mikiem2
Moderator
http://www.neowin.net/news/millions-of-gmail-accounts-hacked-better-check-yours-now
Google has come out & said that they're protecting accounts, that most people are not effected, & that they were not breached. I posted this link because the article links to a web site where you can check your e-mail address.
ChrisS
Administrator
The Google comment Mikiem refers to, Cleaning up after password dumps, wherein Google says:
"We found that less than 2% of the username and password combinations might have worked, and our automated anti-hijacking systems would have blocked many of those login attempts. We’ve protected the affected accounts and have required those users to reset their passwords."
It still makes me wonder about the "use one ID to login into all Google accounts" concept. Or, maybe it screams "biometrics".
mikiem2
Moderator
One thing that bothers me about biometrics is that they have to be stored somewhere. That might be OK in a perfect world, but ours isn't. Sample the population & you'll find some morons, some addicts, some with psychological issues, some with criminal tendencies etc. -- one of those folks is just as likely to get a job with the keys to the kingdom as the most scrupulous genius. So some guy comes into work high or hungover or furious with the world, or maybe he has a debt to pay off or he thinks his kid is going to disappear, and a few weeks later I'm no longer the sole owner of whatever metric based on my body. You can change a password.
Another thing is that the tech to input whatever biometrics has to be cheap enough to be universally, or at least widely used, and it has to work flawlessly every time. Apple's new payment system uses a fingerprint scan, but that scan doesn't always work, so there's another layer or two built into their system to allow for that, with alternative authentication. How secure is that going to be in practice?
Apple Pay: is it safe to pay with your iPhone?
https://blog.kaspersky.com/apple-pay/
"Dmitry Bestuzhev, an expert from Kaspersky Lab, says there’s a problem: “Touch ID doesn’t always work properly. That’s why Apple allows you to enter a PIN. For example, when your fingers are wet the Touch ID may not wok. The same shortcut scheme may be abused by cybercriminals while authorizing payments.” Keeping in mind that paying with Apple Watch doesn’t require any extra interaction, chances are that your devices may be used without your permission to drain your bank account."
And yet another thing that bothers me with biometrics is that they are data on you. At the least better tracking would be easier, but what if it's data beyond fingerprints? What happens when insurance companies with boatloads of cash figure out that they can screen their customers based on some biometric data? With millions of dollars at stake by knowing much more about the risk of insuring every individual [so they can set rates accordingly], would you want to bet that they wouldn't get their hands on that data, legally or not? And what about law enforcement or homeland security if they find that statistically certain characteristics or bio-markers are tied to certain behaviors?
You must log in to post.