Cybersecurity is an ongoing problem, with critical flaws and weaknesses ranging from ongoing research into how best to break fundamental aspects of CPU architectures to users perennial terrible choice of passwords. All in all, it’s not a cheerful situation, and new data from Google doesn’t exactly improve things.
In a presentation at Usenix’s Enigma 2018 security conference, Google engineer Grzegorz Milka revealed that less than 10 percent of Gmail users have two-factor authentication enabled and just 12 percent have a password manager installed on their browsers. Given the high-profile security failures of password managers, including LastPass, I can’t exactly blame people for not using them — it’s not as if they’ve got great reputations — but using password managers is one way to create strong passwords that have less chance of being cracked.
The Register notes that this actually squares up with what the majority of its readers thought, with 82 percent correctly picking the 10 percent or less figure. Milka’s response as to why Google didn’t require two-factor authentication is telling.
“The answer is usability,” Milka told The Reg. “It’s about how many people would we drive out if we force them to use additional security.”
This response echoes Marissa Mayer’s reasoning for why two-factor security authentication or additional security measures weren’t deployed at Yahoo, and we saw how well that turned out. It became the largest known hack in history, as far as how many accounts were compromised.
It’s genuinely tempting to write something along the lines of “It’s hard to blame Google.” Customers don’t generally care about security until they’re the ones being breached. Making two-factor authentication mandatory could result in some users moving to other platforms. But in the wake of Yahoo’s breach, I can’t make that argument.
First, it’d be hypocritical to slam Yahoo’s failure to protect its users, then champion Google’s refusal to do the same thing. But second, humans are terrible at evaluating risks and often take chances they shouldn’t. They also routinely undervalue data. Extra hard drives are dirt cheap and easily purchased. Backup software solutions are highly advanced and easy to use. And yet, most people don’t make regular backups of their own data. They certainly don’t take adequate steps to protect their own online information.
Google should enable two-factor authentication by default, with an option to disable it should people not want it. It’s the right thing to do for people who don’t otherwise understand why the feature is so important. But given that the company is unlikely to do so, we strongly recommend you take the step yourself.
IBM’s AI-Enabled Smartphone Scanner Can Detect Counterfeit Goods
An experienced wine connoisseur can probably tell at a glance if that $1,000 bottle is the genuine article, but most of us cannot. A properly trained machine learning algorithm might be able to help with that.
Nvidia GPUs Take a Heavy Hit With HDR Enabled
HDR support is finally starting to roll out to PC titles, but AMD and Nvidia handle the workload quite differently.
Indie ISP Offering Tor-Enabled SIM Cards
One grassroots UK ISP has started offering a Tor-infused mobile product to make privacy simpler. The Brass Horn Onion3G is a SIM card that automatically routes all your mobile data through the Tor network — no setup required.