User-friendly security
Living in a digital world, people, or ‘users’, are faced with a multitude of portals asking for our passwords. Inspired by his parents’ confusion in the face of complicated password protocols and contradictory advice, and the challenge of remembering them all, digital security expert and future thinker Dr Frank Stajano, at University of Cambridge, has created the concept of Pico.

Pico is a new approach to user-authentication based on having something rather than knowing something. Named after a fifteenth century Italian philosopher, famous for his memory, Pico will remember your authentication credentials, meaning you don’t have to remember a single thing.

Unique visual protocol
The Pico concept starts with a small handheld gadget like a key fob or phone. Its main components will be a camera and a radio that can communicate with your computer. Instead of entering a user id and password, the Pico will be pointed at a visual code on the screen – this would trigger a cryptographic protocol specific to the Pico’s owner and hey presto, the user is authenticated. Stajano gives the example of accessing your Gmail account. ‘Normally you are asked for a user name and password, in future it could present a visual code. You would point your Pico at it and it would call the Pico to send an authenticator to Gmail.’

Stajano has had a safeguard against theft of the Pico. Well aware that criminals can hack pin numbers and determined that with Pico you will never have to remember any secrets, Stajano proposes that Pico will unlock by sensing other gadgets you wear. Using short-range radio signals the Pico will be able to recognise that it’s in the presence of its true owner.

Beyond passwords
The biggest challenge Stajano faces in developing a security system that isn’t compatible with passwords, is that passwords are so entrenched. They are cheap to deploy and everyone is familiar with that approach.

Stajano has invented a more secure, user-friendly system than passwords.  He is putting together a team to work on building Pico. ‘There is no better way,’ he says, ‘than to see non-computer specialists using it and finding it better than passwords.’ He aims to show that Pico, or something even better, could consign passwords to history.