Google Works On New Alternative To Password

Google is working on an option to replace password logins on mobile devices with a "trust score" based on multiple factors. The idea is to combine all sorts of factors that aren't secure enough on their own.

The idea is to balance the need for security with the hassle of remembering passwords by building on the concept of two-factor authentication. That's an existing philosophy that deals with the inherent weakness of using a single login factor such as a password. Two-factor authentication combines a password with another factor such as using a specific device or having access to a physical hardware 'key', such as a USB stick.

Using multiple alternatives to passwords is a difficult balancing act. Many factors are weak in security terms, so relying on one or a couple will be much less secure than the traditional password. However, having a long string of factors that must all be used could be inconvenient: if there's any technical problem or any margin of error with verifying one factor, a legitimate user could be locked out.

Trust Score '10 Times More Secure'

Google's answer is called Trust API and works by combining multiple factors to produce a score. Rather than have to meet an entire checklist, the user would have to score enough points overall to pass a threshold. Google claims combining factors in this way could be 10 times more secure than a traditional password. (Source: theguardian.com)

Many of these factors won't rely on memory as happens with a password. Instead, they will include many biometric factors from facial recognition to patterns in the way users type or swipe on a touchscreen. They may also include geographic factors such as whether the phone is in a "usual" location at a particular time.

The score could be calculated automatically. If a user failed to get the necessary number of points, the system could then ask for a password as a back-up. This could happen if, for example, the user had unexpectedly left town when they would normally be at work and thus "lost" points for location.

Sensitive Apps Require Higher Score

Google says companies using the system would be able to set the required score, the idea being that sensitive apps such as online banking would have a very high threshold, while apps that simply used a password to personalize an app (such as your favorite baseball team in a live scores app) would require only a low score.

The system will be tested this summer with "several very large financial institutions." If that goes to plan, it will be offered to all Android developers later this year. (Source: pcmag.com)

What's Your Opinion?

Is this a sensible alternative to passwords? Can you foresee any shortcomings? Would you be happy to use a "trust score" to login to apps?