WEBVTT
Kind: captions
Language: en

1
00:00:00.089 --> 00:00:03.750
In 1981, the President of the United States,
Ronald Reagan,

2
00:00:03.750 --> 00:00:06.480
was shot by a gunman in Washington DC.

3
00:00:06.480 --> 00:00:08.870
It wasn’t fatal, but it was close.

4
00:00:08.870 --> 00:00:13.110
Reagan was rushed to hospital and in the chaos,
the Biscuit went missing.

5
00:00:13.110 --> 00:00:17.430
The Biscuit was the nickname given to a small
plastic card, sealed inside an opaque case,

6
00:00:17.430 --> 00:00:21.810
that contained the secret codes that would
identify the President over the phone if he

7
00:00:21.810 --> 00:00:25.020
gave the instruction to fire a nuclear weapon.

8
00:00:25.020 --> 00:00:26.850
The card was eventually found.

9
00:00:26.850 --> 00:00:29.226
Some reports say it had been hastily stuffed
in the President’s shoe when

10
00:00:29.226 --> 00:00:31.820
the trauma team cut away his clothes.

11
00:00:31.820 --> 00:00:35.790
Others say that the FBI had seized all those
clothes, and the card, as evidence,

12
00:00:35.790 --> 00:00:38.040
and they didn’t give it back until
a couple of days later.

13
00:00:38.040 --> 00:00:42.329
It’s possible that both are true,
depending on the timing.

14
00:00:42.329 --> 00:00:47.399
Now, there are some overexcited people who will
say that for however long that card was missing,

15
00:00:47.399 --> 00:00:53.340
it would have been impossible for the United States
to launch or to reply to a nuclear exchange.

16
00:00:53.340 --> 00:00:57.710
That’s not true, the Vice President
had a backup, but in 1981,

17
00:00:57.710 --> 00:00:59.260
in the middle of the Cold War,

18
00:00:59.260 --> 00:01:06.560
a President with lost nuclear codes added
some instability that the world really didn’t need.

19
00:01:06.560 --> 00:01:09.174
This story has something to do with your phone,
I promise.

20
00:01:12.310 --> 00:01:16.369
There are three ways that a computer,
or any system, can identify you.

21
00:01:16.369 --> 00:01:21.020
It can ask for something you know,
something you are, or something you have.

22
00:01:21.020 --> 00:01:23.820
Those are the three ‘factors’ of authentication.

23
00:01:23.820 --> 00:01:28.180
And the gold standard for checking identity
is multi-factor authentication.

24
00:01:28.180 --> 00:01:30.990
At least two of these different factors.

25
00:01:30.990 --> 00:01:33.799
Two different passwords aren’t much better
than one.

26
00:01:33.799 --> 00:01:36.469
But two factors are.

27
00:01:36.469 --> 00:01:39.479
When you do something as simple as withdrawing
cash from an ATM,

28
00:01:39.479 --> 00:01:41.240
that is two-factor authentication:

29
00:01:41.240 --> 00:01:43.060
the something you have is your card,

30
00:01:43.060 --> 00:01:45.149
and the something you know is your PIN.

31
00:01:45.149 --> 00:01:48.490
So let’s look at each of these factors.

32
00:01:48.490 --> 00:01:53.240
For something you know. Well, for that,
these days, that’s a password.

33
00:01:53.240 --> 00:01:55.719
The traditional login system,
username and password,

34
00:01:55.719 --> 00:02:00.200
is usually credited to Dr Fernando Corbató
at MIT in the 1960s.

35
00:02:00.200 --> 00:02:04.429
And when the only input device to your computer
is a keyboard,

36
00:02:04.429 --> 00:02:07.219
a password absolutely makes sense.

37
00:02:07.219 --> 00:02:11.079
Something you know could also be a PIN,
which is just a short password,

38
00:02:11.079 --> 00:02:14.030
or in the days before computers, your signature.

39
00:02:14.030 --> 00:02:16.870
But using this one factor isn’t ideal.

40
00:02:16.870 --> 00:02:18.780
Signatures can be forged.

41
00:02:18.780 --> 00:02:20.030
Passwords can be leaked or intercepted,

42
00:02:20.030 --> 00:02:22.519
either by someone hacking into the server
they’re stored on,

43
00:02:22.519 --> 00:02:24.709
or putting a keylogger on your computer,

44
00:02:24.709 --> 00:02:28.099
or just by someone looking over your shoulder
while you type.

45
00:02:28.099 --> 00:02:32.709
I actually taught myself to shoulder-surf
passwords when I was high school.

46
00:02:32.709 --> 00:02:34.260
Learned a teacher’s password.

47
00:02:34.260 --> 00:02:35.269
Got in trouble for it.

48
00:02:35.269 --> 00:02:38.849
And the only reason that I got caught,
the only reason,

49
00:02:38.849 --> 00:02:41.250
is because I told someone else
that I'd done it.

