This is a download from BFM 89.9, the Business Station. BFM 89.9, the Business Station. My name is Rich Bradbury and this is Matt Splain. 1, 0, 0, 0, no?
We're not doing today's Matt Splain in binary. It's taken weeks to talk my dad about that idea. We're actually talking about passwords, their pitfalls and some of the new technologies that might replace them in the next few years. Hi Matt.
Hey Richard, I still think the binary idea is an absolute winner. I mean, 0, 1, 0, 1, 0, 0, 011, 011, 011, 011, 011, 011, 011, 011, 011, 011, 011, 011, 011, 011, 011, 011, 011, 011, 010, that's how you say hello and binary. I don't get why that's so hard to understand. And I don't understand why somebody wouldn't want half an hour of ones and zeros as they go into the weekend.
Really? Yeah. No. Okay, so password problems, it is.
I'm going to ask you a question. Yeah. How many passwords do you think that you have dotted around the internet. Since I first started using the internet.
Or just what do you think you currently have? I dread to think it's got to be at least a couple hundred at least. Well, yeah, exactly. I mean, I did a little bit of a count up for this show and it turned out I've got somewhere between four and five hundred.
Now, admittedly, yeah, no, a lot of them are apps and services that I've registered with to try them out just once and I've deleted the account, but you're the password and the login is still there. It's a lot more than I imagined. I thought it was something similar to you, maybe 115, maybe 200. But I'm guessing that we're not actually, it's not actually that unusual, but most of us have a few hundred logins and passwords trailing us in the wake of our digital voyage.
And do you know what they all have in common? In my case, anyway. Are you about to give away the secret to your password recipe on live radio? Well, sort of.
The thing that they all have in common is that I don't know what any of them are. I don't even know how many characters in any of them it might be 30 and it might be 33. Depending on how you look at it, those may be good or bad things. It's not that I'm some encryption expert.
It's simply that in the course of doing these shows and talking to people like cybersecurity experts, it was clear pretty early on that it simply wasn't safe, not just to recycle passwords, but even to create them myself. All right. Let's deal with the recycling of passwords issue first. Well, we all hear about data breaches where logins and passwords are stolen.
We've all had those emails from a company and we've had to go back into their systems to update our information change to those passwords. What we forget though is that if Yahoo or some other company tells us to change our password, they're telling us essentially to protect our account with them. Of course, that's going to be their focus and that's where their responsibility, certainly legally, kind of begins and ends. They're not really interested whether you use that password on another service.
But there may be other people who are? Well, yes, because those stolen data logs usually end up being traded on places like the Dark Web. So the sellers might divide them up into parcels, for example, they might sell you a package of say, 10,000 stolen logins and passwords. Now, the hackers and the people who buy those parcels of data know that you've probably changed your Yahoo password, but they also know that a lot of us reuse our passwords.
In fact, a Google poll in 2010, I think it was 2019, found that over 50% of people reuse at least some of their passwords across multiple services. So those hackers take the logins and they see if you're using the same email, username and password combinations on other sites. So they'll try it on Google, Facebook, Instagram. They might even try it with a bank.
That would assume then that the hackers have more knowledge about you than just those passwords. Well, it might look that way, but not necessarily, especially when we have so many large technologies. So like I said, it's probably a fair bet that most people will have a Facebook, a Twitter or an Instagram account, at least one out of that three, if not all three. But let's go back to that bank.
And of course, this will be different as you move from country to country. But in the case of Malaysia, how much of a stretch would it be for hackers to think that someone on that list might have a Maybank, a public bank or a CIMB account? Obviously those banks have systems that are probably a lot more secure than those bootstraps startups that you've registered with and had your data stolen from. For example, that three or five or 10 strikes and you're out with the password attempts to or even three factor authentication.
When my mum occasionally had problems with some of her software back in the UK, I used to be able to use her passwords and login to go and rectify and set things up for her. But now a lot of the bigger tech companies instantly recognise that I'm trying to access her accounts from an unusual location. So even though I'm part of her two step verifications, I can't access some of those accounts for her anymore, which is really good from a security standpoint, but it's less good for resolving any problems that she might have. So it comes back to the intent of the hacker?
Well, yes, for the most part, they might be trying to see if they can get into say your Spotify account and then sell that information on for a few dollars. But sometimes they'll try and impersonate you, especially on social media, either to get the person they're impersonating friends to transfer money to them. You know, we've all seen those scams. Oh, I'm in Bali and I've been robbed.
