The Death of Passwords October 10, 2022 – Posted in: Cyber Security

Intro

For the last few decades passwords have been the way to confirm your identity when logging onto a computer or, latterly, a web site. However, passwords are reaching the end of their lifespan: they’re too easy to work-around and too difficult to for users to remember and manage. It’s time to look at the alternatives that have become available in the last few years.

Why Passwords?

Passwords have a massive advantage over all other forms of verification. They’re free, well understood and universally available.

Password Problems

Problems with passwords have become more and more obvious over the last few years. Everyone will have experienced the problem of “your password needs to contain numbers and punctuation”. Why are passwords not long enough? Why do they need more complex characters? Why do I need to change them? What’s wrong with “monkey123” or “P@55w0rd”?

Passwords leak. Sites get hacked.
Accounts get compromised.

Huge lists of passwords make their way onto the Internet and are used as the basis for launching new attacks against providers and web sites.

Since these lists generally include e-mail addresses as well as passwords, an attacker will know that the average user won’t have a unique password for every single site, and so will attempt a “Password Spray” attack against many web sites.

Another problem is that computers keep getting faster, and so the amount of time required to brute- force decrypt a large database of encrypted passwords is less. This can be offset by making your passwords longer and more random, where each additional character added will multiple the complexity by perhaps 100 (as long as your password is as close to random gibberish as you can make it). You can go from a password being brute-forced cracked in hours at eight characters, to taking years, decades or centuries by just making the password a few extra characters longer.

However, none of this matters if you accidentally get fooled into entering your password into a phishing site.

Password Managers

The average person needs to have recorded the passwords for dozens or even hundreds of web sites and services. The human brain cannot manage to do this: security professionals tell us that passwords should be unique, randomly generated, and long (eight characters at the absolute minimum – better to use eleven or more). Therefore these passwords need to be written down or recorded somewhere. A notebook would work, and could be used for those essentials passwords as a backup; however, the best advice is to get a password manager to record all of your passwords. These are generally built into your web browser, and so these can be synchronised via (for example) Google’s environment if you’re a Chrome user. However, it is probably better to pay a

monthly fee for a better password manager such as BitWarden, LastPass, 1Password, etc. as these offer many more features. You generally get a tool bar for your browser and an app for your phone, they do family plans which also (though this is a little morbid) mean that, at your death or incapacitation, someone can still access your accounts. A Password Manager will also highlight poor passwords, and allow you to auto-fill extremely long and complex passwords so that you no longer need to have a clue as to what they are. All you’ll need to remember is that one, extra complex password that unlocks your password manager (the last password you’ll ever have to remember as one of the above password managers reminds us).

How You Combat Password Problems – 2FA

There’s been a drive to supplement passwords with extra techniques to foil an attacker. The username is tied to your identity and might be an e-mail address – you assert this is who you are. A password is something you know – commonly called a single factor. The normal technique used is to add something you have – a second factor. This could be a key fob that generates numbers every minute or so, but most of the time mobile phones are so ubiquitous that the second factor will be tied to that. This technique is normally called Two Factor Authentication, or 2FA for short.
Sometimes it will also be called Multi Factor Authentication (MFA).

Second Factors

The most commonly used second factor is the Text Message. This is beloved by banks especially because ANY mobile phone can be used and so it doesn’t exclude many users. However, techniques such as SIM Swapping can be used to target a particular person. Also, codes from SMS can be entered into Phishing sites (more later). Another problem with SMS is you have to be in range. In a town or city you’re normally fine; however, if you’re trying to log onto your bank or a web site from a country location you may simply not receive the text message you need.