50
00:02:41.250 --> 00:02:43.769
I didn’t even want to do anything
with the password,

51
00:02:43.769 --> 00:02:48.080
I was just the sort of nerd who taught himself
skills like that for fun, 'cos I could.

52
00:02:48.080 --> 00:02:50.280
And the lesson I learned was not
“don’t do it”,

53
00:02:50.280 --> 00:02:52.640
it was “keep your mouth shut”.

54
00:02:52.640 --> 00:02:54.640
Anyway. Passwords.

55
00:02:54.640 --> 00:02:58.819
Not ideal, but reasonable in the absence of
any other options.

56
00:02:58.819 --> 00:03:02.620
What about the next factor:
something you are?

57
00:03:02.620 --> 00:03:04.040
That would be “biometrics”.

58
00:03:04.040 --> 00:03:06.269
Things like fingerprint and face recognition.

59
00:03:06.269 --> 00:03:09.680
These are great for proving who a person is,

60
00:03:09.680 --> 00:03:11.690
and they’re difficult to intercept.

61
00:03:11.690 --> 00:03:13.490
Although they do have downsides:

62
00:03:13.490 --> 00:03:17.810
the system has to trust that the device that’s
reading the print or checking the face hasn’t

63
00:03:17.810 --> 00:03:19.310
been compromised.

64
00:03:19.310 --> 00:03:21.140
And if your fingerprint gets leaked,

65
00:03:21.140 --> 00:03:26.329
because some high-tech spy took a copy of
it from a glass you drank from,

66
00:03:26.329 --> 00:03:28.060
you can’t exactly change it.

67
00:03:28.060 --> 00:03:29.239
I tried once.

68
00:03:29.239 --> 00:03:32.340
Plus, you can pretend not to know a password.

69
00:03:32.340 --> 00:03:34.550
That doesn’t work for your own face.

70
00:03:34.550 --> 00:03:39.200
Some people do say there is a fourth factor
of authentication, “somewhere you are”,

71
00:03:39.200 --> 00:03:43.360
the idea that if your credit card transactions
suddenly move to the other side of the globe,

72
00:03:43.360 --> 00:03:45.970
it might be worth checking what’s going on,

73
00:03:45.970 --> 00:03:49.620
but I’d say that gets rolled into
“something you are”.

74
00:03:49.620 --> 00:03:54.537
Science fiction writers have also imagined
complicated artificial intelligence systems

75
00:03:54.537 --> 00:03:58.389
that can learn someone’s behaviour patterns
over time and recognise them,

76
00:03:58.389 --> 00:04:01.513
or panopticon societies where privacy is a
thing of the past and

77
00:04:01.513 --> 00:04:04.739
everyone knows where everyone is and what
they're doing, all the time.

78
00:04:04.739 --> 00:04:07.650
But right now, for “something you are”:

79
00:04:07.650 --> 00:04:10.969
we’re basically stuck with fingerprints and faces.

80
00:04:10.969 --> 00:04:14.510
So how about the third factor:
something you have?

81
00:04:14.510 --> 00:04:19.699
That would be your bank card, or your phone,
or a literal key.

82
00:04:19.699 --> 00:04:24.539
Which is ideal if you’re in the same physical
location, if you are unlocking a door:

83
00:04:24.539 --> 00:04:30.970
but how do you prove that someone has a physical
object when they’re in a completely different location?

84
00:04:30.970 --> 00:04:33.470
That was a lot more difficult before smartphones.

85
00:04:33.470 --> 00:04:37.245
British banks have been sending out card readers
to their customers for many years:

86
00:04:37.245 --> 00:04:40.710
you plug in your card,
it reads a secret code off the chip,

87
00:04:40.710 --> 00:04:45.370
and then you type in your PIN and a one-time
code that your bank sends you for each transaction.

88
00:04:45.370 --> 00:04:47.790
And it mashes all those together,
does a lot of maths,

89
00:04:47.790 --> 00:04:50.830
and the result is a number that you send
back to your bank,

90
00:04:50.830 --> 00:04:54.000
confirming that you have the physical card.

91
00:04:54.000 --> 00:04:57.069
But these days, often you don’t need all
that fuss:

92
00:04:57.069 --> 00:04:59.360
because almost everyone carries a phone now,

93
00:04:59.360 --> 00:05:03.960
and that’s a physical thing that can work
as a token just by sending a notification

94
00:05:03.960 --> 00:05:06.919
to an app on it. That’s often secure enough.

95
00:05:06.919 --> 00:05:09.770
Sometimes that’s still done with numbers
in text messages,

96
00:05:09.770 --> 00:05:12.720
but that’s not ideal: SMS is not secure,

97
00:05:12.720 --> 00:05:17.509
and there have been attacks where criminals
have called up phone providers and convinced

98
00:05:17.509 --> 00:05:22.360
the provider to move someone’s number
over to another phone that the criminal controls.