I need you to wire me $100 so I can get a card to the embassy and get new travel documents, you know, things of that nature. But sometimes it's more specifically for ID theft. So they'll be posing as the person and asking people for personal details, things like your phone numbers or your address, the kind of information that might help them to reset passwords and take over accounts that will give them access to bank details and other important or financial information. Is it as simple as making sure that your passwords are different for every single login they use?
Well, this comes back to some of the points we've made about artificial intelligence in the past. Predictive algorithms, for example, the ones that decide what TV shows or video clips we want to watch are based not just on what we've consumed before, but what people with similar taste profiles to us have enjoyed. So on the last show, we talked about the New Zealand Tourism Social Media Campaign to stop people trekking to the same Instagram promoted photo opportunities as each other. The reason we need campaigns like that is because we're not as individual and unpredictable as we like to think.
And that same behaviour comes out when we choose passwords as well. We choose passwords that relate to our lives, things like our kids' names, birth dates, anniversaries, pet's names, you know, favourite sports teams. In other words, exactly the kind of information that you might post to something like your Facebook page. So in other words, the longer and more random your password is, the better, right?
Yes, hacking software can use brute force attacks to crack most common words up to eight letters long in just a few minutes, which is why so many sites now require you to use symbols, numbers and upper and lower case letters in random configurations. And a lot of us get very lazy about changing or updating these passwords from time to time. But the more passwords we have, the harder it is to manage them. Yeah, so keeping all those passwords updated is pretty much a full-time job, even if you're using one of those password managers that keeps them all for you, the controls them all for you.
And there are a lot of third-party services out there, but typically our operating systems will have their own password managers. I think there's Keychain on Mac, Google Password Manager, Authenticator on Windows, and most of those apps can also generate random passwords for you, often with variable numbers of characters. Now, some of these apps work across platforms and some don't. I use a third-party password manager that operates across platform.
But even then, you have to make sure that your passwords for those apps are well thought out and secure in case someone is able to take control of your computer or your device and actually then access all of your passwords by accessing your password manager. Is there any that you'd recommend? Well, I don't think I'd recommend a specific one. I'd say, you know, see if the free one on your operating system or browser works for you first, then do a bit of research, see what fits your needs in terms of features, encryption, things like where the files, the information is stored, then have a look at the payment options.
Is it charging your one-off fee? Is there a monthly fee or is it a free service? I think a lot of people would want to know then, you know, are the free ones actually safe? Well, again, that's one of the reasons I'm not making any recommendations.
There's a lot of, it's not necessarily scam or malware, but bloatware, especially when it comes to freeware. And be careful with anything that's storing your passwords in the cloud because that's going to increase your exposure. Local storage is always going to be best. Some of the third-party managers allow you to store an encrypted file vault on your G-Drive or Dropbox or whatever you're using, allowing you to access them remotely and to sync across multiple devices.
So figure out what works best for you and what kind of user you're going to be. It feels like a little bit like we're in 2011, do we talk about passwords and managers, Matt? Well, that's kind of the point of the show today. You know, you can't really talk about passwords without going over this part of it.
You know, you have to talk about the precautions that people need to take. Take what I was saying about people choosing passwords related to their lives. Now, you and I interview a lot of people, and part of that process is chatting and putting people at their ease and asking them questions about themselves. I'm not so sure anyone is ever at ease when they're around you, though.
And that makes it even easier for me to extract information from them because nature abhors my vacuum. So people would rather babble than sit silently within my sphere of malignant. But somebody skilled at talking to people like the Darren Browns of this world can extract information that could potentially be used to steal someone's identity. And I think he's done shows on that very subject.
So yes, passwords do seem very internet 1.0 in that sense. And they seem like a holdover from a time when the internet was much simpler. But after the break, we'll talk about some of the new technologies that are coming into replace that one, two, three, four, five, six, seven, eight, nine that you're using. And to any of our listeners, if that genuinely is your password for anything, I suggest you change it while you listen to these messages.
Absolutely. When we come back, what happens when technology fails your password? You're tuned in to Matt Slain here on BFM, 89.9, the Business Station. Beating Fickle Mindsets, BFM, 89.9, the Business Station.
BFM 89.9, the Business Station. My name is Rich Bradbury. You're tuned into Matt Slain. We're talking about passwords.