Mobile Authenticators: these require an app installed on a smart phone. This puts them out of the range of some users (who might have a dumb phone or an out-of-date smart phone that isn’t usable), but this technology is readily available to most of us. However, we need to understand what to install, the prompts displayed by the app, and what to do once installed. Basically, the service you’re using generates a secret password for you (not one that you need to remember!), normally encoded in the form of a QR Code (one of those square bar codes made up of little square dots), that is stored by your authenticator app. The app does some mathematics based on this shared secret password and the current date and time (so your phone needs to have the accurate time), and produces a six digit code. Thirty seconds later another code is generated, and this keeps going. The web site or service you’re trying to use also calculates the same code and compares it with the one you enter into the dialogue box. If the same, you’re logged in. Two advantages over SMS codes: they’re available no matter how good your cellular coverage is at the time and they cannot be subjected to SIM Swapping. However, as well as requiring a smart phone, the secret password could be leaked by a dodgy app on your phone and they’re not Phishing Resistant (like SMS – more later). Common apps used here are Google Authenticator, Microsoft Authenticator, Authy Authenticator, LastPass Authenticator, FreeOTP – they are many more.

Push Notification: again you need an app on your phone. However, this app must tie closely to the service you’re trying to access. Common apps in this arena are from Duo and Okta, plus Microsoft is able to use this technique for their Office 365 MFA if you have the Microsoft Authenticator. When you attempt to log in, you will receive a notification (the “Push”) from the app on your phone. Most of the time you’ll just need to press Yes, OK, Approve, and there will be a No, Deny or Cancel option if you’re receiving the push notification and it wasn’t you logging in. Obviously you need some form of network connectivity (Wi-Fi or cellular) but most people normally have some network connectivity. One problem that sometimes occurs is that an attacker can use a technique known as Notification Fatigue where they send you repeated prompts to click Yes or Approve until you press this just to make it stop. Obviously the user isn’t to blame in this situation: if you receive a hundred prompts in an hour, it’s a software problem rather than an attacker, right? A workaround for this is

being rolled out to many apps where they produce a code (often just a couple of characters) on the device that needs to be entered into the web site or service. If it’s an attacker trying to log in they’ll be immediately defeated by this.

Phishing Resistance

Phishing e-mails: we’ve all received them. “Click here to update your password”. “Your account has been compromised: click this link”. Criminals now operate services that work around 2FA and MFA that’re based on SMS and authenticator apps. Normally you’d expect to be protected by 2FA/MFA if you enter your username and password into a phishing site. However, if that site is working as a Man In The Middle (i.e. everything you type into the password and 2FA boxes is immediately passed to the real service you’re expecting to be using), then the attacker gains an Authorisation Token (like a website cookie) that they can use at their leisure from their own computer to access your account. You may continue to interact with the web site, blissfully unaware that your account has been compromised, but then the attacker can perform their malicious actions later in the day.

How Bad Could It Be If One Of My Colleagues Was Phished?

Let’s imagine that someone without any seniority in your company was sent an e-mail with a phishing link. They enter their password, and possibly their MFA code, into a phishing site, and they either don’t realise or want to admit that they’ve done something silly, and so go about their day.
What could result from this?

Your colleagues have a trusted position. They are able to send e-mails using the company’s domain name. Other colleagues are likely to trust their requests. An attacker with access to a mailbox on your network can start to socially engineer their way to a position of being trusted by clients and colleagues. What if Madeline the Managing Director receives a request to look over a document?
That could be a phishing link, but from inside the organisation. At this point the attacker may have compromised the account of a much more senior colleague than the original mark. Or Andy in Accounts is asked to make a payment? What about access to another environment, such as on- premises servers? They could send an e-mail to IT, requesting a new VPN account and a password reset. “Sorry, I’m having an awful day. My laptop was stolen and so I’m forced to use another computer. Please can you get me back onto the file server?” Again, the request is from an internal address, why wouldn’t you trust the request and act on it?

Each time they send an e-mail or receive a response they can hide these messages so that the account’s owner doesn’t suspect anything. A common occurrence is that new Outlook rules are created to immediately forward certain responses before deleting them. As long as no-one notices the intrusion the attacker can worm their way around the network. Attackers are commonly in an environment for months before anyone notices. The Albanian government recently suffered a massive failure caused by Iranian hackers who had been resident on their network for more than a year.

