Death-to-passwords FIDO Alliance finds a friend at DOCOMO

co-founding member Nok Nok Labs

Who's there Labs?

What's the false positive / false negative rate?

Must keep an eye on this technology.

I can't see it taking off

Sounds easy to hack

All I (eye) need is a good photo of the victim's eyeball to wave in front of the phone. Or a video clip, if they're really sharp...

Easier than lifting a fingerprint onto a gummy bear.

No e-commerce on the phone

Only a fool would attempt to do e-commerce on your smart phone. It's not secure at all. Phones are public facing and have no firewalls you'd have to be an idiot to participate. And governments have been going hard trying to get malware on phones. All it would take is for that iris signature to be sniffed.

I think it's a great idea but cabled into a computer or part of a computer that doesn't have malware built into the hardware of course and behind a firewall.

FIDO on a wrong path

FIDO is sadly promoting biometrics in a wrong manner.

Biometric authentication could be a candidate for displacing the password if/when (only if/when) it has stopped depending on a password to be registered in case of false rejection while keeping the near-zero false acceptance.

We could be certain that biometrics would help for better security only when it is operated together with another factor by AND/Conjunction (we need to go through both of the two), not when operated with another factor by OR/Disjunction (we need only to go through either one of the two) as in the cases of Touch ID and many other biometric products on the market that require a backup/fallback password, which only increase the convenience by bringing down the security.

In short, biometric solutions could be recommended to the people who want convenience but should not be recommended to those who need security. Below is a brief slide titled “Password-Dependent Password-Killer” posted with respect to this theme.

http://www.slideshare.net/HitoshiKokumai/password-dependent-passwordkiller-46151802