Tag Archive for: Apple

Did Apple Passkey Just Kill Traditional Passwords?

And Will Passkeys Permanently Marry You to Apple?

Humans are weak and so are our passwords. We make easily memorizable (read: guessable) passwords that accidentally invite cybercriminals and identity thieves into our homes, offices and bank accounts like a neighbor for afternoon tea. The solution? Remove humans from the tea party.

Enter Apple. At the company’s annual WWDC developer conference, Apple proposed a new form of authentication that may put passwords entirely out of business. But are we truly ready to retire those decades-old, reuse-for-everything-but-the-kitchen-sink passwords?

Many tech giants are making the move away from passwords and towards passkeys. Why? Because our passwords stink. While a password is a series of numbers, letters, and symbols typed in by a user to unlock an account, a passkey is a form of biometric authentication that is stored in the physical device. Instead of typing “123456” into any given account (which happens to be the most common password for many years running, along with, you guessed it, “password”), Apple proposes a finger/face ID that would automatically sign you into your accounts by unlocking your device. Should you lose or break that phone, passkeys are backed up to the iCloud Keychain and synced across devices. Not to mention, the keys will allow us to sign into websites with end-to-end encryption, further deterring hackers from reaching any valuable data.

How Passkeys Are Like Nuclear Launch Codes

Passkeys can be compared to the “two man rule”, which is the extra layer of protection behind the launching of nuclear missiles. This rule basically requires that two (or more) people each have a key that operates only when paired simultaneously with the other key. In order for anyone to push the missile-launching red button, each key holder needs their physical key to unlock it. This creates a buffer between mistakes (no spilled coffees starting nuclear war, phew!), emotional overreaction, and hacking. Cybercriminals are much less likely to hack both ends of the passkey–both the user end on the device and the company end on the website. By removing weak passwords on the user end, and weakly protected databases of passwords on the website end, hacking is less likely to exploit the human element.

The introduction of passkeys to replace passwords has us wondering–what are the unintended consequences of this new and shiny solution? We must remember that hackers are the masters of unintended consequences. While we cannot be sure of these downfalls, we know that the good guy’s solution is the bad guy’s shiny new opportunity. For example, passkeys will unintentionally increase the marketplace for stolen credentialized devices (working smartphones along with their working passcode). This may introduce a greater physical threat of violence as cybercriminals target the parts of the equation held by us consumers.

Another thing to keep in mind is the myriad of ways in which we are in Apple’s pocket by keeping their products in ours. Apple is very intentionally leveraging security to keep us roped into their products. In fact, they have made security and privacy one of their key competitive differentiators.

So is it worth it? Are we willing to be beholden to Apple products for better security? That is for you to decide as we head into a new password-less era. Like with most new technology, it’s often better to pause, observe, and wait for the unintended consequences to pan out. While it would be easy to throw our hands up, smile at the face ID, and get to our Netflix show without touching a keyboard, we have to know what measures are in place to protect our most valuable capital. And we won’t really know that until cybercriminals have a crack at it.

Pros of Apple Passkey

  1. Efficient and easy to use (no more memorizing guessable passwords!)
  2. Less fallable than human knowledge/memory
  3. Social engineering is taken out of the equation
  4. Security is no longer reliant on that password that you created ten years ago and have copy/pasted since
  5. Stored on the device and therefore more resistant to data breaches
  6. End-to-end encryption (that even Apple supposedly can’t view)

Cons of Apple Passkey

  1. Increases the marketplace for stolen credentialized devices
  2. Increased dependency on the phone and upon Apple
  3. Unknown how passkeys would work for non-apple users

Things to keep in mind about all technological advances

  1. Big promises will always have unintended consequences
  2. In general, it’s better to wait and see when it comes to new technological advances, especially in organizations, where rolling out a new technology can create massive headaches.
  3. Biometrics are not the end-all solution even if it is safer. How companies store and protect that data matters too.

_________________________

John Sileo shares his story of losing everything to cybercrime with keynote audiences around the world. He specializes in the human element of cybersecurity and how technological changes like the death of passwords can derail an entire organization. Contact us at 303.777.3222 to see how John would customize for your event.

New iPhone Setting Stops Apps & Ads from Stalking You (App Tracking Transparency)

Apple App Tracking Transparency is Finally Here!

With the release of iOS 14.5, Apple has given us the most powerful privacy tool for users in many years – it’s called App Tracking Transparency (ATT). The update also includes a lot of features that have Apple product users very excited, like new Siri voices and being able to open your iPhone with Face ID even when wearing a mask—IF AND ONLY IF you have an Apple watch.