If the compromised account is on Microsoft 365, the account has access to the Microsoft Graph. This is a relational system allowing look-up of a wealth of information about your environment.
Whilst much of the information might be locked away, an attacker with access to a colleague account could run searches through e-mails, contacts, Teams attachments, OneDrive file storage, and any other databases you run, looking for specific search terms relating to high value clients, mistakes that should have been buried, etc.

What would they do then? The playbook at this point is likely to be Business Email Compromise (BEC) whereby they attempt to get someone in your company or a client to send large amounts of money to an account under their control. However, they could also decide to go down the ransomware route: encrypt large volumes of data, then demand money to release the decryption key or to stop release of confidential data to the public.

Biometrics

Biometrics is an important part of the discussion, but not the most important. Biometrics relates to identifying yourself based upon something unique to your body such as a finger print, your facial features, your voice or your iris. However, there’s one massive disadvantage to using biometrics on the Internet: you can’t change them if they leak out. If someone figures out how to replicate finger prints and has access to yours, you can never stop them logging in as yourself. However, you can certainly use them on a personal device to log yourself in, or to unlock an app or password database.

All Of This Is Just A Sticking Plaster

The problem with all of these 2FA or MFA techniques mentioned so far is that they are just improving the existing password-centric systems. Fortunately we now have better ways of securing access to services and web sites. Let me introduce FIDO2.

FIDO2 – Fast Identity Online
Multiple Proofs

First: a quick aside. Everyone is used to entering a username (e-mail address) and password into the same dialogue box. However, there’s no reason that this is the only way to prove your identity. Don’t think of “E-mail Address AND Password”, instead think of “E-mail address – assertion of identity” followed by “Password – the proof”. When you have to provide ID for an official reason, you may be asked to provide two of Passport, Driving Licence and Utility Bill. This means that there can be more than one proof of identity. Until now, password would normally be the ONLY way to verify your identity online. Yes, you might need 2FA or MFA in addition, but this is just in support of the password: you couldn’t use just the six digit code from your authenticator app, for example. Now, with FIDO2, it could become standard practise to have more than one proof of identity. Each proof can be used on its own, but you might have one proof on your phone and another as a USB device, or on a Windows PC.

FIDO2 – The Identity Gorilla

There are a number of systems that could replace passwords. However, the FIDO Alliance is one of the leading organisations able to make a difference. It is made up of a collection of companies including a number of the IT industry leaders. Google has been there since day one, and Microsoft and Apple are members. With this number of influential companies FIDO2 has a good chance of being successful.

How It Works

I don’t want to dig deep into the fundamentals, but FIDO2 uses two technologies: CTAP
WebAuthn

Essentially CTAP is how your device handles local authentication, and WebAuthn is the way in which the requests are processed between your device and the remote service provider. WebAuthn is a W3C standard: this means that it’s supported by all current web browsers (on mobile devices as well as PCs and Macs) and by any other software able to make use of the web browser as a channel (like Office applications). Support needs to be available on the server or service you’re trying to access: Microsoft is in the lead here with Office 365, but the fundamental building blocks are readily available to other providers.

When you try to log in a challenge is sent by the web site or service provider, and your device encrypts this using the private key stored locally so that the remote party knows that only you could have done this. You are immediately granted access – it’s faster and more secure than using a password and MFA.

What Do You Need?

You need an authenticator. This isn’t (in most cases) the authenticator app; instead this is a FIDO2- specific term that means a way of storing one or more private keys. Private and Public keys are a well-known way of securing connections and data: the private key is in a pair with the public key and musn’t be revealed (in a FIDO2 authenticator it’s locked away and CANNOT be released), and a public key (which can’t be used to decrypt the secret data) can, and should, be revealed to interested parties. The original FIDO2 specification called for the authenticator to be a physical device, typically a USB key. A number of companies make these, with the most well known from Swedish company Yubico (the “Yubikey”), but others are made by Google (“Titan”), Feitian and Kensington. These are the gold standard of authentication available to individuals and small businesses. At about £60 or so each they’re priced so that an individual can have a couple (always have a backup), and a business can have one for each employee or power user with a few as spares.

