Microsoft has revealed that it is to move away from relying solely on static passwords in the next version of Windows, codenamed Longhorn.
Instead, the new version of the operating system, due to be launched sometime in 2006, will use two-factor authentication as standard. The company has not made clear which form of two-factor authentication will be used, but it is known to be improving support for smartcards, token-based technologies, and possibly advanced biometrics.
The “death of passwords” revelation came during a CeBit session attended by Microsoft’s Detlef Eckert, who heads the company’s Trustworthy Computing Initiative.
"I believe that the time of password-only authentication is gone. We need to go to two-factor authentication. This is the only way to bring the level of trust business needs," the VNUnet news site quoted him as saying.
Microsoft already supports Extensible Authentication Protocol (EAP) in its Internet Authentication Service running in RADIUS mode, but it now looks as if it has opted to embed two-factor technology more deeply in the core OS.
That it is looking to enhance the security of Longhorn is not surprising given that the OS has been in the works for some years, and is running at least a year behind its original release schedule. Because passwords have long been seen as a critical weakness, Longhorn was always likely to see this design overhauled. However, the detail of how the company plans to introduce further authentication remains critical but unresolved.
Perhaps not coincidentally, oft-quoted security expert Bruce Scheier has taken a pop at the idea that two-factor authentication of the general design Microsoft is proposing will be enough to meet current security challenges.
“Two-factor authentication isn't our savior. It won't defend against phishing. It's not going to prevent identity theft. It's not going to secure online accounts from fraudulent transactions. It solves the security problems we had ten years ago, not the security problems we have today,” he announces rather pessimistically in his latest weblog.
“Early adopters of this technology may very well experience a significant drop in fraud for a while as attackers move to easier targets, but in the end there will be a negligible drop in the amount of fraud and identity theft,” he writes.
When Techworld followed up the story after publication, a Microsoft spokesperson issued the following qualification to Eckert's off-the-cuff comments.
"Detleft’s comments are being taken slightly out of context. Detlef was sharing his opinion that solely relying on passwords for security is becoming a thing of the past. He did not say nor did he mean that passwords are no longer needed and that Microsoft was abandoning passwords.
The point Detlef was making is that a two-factor authentication solution is needed to improve security. Two-factor authentication means requiring not only a password but also another form of authentication, such as a smartcard, or biometrics like voice ID or a fingerprint scan to access your computer.
This two-factor capability is already supported in Windows XP and will only get better in Longhorn, however it is too early to say what form these improvements will take. We look forward to sharing more information as we get closer to beta in the first half of 2005."
None of this contradicts the original assumption of the story - that Microsoft is at some point going to abandon the use of passwords as the sole means of authenticating a user. It is, however, possible that Longhorn will be released in several versions, including one with two-factor authentication, and other versions with conventional password-only log-ons.