But as a privacy advocate, the element that matters the most to me is the App Tracking Transparency (ATT) feature. This means that apps like Facebook, Instagram and Google will no longer be able to track or gather your surfing habits on other apps or websites without getting your permission. For example, if you worked out on the Peloton app this morning, Facebook can buy that information and advertise exercise clothing to you based on your exercise type, size, weight, etc.

This is a serious blow to Facebook and other “free” services that depend on gathering your intimate personal and behavioral data to sell to their advertising clients. Of course, these services have never actually been free, as we have always been paying by giving them our information.

Specifically, the update changes the Identifier for Advertisers (IDFA), which is a unique random number assigned to each iPhone and allows advertisers and developers to track user behavior on that device. This includes not only app usage but also web browsing behavior that is often used to target advertisements to your psychographic profile. Apple says this change will provide transparency and give users an easier way to choose if their data is tracked.

Needless to say, Facebook, Google, and other big tech firms are not happy with the change. Facebook was so upset they placed a full-page ad in The New York Times in December claiming that the change would negatively affect small businesses who will see a drop of over 60% in sales. Facebook was unable to substantiate that claim, but their claim that it will force developers to enable in-app purchases or force subscriptions to make up for lost revenue is most likely true.

What will this look like for you as a consumer?

Basically, whenever you open any app that wants to access the IDFA, you will see a pop-up notification that asks for permission to track you across apps and websites by other companies and you’ll be able to opt in to allow tracking or not by choosing between “Allow Tracking” or “Ask App Not To Track.” Opting into data collection rather than having to opt out finally catches up with data privacy regulations such as the EU’s GDPR. It will be required by all software makers within a few months of the release.

So it comes down to a question of are you willing to pay for the extras provided by apps in order to have a little bit more privacy?

John Sileo is a privacy keynote speaker, award-winning author and media personality as seen all over TV. He keynotes conferences virtually and in person around the world. John is the CEO of The Sileo Group, a business think tank based in Colorado.

iPhone and Droid Want to Be Your Big Brother

Remember the iconic 1984 Super Bowl ad with Apple shattering Big Brother? How times have changed! Now they are Big Brother.

According to recent Wall Street Journal findings, Apple Inc.’s iPhones and Google Inc.’s Android smartphones regularly transmit your locations back to Apple and Google, respectively. This new information only intensifies the privacy concerns that many people already have regarding smartphones. Essentially, they know where you are anytime your phone is on, and can sell that to advertisers in your area (or will be selling it soon enough).

The actual answer here is for the public to put enough pressure on Apple and Google that they stop the practice of tracking our location-based data and no longer collect, store or transmit it in any way without our consent.

You may ask, “don’t all cell phone carriers know where you are due to cell tower usage?” Yes, but Google and Apple are not cell phone carriers, they are software and hardware designers and should have no real reason (other than information control) to be tracking your every move without your knowledge. Google and Apple are not AT&T or Verizon, therefore they should not be recording, synching and transmitting your location like it appears they are.

Both companies are trying to build huge databases that allow them to pinpoint your exact location. So how are they doing it? By recording the cell phone towers and WiFi hotspots that you pass and that your phone utilizes. This data will ultimately be used to help them market location based services to their audience, which is a market that is expected to rise $6 billion in the next 3 years.

The Wall Street Journal found through research by security analyst Samy Kamkar, the HTC Android phone collected its location every few seconds and transmitted the data to Google at least several times an hour. It transmitted the name, location and signal strength of any nearby WiFi networks, as well as a unique phone identifier. This was not as personal of information like what the Street-View cars collected that Google had to shut down some time ago.

So what do we do now? According to the Wall Street Journal, neither Apple or Google commented when contacted about these findings, so it is hard to know the extent of how they are using the data collected. Right now, there really isn’t much you can do to stop GPS tracing of your location without your consent. Of course you could power down your phone, but we are all way too additcted to these handy little digital Swiss Army Knives to do that. You can turn of GPS services, but again, that makes it impossible to use maps and other location-based apps.

The actual answer here is for the public to put enough pressure on Apple and Google that they stop the practice of tracking our location-based data and no longer collect, store or transmit it in any way without our consent.

While this may be the future of privacy, it is better that we are aware of what may come rather than remain in the dark about the possibilities of technology.

John Sileo is the President of The Sileo Group and the award winning author of four books, including his latest workbook, The Smartphone Survival Guide. He speaks around the world on identity theft, online reputation and influence. His clients include the Department of Defense, Pfizer and Homeland Security. Learn more at www.ThinkLikeASpy.com.