However, since the vast majority of people wouldn’t want to spend any money on a single-purpose device, the FIDO Alliance has recently announced passkeys.

Passkeys

Passkeys use the same public / private key cryptography as FIDO2 hardware devices. However, they exist in software on specific mobile devices or computers. They rely on the cryptographic chips on most computers and phones to store the private keys out of reach of malicious software, but passkeys will also be transferable to other devices in the same ecosystem. If you create a passkey on an iPhone, it will immediately become available on a Mac and an iPad logged in with the same account. An Android user losing their phone will be able to regain access to their passkeys on their new device. Microsoft also support passkeys on Windows (as a FIDO2 authenticator) and with their Authenticator, however there are a lot of different ways of interacting with their complex ecosystem. Full Android support is in the pipeline, Apple iOS 16 already enjoys support. FIDO2 has been around for a few years, but passkeys have only been announced in the last few months. They can be used now, but there are probably some rough edges at the moment.

Where Does Biometrics Come Into This?

Most users of mobile devices now use some sort of Biometrics to quickly and conveniently unlock their phones and tablets. Apple’s Face ID and Touch ID, and the various different Android variations on this theme have all made getting into your devices and critical apps (such as banking apps) much more convenient and faster. Biometrics can also unlock the passkeys database on these devices. What this means is that getting logged into a service or web site might be as complicated as holding your finger or thumb on the fingerprint reader, or looking at the device.

Microsoft Authenticator

The Microsoft Authenticator enjoys a slightly odd but very useful place in the list of software. Firstly, as mentioned earlier, it can be used to generate 2FA codes. Secondly it can also function as a passwordless (passkey) store. If you provide login credentials it can synchronise account details from one device to another (or so that they can be restored after device loss). One very useful feature is that it can be used on both Android and iOS. This means that you can create a passkey for a Microsoft Office 365 account, and in the future you can log in simply by entering your e-mail address and then confirming the numbers shown on your computer screen and entering them in the app. With Biometrics you can be logged in after only a few seconds of work and you never need to worry about remembering your password or 2FA codes.

Domain Binding

One of the important innovations of the FIDO2 specification is that each FIDO2 private/public key pair or passkey is bound to a specific domain name. If you log onto Google with a passkey, that passkey will not be valid if you get redirected to a phishing site. This phishing resistance can be very valuable: in a recent campaign that caught several high-profile tech companies, Twitter stood out as an organisation which was attacked but no-one was able to hack their way in. The reason for this was their use of phising resistant authentication. Although at least one of their users gave out their password to an attacker via a phishing site, the attacker was unable to exploit this.

Summary

Passwords are a long way past retirement. Whilst they can (and should) be supplemented with 2FA/MFA, they need to be replaced with FIDO2 devices or passkeys.
FIDO2 cannot be used for an on-premises AD domain login as yet. It’s possible that a third party solution might be available one day, however it’s more likely that on-premises servers will be replaced by Cloud services over the next decade. This means that Microsoft may choose to never support FIDO2 on premises.
FIDO2 USB keys have been available for years and are well understood. They are phishing resistant and the gold standard for authentication. However, they have a cost and FIDO2 needs better support from service providers.
Passkeys are very new and some facets of their use (for example, exporting them from one ecosystem to another) are unknown. However, they are very fast and secure and enjoy support from Microsoft Office 365 (as a remote service) and the iOS and Microsoft Authenticator clients right now. Passkeys are highly likely to become the dominant login mechanism in the next few years (although passwords will hang around for some while).