The World Must Go Passwordless to End ‘the Morass of Data Breaches’ – An Exclusive Interview with StrongKey CTO Arshad Noor

This text discusses several challenges related to passwordless authentication and the implementation of new technologies like blockchain. The author, Arshad Noor, highlights corporate and government inertia as a major barrier to adopting new authentication methods and technologies. He also mentions the missed opportunity with X.509 digital certificates and the current focus on user experience over security.

In an engaging conversation for GoCrypto’s interview series, Mike Ermolaev sat down with Arshad Noor, the brilliant CTO of StrongKey. With a remarkable 34-year tenure in Information Technology under his belt, Arshad has dedicated the past two decades to tackling data protection challenges using advanced cryptography. His innovative work has significantly bolstered defenses in various industries, including banking, defense, telecommunications, pharmaceuticals, biotechnology, and e-commerce. These sectors, known for their heightened need for robust authentication and encryption, have greatly benefited from his expertise. Notably, Noor is the author of the first open-source symmetric key-management system and has made significant contributions to numerous security standards.

At the interview, Noor offered valuable perspectives on the development of unified global digital identity systems, underscoring the importance of such a system in our progressively digital world and recognizing that approved international security measures are essential for safeguarding our lives online. Additionally, he advocated for society tokenization and endorsed the notion of a retail US Central Bank Digital Currency (CBDC), which has been a topic of much interest from him recently. This interview is part of the ongoing series brought to you by GoMining, showcasing insights from prominent figures in the realms of cryptocurrency and data security.

Noor’s Pioneering Contributions to Digital Identity and Data Protection

Noor is known for his inventions such as StrongKey Sign-On (SKSO), a user authentication system for the web that doesn’t require third-party Single Sign-On services, and StrongKey FIDO Server (SKFS), an open-source, FIDO Certified platform for managing FIDO credentials in businesses. Additionally, there is PKI2FIDO, a web application that simplifies and strengthens authentication processes for corporations and public institutions. Before joining StrongKey, Noor gained a strong reputation as an IT solutions architect and global Public Key Infrastructure (PKI) builder while working with companies like Sun Microsystems, Citibank, and BASF Corporation. His extensive background and expertise make him a trusted expert in data security and digital identity, providing valuable perspectives on the future of these technologies.

Global Digital Identity Standards Need Harmonization

Noor described the potential framework of a worldwide identity system, highlighting the importance of various identity networks catering to distinct requirements.

It’s clear that numerous identity ecosystems will emerge to cater to diverse requirements. Presently, standards have been established to facilitate the secure sharing of identity attributes, complete with verification, ensuring their reliability and acceptance across borders – think of passports as an illustration.

He highlighted the need for a strong, internationally accepted system for businesses to use digital identity traits.

When a reliable base and structure have been set up, various ecosystems can create schemas to facilitate cross-border utilization.

Arshad Noor added.

In addition, Noor acknowledged the advantages and difficulties that come with implementing a worldwide digital identity system. He emphasized the prospects of expanded international electronic commerce and intensified competition in this context.

“Global identity-sharing frameworks bring about a significant advantage, facilitating the expansion of cross-border e-commerce. Although it may lead to intensified competition among products and services, the benefits extend to all parties, except for those who struggle with competition.”

He underscoreed the importance of aligning security and privacy regulations for a strong system, similar to the unified approach in international commerce.

As a researcher studying global data security and privacy frameworks, I firmly believe that a minimum requirement for participation is a universally accepted baseline of security and privacy controls. The absence of equivalent regulations in various regions, such as GDPR in the EU versus no comparable regulation in the US, hampers effective harmony in this area. To ensure a level playing field, data security and privacy rules need to be harmonized on a global scale, similar to how international trade required the establishment of consistent rules governing commerce and logistics. This process necessitates equal representation from every nation within the decision-making body to guarantee long-term success. Although it will undoubtedly be a time-consuming and complex endeavor, with dedication and cooperation, we can make it work.

Challenges in Passwordless Authentication

As a researcher delving into the topic of passwordless authentication, I’ve come across numerous obstacles that merit attention. These challenges can be broadly categorized into several critical areas: corporate and government resistance to change, the intricacy of system integration, biases in group decision-making, the financial strain caused by past investments in failed technological initiatives, and a missed opportunity with X.509 digital certificates.

Corporate and Government Inertia

As a crypto investor, I’ve noticed that passwordless authentication, which is crucial for securing digital assets, encounters significant obstacles due to the inactivity of corporations and governments. They seem reluctant to adopt this advanced security measure, leaving us vulnerable to potential cyber threats.

As a researcher focused on authentication solutions for distributed systems, I’ve witnessed the development of various schemes aimed at addressing password vulnerabilities since the 1980s. However, the adoption of these new technologies by large institutions often results in an intricate web of integration that grows increasingly complex with each addition.

As an analyst, I would rephrase Noor’s explanation as follows: I’ve observed that IT has become a risky investment arena due to the high number of failed technological projects. Consequently, IT executives are sometimes compelled to back projects they may not fully comprehend, resulting in a herd mentality where everyone jumps on the bandwagon without proper evaluation.

He elaborated,

Approximately 8 out of 10 consumers in the market are likely to wait for the experiences of early adopters and solid evidence of return on investment before taking action. However, due to the intricacy of the current situation, determining such ROI can be a formidable challenge, resulting in a tendency towards inaction.

Missed Opportunities and the Second Chance with FIDO

He pondered over the past chance during the late ‘90s and early ‘00s to implement passwordless authentication using X.509 digital certificates, remarking,

“Industry killed that ‘goose that laid the golden eggs’ by over-pricing and under-delivering PKI.”

