used by Facebook and Google+, which require the use of real names. Second, they're subject to greater user control: Individuals can register and operate their own Internet domain, to more or less own their email identity. At services such as Gmail or Yahoo Mail, users cannot take their email address to another service provider if they're dissatisfied.

Persona's architecture also provides a privacy advantage. Whereas systems like OpenID require third-party websites to contact an authentication provider, Persona makes the user's browser the intermediary, passing credentials from the email provider to the third-party website. This exposes less website visit data to potential tracking.

There are benefits for businesses that adopt Persona, too. Mozilla's system provides developers with access to email addresses, enabling websites and app makers to contact their customers and eliminate the friction of soliciting an email address separately. Email addresses also play nicely with most existing login systems.

The problem with authentication systems is business buy-in. Online content and service providers might choose to integrate an authentication system like Persona, but they have tended to avoid doing so. A 2010 study conducted by the University of British Columbia's Laboratory for Education and Research in Secure Systems Engineering on the failure of single sign-on technology, A Billion Keys, but Few Locks: The Crisis of Web Single Sign-On, found that the among websites that could implement OpenID, the adoption rate was less than 0.02%.

The paper cites a number of reasons for disinterest in the technology: lack of business incentives, competitive concerns, usability, security, privacy, trust, and legal issues. The lack of business incentives for becoming a "relaying party"--that is, integrating an external authentication system--appears to be the biggest impediment to making single sign-on systems more appealing.

Although adopting a technology like Persona might have operational benefits, such as reducing password maintenance and recovery costs, doing so often doesn't have competitive benefits. Indeed, relying on an external authentication system might impose a competitive disadvantage if it deprives a company of potentially valuable user data or makes the company dependent on a potential competitor. The paper characterizes the situation as an "identity war" that "has been ongoing since the beginning of the Web" to build walls to keep customers and competitors apart. Imagine Google allowing users to sign in using a Facebook ID or vice versa and the problem becomes clearer.

However, Persona's association with Mozilla, a non-profit organization, might work to its advantage. Companies that might have balked at becoming reliant on a platform-based authentication system from the likes of hyper-competitive Facebook or Google could be more willing to trust Mozilla and its open Web ethos.

IDC analyst Sally Hudson characterized the issue as a balance among cost, convenience, and risk. "Consumers (or even corporate employees) will try to bypass or avoid using complex authentication mechanisms," she said in an email. "In a world where revenues are often driven by eyeballs and mouse clicks, anything that annoys or slows the consumer down in their quest to purchase a product or apply for a service is quickly discarded."

However, she cautioned, while anything is better than nothing when it comes to authentication, "there is no foolproof authentication method or standard on the market today."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/30/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15703
PUBLISHED: 2020-10-31
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivile...
CVE-2020-5991
PUBLISHED: 2020-10-30
NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.
CVE-2020-15273
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can ac...
CVE-2020-15276
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.
CVE-2020-15277
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.