Strategic Autonomy

One of the nefarious aspects of Multi-Factor Authentication that I have not mentioned in my previous post on the subject is the risk of loosing Digital Sovereignty.

Authentication via a login and a password is well understood and is usually implemented within existing software. On the other hand, Multi-Factor authentication is often implemented via US-based third parties: Google, Facebook, Github, Linkedin, etc.

Countries can not implement Multi-Factor Authentication for their citizens themselves either. Case is point is Belgium, with the national service that provides authentication services relying on the US-based COTS software for most of its functionality.

There's a simple way to enforce Digital Sovereignty. Digital Services should be legally coerced to enable user login via a single string, akin to an API key already used by many services.

We all know that login/password combos are flawed, as users tend to choose weak passwords. For a lay person, the combination of a unique login and a weak password is enough to differentiate them from all other users. They do not know about rainbow tables nor multi-site attacks.

That same lay person presented with the need to have a single string as authentication key will ponder seriously on its length and randomness.

That string will not be called password but something else, be it passkey or key or passphrase. With a whole new world of assumptions and software helpers to generate them and securely store in key managers.

A few weeks ago I received an unsolicited email from the Belgian Center for Cyber Security. It starts with the statement that 80% of cyber attacks could be avoided if 2FA was active and then says literally that If you only use a username and password for your remote logins, you're a sitting duck.

This is not true, username and password are no less secure than 2FA. In a way, they are more secure. I know this is controversial, but please bear with me, and I will explain CCB assumptions, my assumptions, and how it all makes sense.

CCB assumes that people can not be trusted with passwords. Over the years, the most popular passwords have been 123456 and password, closely followed by 12345678 and qwerty. Research has proven time and again that we use weak passwords whenever possible.

But hold on. These same people behave reasonably and optimally. Whenever they start using a new website or app, its value is close to zero, so it it an optimal strategy to use a weak password. More often than not, the interaction is unique or spaced in time so much that it makes no sense to save the password at all. When I visit a website I have not visited for years, my old password usually does not work anymore, and I have to reset it.

I have a workflow for auto-generating passwords and storing them in a password manager, but it is totally reasonable to expect other strategies for occasional users: