Google sees one password ring to rule them all

Google researchers have proposed a USB key, or even a finger ring, to solve the problems with website passwords

Google thinks it might have found an answer to the vexing problem of forgotten or weak passwords: "physical" passwords, which might come in the form of a piece of jewelry such as a ring.

In a research paper, two of its engineers write that current strategies to prevent the hijacking of online accounts, including the two-step identity verification system, are insufficient, partly due to the constant threat of attacks that exploit new bugs.

Google highlights phishing, in which hackers dupe account holders into revealing sensitive information by making them sign into a fake account login page, as one of the biggest security threats of today.

"It's time to give up on elaborate password rules and look for something better," the authors say. The research paper, by Google's Eric Grosse and Mayank Upadhyay, is to be published Jan. 28 in the publication IEEE Security & Privacy. It was first reported on by Wired earlier Friday.

At the core of Google's proposal is an idea it says has been used by businesses but has found little success among consumers: an encrypted USB-like device that people would use to log into password-protected websites and online accounts.

Google says it is working on an internal pilot with an experimental USB device that users first register with multiple websites where they have accounts. A compliant browser would make two new APIs (application programming interfaces) available to the website to be passed down to the attached device.

"One of these APIs is called during the registration step, causing the hardware to generate a new public-private key pair and send the public key back to the website," the paper explains. "The website calls the second API during authentication to deliver a challenge to the hardware and return the signed response."

The method wouldn't require any software to be installed, though users would need to be using a Web browser that's compliant with the effort, Google said. The registration and authentication protocols would be open and free, and the device would connect with a computer's USB without needing any special OS device drivers.

Basically, the Googlers envision a single device that people can slide into a USB slot and then use to log into any number of online accounts with a single mouse click.

Because carrying around another device may not prove popular among consumers, Google suggests the authentication device could be integrated into a smartphone or even a piece of jewelry. The device would be able to authorize a new computer for use with a single tap, even in situations in which the phone might be without cellular connectivity.

The technology aims to improve upon the company's current, optional two-step verification system. With that system, when users want to log into a Google service from a new computer, they're prompted to enter a code sent to their preregistered mobile phone, granting them access to the site.

The company says its experience with that system has been good, though it too can be abused by account hackers. After they steal a password and break into an account, they sometimes set up a two-factor authentication using their own phone number, "just to slow down account recovery by the true owner," the Google engineers wrote.

Google admits its proposed USB key approach is "speculative" and that it will need to be accepted on a wide scale. But the firm said it is eager to test the device with other websites.

"User device registration with target websites should be simple and shouldn't require a relationship with Google or any other third party," the engineers write. "The registration and authentication protocols must be open and free for anyone to implement in a browser, device, or website."

Google didn't say if or when the experimental system might make it into use. "We're focused on making authentication more secure, and yet easier to manage. We believe experiments like these can help make login systems better," a spokesman said via email.

Join the PC World newsletter!

Error: Please check your email address.

Tags Internet-based applications and servicesonline safetyAccess control and authenticationdata breachscamsdata protectioninternetIdentity fraud / theftmalwaresearch enginesGooglesecurity

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Zach Miners

IDG News Service

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?