advances in usability for cryptography/authentication

Question

I'm wondering if there have been any recent advances (say, the past 5-10 years) in human usability for cryptography and/or authentication?

By that I mean something that makes it easier for an average person to make use of the benefits of cryptography. It strikes me that although we have all these great algorithms for encryption and hashing, and they have widespread use in machine-to-machine communication, it's still hard for us humans to use cryptography, because there's an impedance-mismatch between these methods and the way most people's brains work.

(The only one I can think of is OpenID or things like it, namely a way of decoupling the authentication process from the point-of-use without compromising security, so that one authentication method can be used for many end uses.)

Some examples in case this doesn't make sense:

I was just reading the O'Reilly book "Web Security, Privacy, and Commerce" (2002 edition), and was reading about PGP, and wondering why after 20 years, it or something like it is still not in widespread use.

I'm also wondering why the allegedly secure websites (financial/healthcare) that I use, still use password access and still have "security questions" in case I forget my password, where the security questions aren't very secure.

Answer 1

This is an active area of research. There have been attempts at creating usable security tools and lots of user studies of existing tools (typically with critical results).

A good anthology for work in this area (a few years old now) is Security and Usability edited by Lorrie Cranor and Simson Garfinkel.

There is also a workshop every year called Symposium on Usable Privacy and Security (SOUPS) with lots of papers. However the best usable security papers tend to appear at the top security conferences (Oakland, Usenix Security, and CCS).

Answer 2

Cryptography is being a lot of places already and people might just know about it. For example, whenever you access an HTTPS page, that's cryptography protecting you.

For desktop applications, many people use the Truecrypt application to protect their files. You also see a similar application in Windows BitLocker.

As for why more people aren't using cryptography applications, I would suggest is that most people simply don't care nor realize they are at risk. Many people believe, "Why would anyone bother attacking me?" and so fail to protect themselves.

Security will always be secondary to performance, since if an application is not a good performer, no one will use it. As such, security is usually not only secondary, but sometimes even absent.

Answer 3

In voting schemes, there is the three-ballot system, if you can consider this as part of crypto (I do).

Answer 4

The main weakness in cryptography is that people are involved.

I'm also wondering why the allegedly secure websites (financial/healthcare) that I use, still use password access and still have "security questions" in case I forget my password, where the security questions aren't very secure.

There are more secure schemes, however they cost money. Using the "security questions" makes it look like things are being done without doing them.

The 3 main food-groups of authentication are:

• something you know (passwords and the so-called "security questions").

• something you have (tokens like SecurID or those used on online games).

• something you are (biometrics - like retina scan or fingerprints).

The tokens cost several dollars apiece, so banks won't spend the money unless the government holds a gun to their head. Although banks in Nordic countries have come up with a very cost effective alternative - mailing cards with scratch-off areas and under each scratch-off area is a unique number to use when logging in.

In the US, financial institutions use passwords along with the "security question" scheme because regulatory agencies claim that is good enough. Due to regulatory capture, this security problem cannot be fixed in the US.

Answer 5

From e-mail to cellular communications, from secure Web access to digital cash, cryptography is an essential part of today's information systems. Cryptography helps provide accountability, fairness, accuracy, and confidentiality.

Cryptography can prevent fraud in electronic commerce and assure the validity of financial transactions. It can prove your identity or protect your anonymity. It can keep vandals from altering your Web page and prevent industrial competitors from reading your confidential documents. And in the future, as commerce and communications continue to move to computer networks, cryptography will become more and more vital.

Answer 6

For something-you-know authentication, one way of bridging the human side of 'remembering' with stronger cryptography is with a deterministic algorithm that generates a public key pair from that secret. We defined one such scheme for a platform product as a means of authentication.

The trade-off is the user must be willing to remember one very complex and entirely random password, in the range of 16 characters (to protect against brute-force key attacks). However, once that investment has been made, different identities are easily generated by making slight variations to the input secret.

There are a number of advantages to such an approach, e.g. passwords are never transmitted nor stored on servers which eliminates certain types of attacks, and also a user can authenticate herself across multiple domains without relying on any centralized identity managers.

Below is a simple python code example which generates a 1024-bit RSA identity from a set of input parameters (requires Versile Python):

>>> from versile.quick import *
>>> purpose, personal = 'mail', 'johndoe'
>>> pwd = 'kW4mcpF9qzaAp4hw'
>>> identity = VCrypto.lazy().dia(1024, purpose, personal, pwd)
>>> print(VX509Crypto.export_private_key(identity))
-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQDLo3fjhkBYGHa9f2ZrydP9QBMEsZ+atEneHxOqG5+ry6V1a8zmqgHr4ai8Fvep
cXHcK2ON5gegoCO0mJTsp/hyo88C1ybN6jqNj7xNhN17qX9nU8zicKZXEQ+UXgC5vm14qfGAqUoP
xJu2RwSdBV3hCCSbsb8M4d4owcnAXTjfIQIDAQABAoGAQPDstt6FfpKuq1gJra47sLPSXNjYcVm1
hOScPM96aCsVpRCv04+79SGN0g3xBVRsXy5nHUWSgSMQv/M46w/WJwc34er1Dp5UZ8Tb0PREPTEo
vkaGZGubSi38eGV0w9S18aqivmym2y338yHSKMoG2SyCVfzXkEfj/EagVExAjMECQQDyticAA6qj
BEtPQQlc35u7EPxu6RFNVX66cEC3MvD8ZrCH0w70o0v/1TPBEhncVAwS7q/eabS0Wqbp/DfFtdPF
AkEA1smrJ0HKHUi0TBk0YPVhdST7DAdmf/gkUHcrpdvUf6pMdlYwDzpXItteS0jCzYUQiz1vlW70
hzh+VRODDFrnrQJAGubVq8q8PxVaw44R25ltSW64jBKJOGkhgsiuY5/h1hgLuQJLxhHTeqfG9L9s
3l7yd6a9F4nf3Z2uooCyLdfZgQJAJ9lsnrDvDbXSdZfrht2fwjslNJse4jkoi6FAgNojN7hhzUa6
Tej2B6qJeRA7zCOW6S5xyFi4l2nczm37T0yCVQJAJLnSO0Hh3BmxVnxC6gzk1F7JtVXoMcCB8D75
w0shTDy/OlHH8gQ3mSwkkYvqogflTgO8aa9RJhuXJBxuGjHQEw==
-----END RSA PRIVATE KEY-----
>>>