Slashdot has had a couple stories posted in the last couple days about new authentication schemes. The first scheme comes from Carnegie Mellon University, where graduate students have developed a method to cover the input interface with the hand to protect against observational attacks, combined with a graphical password control. The paper is well-written and, though not seemingly reasonable to implement quite yet, poses some interesting ideas. More on it at the following links:
http://it.slashdot.org/article.pl?sid=08/02/08/0452221
http://www.darkreading.com/document.asp?doc_id=145104&WT.svl=news1_2
http://www.andrew.cmu.edu/user/nicolasc/publications/SCH-CHI08.pdf
In other news, a startup named Credentica is featured in an article on Wired discussing their authentication scheme and how it could prove identity with minimal information exchanged. They leverage a cryptographic method to authenticate a transaction without necessarily disclosing identity. This concept seems rather strange in that the whole point of authentication is to reasonably prove an asserted identity. The opening paragraph of the Wired article puts it in a little better perspective:
"Imagine you could prove you were 21 without revealing your date of birth -- or anything else about you, for that matter. Or qualify for a loan without disclosing your net worth. Or enjoy the benefits of e-commerce, e-health and e-government without a moment's fear that you are open to identity theft."Overall, this sounds interesting, but my "snake oil" alarm is tingling and I'm not sure I see the benefits (yet) of this type of transaction. Maybe I'll understand it once I've re-read the article a couple times. More info at these links:
http://yro.slashdot.org/article.pl?sid=08/02/09/0229203
http://www.wired.com/politics/security/news/2008/02/credentica
