White House to public: 'Lock down your login!'

The Obama administration and a bevy of non-profits and technology and financial services companies joined forces Wednesday in a publicity campaign to get Americans to stop relying on passwords and use stronger methods of online identity authentication.

The Obama administration and a bevy of nonprofit organizations, technology firms and financial services companies joined forces Wednesday in a public campaign to get Americans to stop relying on passwords and use stronger methods of identity authentication.

“Your usernames and passwords are not enough to keep your accounts secure,” states the campaign website, which went live Wednesday in the run-up to the 13th annual National Cybersecurity Awareness Month.

“Luckily,” the website continues, “there’s a simple and quick way to put you in control of your personal information and keep your key accounts like email, banking and social media safer — it’s called strong authentication.”

Strong authentication, also called multi-factor or second-factor authentication, has long been advocated by security experts as an alternative or addition to passwords.

Unfortunately, as the campaign factsheet notes, 72 percent of Americans believe their online accounts are secure with just a password and login — something that repeated breaches of password data, like the one revealed last week by Yahoo, have shown to be untrue.

Under the slogan “Lock down your login” the campaign advocates one or more of three authentication technologies that can make online accounts more secure:

• A security key — like a USB keystick

• Biometrics — like an iris scan or facial recognition from the webcam on your laptop or smartphone; or a fingerprint from a special built-in sensor

• A one-time password or code — sent to your phone by SMS or app

“The bottom line is, passwords can’t be secure,” said Brett McDowell, executive director of the nonprofit FIDO Alliance, which advocates for strong online authentication. “It’s long past time that we replaced them with something that’s not vulnerable to phishing, social engineering or replay attacks.”

Phishing or social engineering involves tricking a user into giving up their password. Replay attacks rely on the fact that most users also ignore advice not to use the same password for multiple sites or accounts. That means if a hacker has the password for a user’s email account, they can try it on social media or even financial accounts, too.

The FIDO Alliance is one of the organizations backing the new campaign, which is led by the National Cyber Security Alliance — organizer of National Cybersecurity Awareness Month.

Other partners include Bank of America, CompTIA, the Consumer Federation of America, ESET North America, Facebook, the Financial Services Roundtable, Google, Intel Corp., Mastercard, Microsoft, Mozilla, PayPal, Salesforce, Square, Symantec, Twitter Inc., Visa Inc., Wells Fargo & Company, and USAA.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure