Last month, Google quietly announced a plan which could have a massive impact for Android users: they hope to kill off PINs and passwords entirely for Android apps and services. What’s more, it could happen as soon as the end of the year!
Google’s annual I/O developer conference doesn’t usually make the headlines. Lacking the glitz and hype of Apple’s presentations, it’s generally a pretty sober affair.
But in this year’s even, which took place last month, the head of Google’s ‘Advanced Technology and Projects’ division, Daniel Kaufman, made a low-key but potentially game changing announcement concerning a mysterious ‘Project Abacus’.
This project aims to fully replace the PINs and passwords that keep our most crucial data safe with something else entirely: a smart way of determining your identity without you needing to remember anything at all.
Clearly, this has the potential to radically change the way we use our smart devices – so how exactly will it work, and what does it mean for you? We'll look at the facts in a moment – but first, you might be wondering what exactly is wrong with the humble password...
The problems with passwords
Passwords are one of the most familiar features of our modern, connected lives. In fact, passwords have been around for almost as long as computers themselves – the very first password login system was used on the MIT CTSS computer all the way back in 1961!
Most technology that survives unchanged for 50 years does so because it’s the best tool for the job. But with passwords, that’s simply not the case – the password is an inherently flawed security method for a number of reasons. When properly implemented, they are fairly secure – but in practice, they almost never are.
First and foremost, users need to come up with their own passwords – and most users just aren’t that good at it. For a password to be truly secure, it has to be long, to defeat ‘brute force’ hacking methods. It has to have a varied range of characters, to beat ‘dictionary’ hacks. And it has to be unique – otherwise, when one password-protected account is compromised, any others with the same password also become vulnerable.
As security research consistently illustrates, users are, on the whole, terrible at password security. Far too many passwords are guessable, crackable or simply re-used from site to site. And as long as the responsibility for coming up with secure passwords and following the best security practices lies with users, devices and critical accounts will remain insecure.
This is the problem Project Abacus aims to fix.
The Two-factor solution?
Of course, it’s not the first attempt to solve the problem with passwords.
Since 2013, Android users have been able to unlock their devices using facial recognition – and since the iPhone 5S, all of Apple’s phones and tablets have allowed users to unlock their devices and authorise Apple Pay payments using a fingerprint scanner.
More recently, Google has gone even further with a service called ‘Smart Lock’ – which can automatically unlock your device when you’re in a trusted location or within the vicinity of a trusted Bluetooth device.
But while these methods undoubtedly have some advantages over traditional passwords, their big weakness is that they still represent ‘single points of failure’: as long as a potential attacker can crack this one method, they have full access to everything.
For the most secure information – your email, bank account and the like – ‘two-factor’ authentication is the key. Two-factor techniques combine a password with something else, like a PIN sent to your phone or a ‘smart key’ for online banking.
The idea here is that this approach combines something only you know – the password – with something only you possess – the device. With both of those factors covered, the service can be fairly sure you are who you say you are.
So far, two-factor authentication is the best we have at the moment. But Project Abacus aims to be an even better solution – one that doesn't rely on passwords or PINs at all.
A question of Trust
At the core of Project Abacus is something Google call the ‘Trust API’.
With this, rather than users having to enter a password or engage in any other form of authentication, each device will keep its own running ‘Trust Score’ – essentially, a percentage value representing how certain the software is that you are who you say you are.
Right now, it’s unclear exactly how this score will be built up – but it’s likely to include a combination of biometric and other factors. Obviously, facial and fingerprint recognition are already well-established means of verifying your identity – but factors like voice recognition, location and even typing style and speed can also be harnessed by the Trust API.
Google's Ben Kaufman explained it this way: “We have a phone, and these phones have all these sensors in them. Why couldn’t it just know who I was, so I don’t need a password? I should just be able to work.”
To that end, Google’s engineers have been working hard on the project – which is currently undergoing testing by “several very large financial institutions”.
“And assuming it goes well,” said Kaufman, “this should be available to every Android developer around the world by the end of the year.”
If it all comes off as Google plans, this could be a truly revolutionary leap forwards for information security. But could it really kill off the password?
Agent’s Verdict
Undeniably, Google’s Trust API offers some massive advantages over current systems of PINs and passwords.
First and foremost, it takes the responsibility for device and account security away from its weakest link: the user. For the first time, your device’s security will actually be in the hands of experts at every step of that way.
Of course, this has the potential to be something of a double-edged sword. The new process might, in fact, be more secure – but if users never have to enter a password or a PIN, it’s conceivable that they might feel less secure, and that could make some reluctant to adopt the new technology.
But one of the big advantages of the Trust API is that it offers varying levels of confidence in a user’s identity, rather than a simple yes-no answer. This way, the really secure stuff like banking can always remain safely locked behind a secure – and reassuring – fingerprint lock or similar.
And given enough experience with this new way of doing things, I reckon most users will be glad to throw off the burden of creating, setting and remembering secure passwords.
Ultimately, though, the new method’s success will depend on Google convincing major third parties – banks and other financial institutions chief among them – that the new system is safe, reliable and worth the cost of integrating into their existing systems.
Right now, there’s no way to know how that’ll go. But if the password really is going to be killed off, it probably won’t happen for a while, and it’ll undoubtedly be a gradual process rather than a sudden shift. After all, Google doesn't represent the entire internet – even if it feels like it at times.
For that reason, it’s still worth making sure you’re up-to-date on the best password security practices – and yes, Geek Squad has a guide to help you figure it out.
What do you reckon: is the death of the password long overdue, or do you feel more secure with a passphrase only you know? Let us know what you reckon in the comments below!