99
00:05:22.360 --> 00:05:25.639
Or you can use an authenticator
app on your phone.

100
00:05:25.639 --> 00:05:27.400
Now, that generates one-time codes.

101
00:05:27.400 --> 00:05:30.800
When you set up that app,
it stores a long secret code from the server:

102
00:05:30.800 --> 00:05:32.550
then it combines that with the current time,

103
00:05:32.550 --> 00:05:36.673
and every minute, you get a different six-digit number
that you can type in,

104
00:05:36.673 --> 00:05:39.163
to prove that you have that phone.

105
00:05:39.241 --> 00:05:42.908
It’s basically a password that your phone
knows, but you don’t.

106
00:05:42.908 --> 00:05:46.449
The codes you type in can be short because
they only last a minute each.

107
00:05:46.449 --> 00:05:49.140
Of course, if you’re not actually talking
to your bank,

108
00:05:49.140 --> 00:05:53.366
you're talking to some phishing web site that’s just
taking the number you give them

109
00:05:53.366 --> 00:05:56.169
and passing it on to the bank
pretending to be you…

110
00:05:56.169 --> 00:05:58.199
that’s not ideal.

111
00:05:58.199 --> 00:06:03.970
So some really high-security companies use
a small physical USB or Bluetooth token instead.

112
00:06:03.970 --> 00:06:06.270
Google gave those out to all their employees,

113
00:06:06.270 --> 00:06:11.169
and they claim it reduced the number of successful
phishing attacks to zero.

114
00:06:11.169 --> 00:06:14.699
The actual process of how it works is way
beyond the scope of this video,

115
00:06:14.699 --> 00:06:16.889
but it’s basically equivalent to the
bank card reader,

116
00:06:16.889 --> 00:06:21.139
only automatic and with a lot more complicated
maths going on behind the scenes to make sure

117
00:06:21.139 --> 00:06:24.190
that the key will only talk directly to the
correct web server.

118
00:06:24.190 --> 00:06:26.300
And because there’s nothing
for you to type in,

119
00:06:26.300 --> 00:06:28.949
you can’t accidentally give the code to
someone else.

120
00:06:28.949 --> 00:06:33.669
You’re required to have
the actual, physical token.

121
00:06:33.669 --> 00:06:38.479
Those US nuclear codes use
all three factors of authentication.

122
00:06:38.479 --> 00:06:41.010
Something you have: the biscuit, the actual
code card.

123
00:06:41.010 --> 00:06:43.640
Something you know: there were fake codes
printed on that card,

124
00:06:43.640 --> 00:06:46.130
so the President had to memorise the position
of the correct one

125
00:06:46.130 --> 00:06:49.330
so that when he cracked open the card --
hopefully he'd never have to, but 

126
00:06:49.330 --> 00:06:52.599
when we cracked open the card
he’d know which one to read out.

127
00:06:52.599 --> 00:06:53.740
And something you are:

128
00:06:53.740 --> 00:06:57.759
he had to be surrounded by the security apparatus
and top-secret infrastructure

129
00:06:57.759 --> 00:07:01.259
that would let him make the call to the military
in the first place.

130
00:07:01.259 --> 00:07:04.930
Of course, all that multi-factor authentication
could only check

131
00:07:04.930 --> 00:07:07.189
that it really was the President
giving the order:

132
00:07:07.189 --> 00:07:09.129
that the identity was correct.

133
00:07:09.129 --> 00:07:12.640
There was no way to check that the President
was sane,

134
00:07:12.640 --> 00:07:14.639
or that he wasn’t being coerced or tricked.

135
00:07:14.639 --> 00:07:16.050
And in the same way,

136
00:07:16.050 --> 00:07:20.759
you can have all the multi-factor authentication
you want on your bank account and email.

137
00:07:20.759 --> 00:07:22.490
And you should. You should turn that on.

138
00:07:22.490 --> 00:07:26.213
You should go to your email provider and your bank
and turn on two-factor authentication

139
00:07:26.213 --> 00:07:30.457
for all your important accounts.
But it won’t help if

140
00:07:30.457 --> 00:07:32.812
the company that you’re
sending money to has been hacked,

141
00:07:32.812 --> 00:07:36.156
and the payment details they’ve emailed you
actually come from a scammer.

142
00:07:36.156 --> 00:07:39.666
It won’t stop you falling for a confidence
trick or a multi-level marketing scheme.

143
00:07:39.666 --> 00:07:44.080
Computers can only do what you say.
They can’t do what you mean,

144
00:07:44.080 --> 00:07:48.060
and they can’t stop you from asking for
terrible things.

145
00:07:48.060 --> 00:07:51.580
But at least they can be reasonably sure that
it’s you asking.