We're looking at password tech on Matt Slain this week. And with a bit of luck, listeners have either changed their passwords, or join the break, or put the podcast on hold whilst they updated. But you teased us, just call the break, with a password fail. Yes, a really fascinating article on the Guardian website called The Tyranny of Passwords by Cireon Cale.
So she references a story that some of you may have read a few weeks ago about a German-born programmer, Gold Steffent Thomas. And that links to all the GameStop outsider share trading activity that we've seen over the last couple of months. And that, in turn, has also seen the price of Bitcoin explode this year on its wild ride into the scariest parts of the investor ecosystem. Now, Thomas was paid in Bitcoin for a video about cryptocurrency that he produced a decade ago.
Now, those 7,000-odd Bitcoins that he was paid are now worth, or at least were worth when this story broke in January, around $240 million US dollars. Now, they've since increased in value by almost $100 million, so they're getting up towards the $350 million mark. But they're no more used to Thomas than the ones and zeros that I start to this show off with. He forgot the password.
He forgot the password to the Bitcoin wallet. So he had two copies of the password on two old hard drives, but technology has moved on and he can't access the drives anymore, the systems for those drives and how obsolete. He had one more copy on an iron key, which is an encrypted thumb drive. And that's the one he's lost the password for.
So after 10 incorrect password attempts, the device essentially destroys or completely encrypts the data on its scrambles it. So far, he's tried eight of his most commonly used passwords. Most commonly used passwords. There you go.
See, the first half of the show wasn't such a waste of time, after all. Even though Thomas is a programmer, it's obvious that he's not following password-based practices, or at least he wasn't back in the day. How do you survive losing what's edging towards half a billion dollars? Well, the reports suggest that Thomas is more sanguine than suicidal, so that's definitely a good thing.
The last time I lost $100 million, I was livid for, I don't know, at least 10 minutes. Then I found it again, it was under theang pals, you know, I'm so forgetful with money. But I don't think Thomas has given up hope. And he's had various offers from crypto crackers to help him recover the information on the drive for a share of the proceeds.
But with all of those hundreds of logins and passwords out there, this is something that pretty much all of us could face at some point, although probably not for sums of money in the hundreds of millions of dollars. So for example, if I forgot the password for my password keeper, what would happen? You know, these services are specifically designed so that someone can't remotely reset it for you. They're designed to be proved against external access.
So the thing that protects my passwords from hackers has no effective protection from me. Wasn't there another case of millions of Bitcoin being lost as well? Well, the Guardian quotes an estimate from cryptocurrency data firm Chainalysis that around 20% of the current supply of Bitcoin is either lost or its owners are locked out of their access to that currency. Now that's approximately 3.5 million bitcoins that are worth close to 50,000 apiece.
Now I did work that out on my calculator, but that was more zeros than I actually know the numbers for. It's a lot. A Bitcoin miner in Wales called James House has been trying to retrieve a hard drive containing the key to his coins that was accidentally thrown out in 2013. He suspects the drive is somewhere in a landfill in Newport, but today the local council has shown no interest in helping him to locate it.
He's even up at 25% of the sale value of the coins to the council so far to no avail. And the value probably in a similar ballpark to Stephen Thomas close to $300 million that today's Bitcoin rates. So if securing your password is dangerous and not securing your password is even more dangerous, what's the solution? Well, I'd be tempted to say don't ask me if that wasn't actually the entire purpose of this show.
Obviously, we're already moving into an era where passwords can be replaced by biometrics. Now a lot of our phones and other devices have fingerprint scanners. That technology has evolved. The chips and sensors are reliable and relatively cheap.
In fact, the irony is that it may be harder to remotely get into phones protected by a fingerprint than it might be to crack the passwords for all your other services once you're inside that phone. But I don't think fingerprints is where we're heading. We're seeing that expansion of facial recognition software coupled with machine learning systems. The technology is advancing.
There was anyone who used consumer grade facial recognition to open a phone or tablet knows it can be easily thrown off by changes in your appearance or even changes to background lighting. And could somebody just hold up a selfie you posted to Instagram and hide your device that way? It was certainly possible to spoof some older facial recognition systems in that way. But most now have what's called a liveness component built in so that it's obvious it's a living breathing human that the camera is seeing.
In fact, we're actually seeing a trend away from so-called active liveness systems towards passive systems. So spoofing of some active systems, the systems they look for things like eye blinks or a twitch of your mouth, for example. Now you might have been able to spoof some of those by creating a mask of a person's likeness or even a printout with the eyes cutout and the spoof blinks through the eye holes, tricking the system into thinking that it's the real you. Obviously that wouldn't work for me because I haven't blinked since 2001.
