Computer security: password protection could be a thing of the past

Thorsten Stremlau

Tuesday 20 December 2016

Thorsten Stremlau, Lenovo’s WW Principal IT Architect, on why having to remember a password will soon be a thing of the past.

Password protection has a problem. Lots of people still use the same password across multiple devices and platforms, meaning that if a hacker compromises one account, they can compromise them all. And hackers are more active than ever: computer security is threatened as evidenced by the recent LinkedIn and Twitter hacks. Other technologies, such as biometrics and smart cards, are more secure but they too have their weaknesses. With all our information now stored digitally, the issue of security is more important than ever. So how do we move to a more secure model?

A better way to authenticate

The answer is the FIDO Alliance. This is a group formed of some of the biggest companies in technology: Lenovo (a founding member), Google, ARM, Bank of America, Intel, Microsoft, PayPal, Qualcomm and Samsung, and the list goes on. It was set up to pioneer better security methods across all platforms and devices. And it’s ensuring that the password’s days are numbered.

It all started when Lenovo acquired a fingerprint sensor manufacturer called Validity. The chief executive of Validity had approached a number of big companies including PayPal in order to use their technology to authenticate payments. The idea was that it shouldn’t matter what device you were using, as long as it had a Validity sensor, PayPal should be able to authenticate the payment. PayPal loved it. But there was a problem.

If it did this for Validity, it would have to do it for all fingerprint sensor manufacturers. At the time, there were around 150 to 200 of them. So PayPal would spend all of its time integrating and security testing, which obviously wasn’t feasible.

Instead, Lenovo, PayPal and Validity created and led an open industry alliance to revolutionise online authentication. This is called the FIDO Alliance, which stands for Fast IDentity Online.

What came before?


For every authentication, you had to implement some sort of software solution for that particular hardware. This was specific to that authentication and couldn’t be transferred to anything else. If you had a fingerprint solution, you needed a fingerprint solution running on your server as well as a fingerprint client – and the same with a smart card and an RSA token. These weren’t compatible across platforms, so it was really hard to switch devices.

Also, it was very difficult to reuse. If I used my smart card solution in my company, I couldn’t also use it for my bank, my online payments with Amazon, or with PayPal. It was tied to my corporate environment, and that was that.

How FIDO is better