As a researcher following Noor’s work, I’ve come across an intriguing perspective. According to him, there exists an opportunity for further progress with FIDO protocols. However, he raises concerns that some major tech companies might be overemphasizing user experience (UX) at the expense of educating consumers about security necessities and behavior adaptation. He put it simply, “We need to strike a balance between convenience and security.”

As a researcher studying the latest developments in cybersecurity, I’m excited about the potential of FIDO to provide a second opportunity for enhancing global security. However, my concern is growing as some major tech companies persist in prioritizing user experience (UX) over educating consumers about the importance of security. Unfortunately, this misplaced focus could lead to consumers remaining unaware of the need for behavior adaptation, thereby undermining the benefits that FIDO and similar technologies have to offer.

Transitioning to Passwordless Authentication is Essential, but Implementation Details Matter

Discussing the future of PKI and passwordless authentication, Noor said,

PKI (Public Key Infrastructure), FIDO (Fast Identity Online), and passwordless authentication can be described as different methods or approaches to achieving the same fundamental goal – secure authentication. They are comparable to various designs or styles of shirts, all made from the same high-quality fabric or security principles.

As a researcher in this field, I can assure you that the advancement of public-key cryptography marked a significant shift from previous methods. To put it another way, there is currently no equivalent solution that can match its capabilities and benefits.

To move past the overwhelming number of data breaches we’re experiencing today, it’s essential to adopt passwordless authentication as a solution. Yet, the specifics of implementation are crucial. While a firearm can effectively protect us from intruders, it also carries the risk of self-inflicted harm when mishandled.

Rational Evaluation Needed for Blockchain vs. Traditional Technologies

As Noor noted, although blockchain technology can theoretically support business processes, functionalities like decentralized databases and digitally authenticated transactions can accomplish the same goal in a natural and easy-to-understand way.

“Almost anything that can be implemented with blockchain was possible to be implemented with traditional databases leveraging public-key cryptography in the late ‘90s – the market could not adopt such capability because of recessions following the “dot com” and real-estate related mortgage-backed securities meltdowns,”

he explained.

During the early 2010s, blockchain technology piqued the interest of many professionals in the tech sector. Although it’s technically feasible to establish business processes that involve multiple companies using blockchain, such processes can also be achieved with distributed databases and digitally authenticated transactions.

Noor added.

From my perspective as an analyst, it appears that the excitement and investment frenzy surrounding Bitcoin have cast a large shadow over the more pragmatic and technical aspects of blockchain technology. Consequently, there has been a rush to adopt this technology without due consideration of its real-world value and effective implementation.

He stated,

After the fever passes, affordable and profitable blockchain solutions will surface to address certain issues.

In the context of exploring potential solutions for data protection and identity management using advanced technologies, Noor highlighted the significance of addressing complex business processes that involve numerous parties. He advocated for the application of distributed systems and public-key cryptography as effective tools to tackle these challenges.

He concluded,

As a researcher examining this issue, I would advise considering whether to employ blockchain or conventional technology is a crucial decision that necessitates careful analysis, just like any other financial investment for a corporation.

The Fed Should Automate Interest Rates for a Smoother Economic Ride

As a financial market analyst, I share Arshad Noor’s perspective that the rollout of a retail US Central Bank Digital Currency (CBDC) could bring about greater efficiency in financial markets. This transformation would ultimately redound to the benefit of consumers around the world. However, it is essential to recognize that this process may not be without its challenges and complexities. Arshad acknowledged these realities but remained optimistic about the potential positive impact on a global scale.

In the initial phase, there may be some inconveniences or challenges in the rollout of the system. However, once these issues are addressed and resolved, the system is expected to run smoothly and efficiently, providing value to the consumers.

Noor anticipated that the Federal Reserve might change its approach to setting interest rates in the future. Proposing a solution, he advocated for a clear and consistent method of calculating inflation regularly.

He stated,

“I envision the Federal Reserve choosing to defocus on their current process for establishing interest rates, and simply paying 2% over whatever the current rate of inflation may be on any given day. The efficiency gained from this strategy will be similar to automobiles going from manual to automatic transmission. Savers will always be rewarded with a reasonable rate of return, while spenders will bear what they must for their profligacy. Knowing that individual buying decisions no longer need be dependent on a small group of central bankers meeting a few times a year, it will allow the economy to achieve a “smoother ride” as rates shift automatically corresponding to inflation rates prevalent in the market.”

Noor left comprehensive remarks about cybersecurity issues related to a Central Bank Digital Currency (CBDC) at the Federal Reserve, which can be accessed on their website. In his own words, “I raised concerns over cybersecurity matters regarding a CBDC with the Federal Reserve.”

Retail central bank digital currency (CBDC) exchanges will be transparent, ensured by encryption and pseudonymization methods within a new regulatory framework. This framework will enable authorized entities to decrypt these transactions while maintaining the privacy of law-abiding citizens’ personal transactions through advanced technology and regulations.

However, he warned that nefarious activities are unlikely to disappear from the internet:

As a crypto investor, I’ve noticed that there’s an innate human tendency to seek out opportunities for arbitrage in economic conditions and outcomes. However, the cost of preserving individual privacy is a question that society must grapple with. In other words, how much value do we place on protecting our personal information in a world where technology allows for increasingly intrusive data collection? It’s a complex issue that requires careful consideration and dialogue.

I found in my research that safeguarding confidential data was a comparatively affordable task during the pre-computer and pre-internet era. All it took were modest expenses for locks and keys, along with uncomplicated processes. However, my findings suggest a marked increase in cost in today’s digital age. I underscored this point during my research.

Open-source technologies have the power to greatly decrease expenses. However, setting up, managing, and ensuring the privacy regulations, along with the essential security measures, will demand a considerable long-term investment.

2024-07-10 22:43