In a YouTube interview, host Maria talks with identity‑theft expert and McAfee consultant Robert Siciliano about the White House cyber‑security adviser’s proposal to replace traditional passwords with biometric methods such as selfie‑based facial recognition and fingerprint scanners. Siciliano explains why passwords are vulnerable—citing dictionary attacks, password resets, and high‑profile breaches at Target and JPMorgan Chase—and argues that biometrics could mitigate many of these risks if implemented securely. He notes that while technologies like Apple’s fingerprint‑based ID are promising, widespread, user‑friendly biometric authentication is likely a decade away, and attackers will inevitably try to subvert any new system. The conversation ends with practical advice for viewers: use complex, unique passwords, employ password managers, encrypt backups, and consider two‑factor authentication while the industry works toward more robust authentication methods.
Chapters
Data breaches, cyber terrorists, our online world is at risk, as you know, 24/7, and the only protection we really have is how creative we are with our passwords. But that could change. The president's cyber czar is saying that it's about time we get rid of passwords and maybe, maybe replace them with selfies. Let's talk about this. Joining me now from our Beacon Hills studio is Robert Siciliano, identity theft expert and McAfee consultant. All right, what do you think? Are we gonna selfie to identify ourselves now? What do you think of this?
Yeah, I could see it now. We'll have every 12 to 22-year-old taking fishy face selfies as passwords. That'll work.
You know, and you know that's what they're gonna do. You know that people are gonna just have fun with it. So you're not on board with this?
Well, you know, it's not necessarily a bad idea. Companies like Facebook and others are already cataloging a significant amount of documentation, pictures, that they're using some facial recognition technology built right in that along with a number of different other other technologies could in fact properly identify us.
So do we get rid of all our passwords and then do something else? I mean, what's the point? What were they trying to do here? Obviously to protect our safety, correct?
Yeah, so the password as we know it has been hacked, cracked, and decimated. Basically anybody needs your username, which often is either your name or an email address or some funny code, and then a password itself that could easily be cracked as a result of a password reset. People can guess it, and there's also something called a dictionary attack, attack where the bad guys basically go to the dictionary with certain software to recognize passwords. So additional passwords, as far as like biometrics are concerned, you know, facial recognition, iris recognition, fingerprinting, and even photos linked to some type of cryptology could solve the password problem.
So, but, but if— so we, we say they do this selfie thing, how long is it going to take someone to figure out how to hack into that? Because you know that's going to happen, that's next.
Yeah, there's no such thing as 100% security. So let's just say they do launch a, uh, a selfie as a form of password, more than likely behind that application will be a number of security— all kinds of security that would prevent that selfie from being hacked. That being said, the bad guys will try to find a way to work around it. My guess is if a selfie is launched as a form of password, we will probably be good until the bad guys figure out how to crack it.
Another idea that's being floated around by this cyber czar is putting fingerprint scanners for everything. Any major red flags there?
Well, you know, the Apple ID, the password that's built into the biometric for the Apple iPhone, I think is a really good step. It's a step in the right direction. There's a lot of technology behind that that could go a long way in other devices like laptops, even at an ATM machine. And if that becomes ubiquitous, if we actually use the fingerprint as a password, and again, it is secured properly, that actually could solve a lot of password problems.
So you like that one?
Well, I do, because the password itself As it is right now, really is insecure. I mean, look at all the data breaches that we're seeing right now. A lot of them are as a result of a simple username and password being breached.
So how long, if this ever, all of this ever happened, how long would it take to implement all of this? I mean, are we talking years?
You know, before we actually come up with a secure form of password that is user-friendly, uh, beyond something called two-factor authentication, we're looking at probably a decade. Oh yeah.
Well, I guess I got that wrong then, that's for sure. So, so what do you What do you think about all of this? I mean, do you think that this is gonna fly?
It has to, Maria. We are at a point right now where we've got Target with 56 million and JPMorgan Chase with 83 million.
Right, you're absolutely right.
Yeah, it's a nightmare. So we have to upgrade our password technologies without a doubt.
So while I have you here, we might as well give some great advice to the people out there watching. So what's the best thing you can do in terms of passwords?
Well, certainly uppercase, lowercase, you know, numbers and characters, all different passwords on all of your different accounts. Use a password manager, basically software you download onto your device that manages all your passwords. Have backups encrypted in an Excel file. Store them in the cloud, also encrypted. Make sure that you use a different password for every account. That's one of the most important things.
I know, you say that to me every single time, and then I always say, "Oh, as soon as I get off the set, I'm doing it." Do it! I never do it. I am too busy. I forget. I know, it's, it's worth it. It's worth it. Well, thank you so much. We always appreciate talking with you and great advice.
Thank you, Maria.
Thanks. Good to see you. Nice to see you. So our feedback question: what do you think is the best way to keep your identity safe? Is it facial recognition, fingerprints, or just keep your passwords around? Tell us what you think. Vote on our poll, myfoxboston.com, and we'll have those results ahead at 10. All right.