So I want a passive system work if it isn't looking for movement. Well, this is where it gets murky. I mean, I tried to find this out. Tests have shown some of the emerging passive systems to be faster and more accurate and that they have lower rejection rates and they produce fewer false negatives.
However, the companies involved are very low to explain exactly how those systems work because we come back to our old friend, the proprietary algorithm. The gist, yeah, exactly. The gist of it seems to be that the systems are neural networks that have been trained on large databases of photos and images of real people. So they analyze what's in front of them and they identify the characteristics that represent an actual person rather than a facsimile representation of a person.
Then it produces a liveness score which determines whether you or I are more likely to be a real person or not. Are you saying I'm not a real person? Well, if the computer says no, facial recognition systems are already used widely across China, Alibaba and WeChat pay are spending hundreds of millions of dollars to install their facial recognition payment systems across the country. And the BBC reports that Chinese state media has claimed that over 750 million people will be using facial recognition payment systems in the country by 2022.
But that still raises the question of the relevance of facial recognition systems in a time when we're all wearing masks, Matt. Well, we've previously reported that companies in China as part of the country's pandemic controls have developed facial systems that are accurate even when people are wearing masks. The idea being that remote temperature sensors in public places could detect if someone had a fever and then the facial recognition software takes a picture of them and it can identify them even when they're wearing a mask. And similar systems are coming to other countries as well.
A system called PopID in the US enables you to link your bank cart to their system. So it's a gateway rather than an e-wallet or standalone payment system like some of the others. But PopID is also working on an update that will be accurate for people to allow them to pay while wearing a mask. And the company also has a hand gesture service.
You can set certain hand gestures to trigger tips of varying percentages. So for example, you can give the devil's horns to give a 20% tip. So the bigger question then is should we be using biometric systems like this from a privacy point of view? Well, sure.
These are just technology solutions. So we should be able to be in that position to at least have those conversations about how this technology is going to be used. Because there are other even more outlandish sounding systems being developed at the moment. For example, biometrics based on the unique shape of your ear.
Or even as we talked about a few months ago on our show about gate analysis, machines can learn to identify you from the way that you move. So the issue then becomes who has this information and where is that information stored? Cloud versus local. Well, yes, we're already seeing this fight back against big tech when it comes to privacy issues.
So how much data they have, how they're going to use that data. Look at companies like Alipay, Amazon, Google, Apple. And just to be clear, I'm not alleging anything nefarious here. But how much of a picture of your life do you want to give these companies?
You may already be using a voice activated device produced by these companies that listens to your home. You know, you ask it to tell you that the time will turn on the TV or control the lights. You watch movies and TV shows and play games on their entertainment platforms. You buy pretty much anything it's possible to buy, whether it's groceries or a garden shed through their apps.
And now you're asking them to be the gatekeeper of your identity. Now for some people, that's not going to be a problem for other people. It is. So I think we should get a chance to decide which direction this is going to go in.
Can you give us some examples? Well, we've already seen some of the tech companies fighting against state overreach against governments that want to access user data. Now we're seeing governments trying to control tech overreach and limit what those companies, those tech companies can do with that same data. Now, sometimes these fights are occurring in the same countries between the same companies and legislators, which is a situation that is truly bizarre.
But what's obvious is that we should be rethinking our approach to passwords and the way we secure our identities. Otherwise, I think in a few years time, we may all have unmanageable quantities of physical passwords that we can neither remember nor secure. What I'd like to see is that we get to some middle ground where we can enjoy the convenience of pain with a smile or a twitch of the earlobe if that's the way you want to do it. But with that data being held locally on our own devices through some kind of encrypted algorithmic handshake, rather than that data being held on centralized servers where it can be hacked, misused or shared with big brother and big tech.
Well, there you go. Matt, I'ma teach that wonderful ray of sunshine. If you've returned in to Matt's plane here on BFM, and of course, you can find my on Instagram, and to the at culture mat. You can also head over to culturepop.com for transcripts of these shows and information about culture and its consulting services.
You've been listening to Matt's plane here on BFM 89.9, the Business Station. Thank you for listening to this podcast. To find more great interviews, go to bfm.my or find us on iTunes, bfm 89.9, the Business Station.