"The biggest thing with password security isn't you coming up with a password for a website that can't be hacked. That doesn't matter. The important thing is that for an organization, one bad password compromises your whole system. All you have to do is try accounts until you find the idiot who set his password to "password1" and then you can install a rootkit and compromise the whole thing." - Joel H.

I was reading an online discussion about username+password authentication: the pros and cons of it. Someone mentioned how we need something better, but it's the best we have right now so (almost) everybody is using it for website authentication.

Most of the factors that make the username+password not-so-secure have to do with the users and not the method. There are guidelines (wikipedia) to help create strong passwords. But they also tend to make these passwords harder to memorize. When coupled with another advice to not reuse the same password for different accounts, they create an even more bothersome situation for the users. The result is that a good number of people either use simple passwords (easy to crack) or use the same password for multiple accounts (crack one, crack all).

I thought up a different approach to tackle these two issues. When compared to real life counter part, most websites today are like buildings that require people to punch in their PINs for access. The alternate approach already has a real life counter part: buildings that require people to insert their keys for access. The main difference is the first is "something you know" and the second is "something you have". (There's also the "who you are" concept, but I'm not a fan of it.) In fact, both of these methods have been in use for quite some time now, the latter just not with websites (that I know of).

The Idea

The idea is to replace password (text) with key (file). That's it. It's that simple. On the log in page, instead of entering username and password, the user would enter his username and upload his key. The key can be of any type (text, image, PDF, etc) and any size (10 kB, 10MB, etc). Though it is a good idea to put limitation on them (for example only allow certain file types, or limit file size to < 10 MB). The key is determined at a prior time either by the user during registration or the site itself by assigning randomly generated key.

Since the idea of username+key is very similar to username+password, some of the issues carry over such as

• The user needs his password to login.
• The user needs his key to login.

• If he forgets the password, he can't login.
• If he loses the key, he can't login.

• If someone else knows the password, they will have access to the account.
• If someone else has the key, they will have access to the account.

Pros & Cons

• pros
  • It is easier for users to have complex/large keys than to memorize complex/long passwords.
  • It is easier for users to have more unique keys than to memorize more unique passwords.
  • Greater input space makes it harder for basic brute force attack.
• cons
  • Inconvenience: the users need to have access to the key in order to log in (e.g. carry it in a flash drive).
  • Requires more resources (e.g. bandwidth of sending file vs text).
• others
  • Since a key can be any file, it's possible to not have to actually encrypt it. It can be hidden in plain sight among normal files. Unless an attacker watches your traffic and gets the key file size.

Summary

The key method still authenticates using username+something against the database. From the back end stand point, it's pretty much the same as the password method. Which means other security measures that you can apply to the password method, you can also apply to the key method.

But from the user stand point, they won't be required to memorize multiple, long and complex passwords for good security. Instead they will be required to possess the keys whenever they want access (just like carrying physical keys). Overall, I believe that the key approach provides better security in exchange for some inconveniences.

In general websites that users access often and require lower security will probably not find the trade off favorable. Another thing to note is that this username+key authentication can replace username+password in any system. I mentioned websites here, but other domains such as desktop applications can also benefit from it.

Demo

I created a simple demo of the username+key login system. You can check it out at https://karn-test.appspot.com/demo01/.

Newton's Third Law: "To every action there is always an equal and opposite reaction: or the forces of two bodies on each other are always equal and are directed in opposite directions."

Every time you take a step, you are pushing yourself forward at the expense of something else going backward. In this case you're pushing the Earth. Since the Earth is rotating eastward, if you take the step at the equator and also head east, you are slowing the Earth's rotation down. If you heard west, you are speeding it up. Let's see if everybody walking at the same time in the same direction can affect the Earth's rotation!

First we list some of the numbers we're going to use (rounded for simple calculations):

• A person's mass: 1 e2 kg (average is closer to 70kg)
• Number of people: 1 e10 (closer to 6.7 e9; source)
• A person's acceleration at beginning of sprint: 3 m/s^2
• Earth's Radius: 6 e6 m (actual ~ 6.378 e6; source)
• Earth's Mass: 6 e24 kg (actual ~ 5.9742 e24; source)
• Earth's Anuglar Mass: 8 e37 kg*m^2 (source)

And some formulas:

1. angular mass = mass * radius^2
2. force = mass * acceleration
3. torque = radius * force (assuming ? of 90)
4. torque = angular mass * angular acceleration

From this we can calculate that if everybody stands at the equator and starts sprinting in the same direction at the same time, they exert ~ 2 e19 N*m of torque:

1. torque = radius * force
2. torque = radius * (mass * acceleration)
3. torque = (6 e6) * (((1 e10)*(1 e2)) * 3)
4. torque = (6 e6) * ((1 e12) * 3)
5. torque = (6 e6) * (3 e12)
6. torque = (1.8 e19)
7. torque ~ (2 e19) N*m

We modify one of the equations to tell us how fast the Earth would rotate with this much torque:

1. torque = angular mass * angular acceleration
2. angular acceleration = torque / angular mass
3. angular acceleration = (2 e19) / (8 e37)
4. angular acceleration = (2) / (8 e18)
5. angular acceleration = (1) / (4 e18)
6. angular acceleration = 0.000 000 000 000 000 000 25 rad/s^2

In this example we simplified the numbers and rounded them in the conservative side. If everybody on earth were to run in the same direction at the same time, we still wouldn't budge the Earth one bit. Ok, maybe a tiny tiny tiny bit. But way too small to be of any significance.

Another way to alter the Earth's spin: Water Reservoirs