No password, no problem for NTUC members

Irene Tham

030414_assurity_onekey.jpg

SINGAPORE - Members of the National Trades Union Congress (NTUC) may no longer need to remember their passwords when they log in at its website to book a chalet or apply for a course.

The national umbrella body for trade unions has offered its 600,000 Singaporean and permanent resident members a new way to access its website, using just a security token, with no password needed.

It is believed to be the first organisation here to do away with the use of passwords.

Typically, a security token generates a one-time password (OTP), but users still have to key in user names and passwords in a process called two-factor authentication, which has been mandatory for banks since 2006, to counter cyberthreats.

But NTUC is offering members a token called OneKey, which looks like a credit card and provides a randomly generated one-time password.

In NTUC's case, only the OTP and username - usually the identity card number - need to be entered.

What is not required is a password, which NTUC said members often forget and ask to reset.

"Using OneKey as the password mechanism, we have removed the hassle of having to create and remember passwords," said Dr Kwong Yuk Wah, chief information officer at NTUC.

Members interviewed are happy with the new feature.

Business development manager Edna Low, 40, said she tends to forget passwords, which is why she uses the same one across a few online accounts.

"I know it's not safe, but now the problem is solved. I hope more organisations will get rid of static passwords by using security tokens," said Ms Low, an NTUC member for at least 14 years.

According to a 2012 poll of 346 people by Assurity Trusted Solutions, a subsidiary of the Infocomm Development Authority, three in five Singaporeans who access government services online have never changed their passwords. And half use the same one for all other online activities - from banking to shopping. But this creates "a single point of failure" which hackers can easily exploit, said chief operating officer Chai Chin Loon of Assurity, which is behind the OneKey hardware.

"NTUC's innovative use of OneKey shows that user convenience can go hand in hand with online security," he added.

Insurer NTUC Income's two million policyholders have been given the option to use OneKey since early last year.

itham@sph.com.sg

This article was published on April 3 in The Straits Times.

Get a copy of The Straits Times or go to straitstimes.com for more stories.

- See more at: http://news.asiaone.com/news/singapore/no-password-no-problem-ntuc-members#sthash.ngznewAL.dpuf
.............

E-SECURITY TIPS

We often get carried away with what the cyber universe has to offer – copious amount of fascinating, intriguing and often fun images, videos, news and stories. In our excitement, we happily click on any links with the keen anticipation of what we might find!

However, with each click lies the potential of an unknown or often times, invisible intruder ready to embed a virus to steal your identity.

CYBER RISKS

Who:

Cyber intruders intend to cause harm in cyberspace, such as a hacker stealing personal information. They, then, become you and gain access to every aspect of your life – at work, at home or at school.

What:

You are what they are after. Impersonating you will allow them access to many aspects of your life – e.g. your bank accounts which they can financially benefit from, the contacts of your family and friends whom they can exploit thereafter, etc.

Where:

The Internet is created by and accessible through computer networks that share information and facilitate communication. Unlike the physical world, cyberspace has no boundaries across air, land, sea, and space.

Why:

There is a range of motives, including seeking confidential information, money, credit, prestige, or revenge. Some just do it for fun. The majority of cyber criminals are indiscriminate.

Information Technology may have created greater convenience in our daily lives, whether at work, at home or at school, but our growing dependence on IT demands greater security online. We are our own first line of defence in guarding against any online risks.

The Password Guide

Most people would admit to having a universal password for the ease and convenience of remembering, not really knowing the danger this may pose. The basis of hacking is to steal one’s identity, which means, knowing your username and your password to gain access to your online accounts.

Mistakes Commonly Made When Creating Passwords

Using personal information about yourself or family members. This includes the generic information that can be obtained about you easily via social media. This may also include your favorite food, sports and pop idols.
Passwords that are the same as your username or part of your username.
Using a real word from any language that can be found in a dictionary or common colloquialism.
Using sequences, i.e. consecutive alphabets, numbers or keys on the keyboard. E.g. abcde, 12345, qwerty, asdfgh
Using any of the above in reverse sequence and any of the above with a number in front or at the back.
Using a word found in the dictionary with a number substitution for the word look-alike. E.g. Replacing the letter “O” with the number “0” in “passw0rd”.
Using the default password as supplied by the system vendor and meant to be changed at installation time.

Tips On Creating Strong Passwords

Use a combination of uppercase and lowercase letters, plus punctuation and numbers. Using all four types of characters works the best. E.g. Instead of using “Thank You”, use “Th@n1
Passwords should be at least eight characters long. The longer they are, the harder to crack.
Try to make your passwords as meaningless and random as possible.
Create a password from a phrase. E.g. “My Father was 50 years old last year” could be made into “Mfw50yoLY”.

How You Can Manage Your Passwords

Do not use a common password for all your accounts.
Use a memorable password that you do not need to store in your computer or your mobile phone.
If you have your passwords written down somewhere, do not link them to their respective accounts.
Do not answer “yes” when prompted to save the password on any particular computer, including your own.
Remember to clear your browser history.
Never communicate a password to anyone, especially via email or instant messenger. Passwords should always be kept private.
Remember to change your passwords frequently. The more important the account, the more frequently the password should be changed.
Never click an email link and log in to any site from an email. Always type in the URL yourself. This will help you avoid phishing attacks.
There are many online services that will help you gauge the strength of your password.
Adopt 2nd Factor Authentication (2FA) practices to further secure your online activities.

It is always tempting to use your username, birth date or some combination of personal information as your password.

However, with the rise of social media, it takes only an average hacker to figure out these passwords.

Passwords provide the first line of defense against unauthorized access to your computer. This responsibility can truly lie only in our own hands.

Adopt 2nd Factor Authentication For Maximum Security

2FA, which stands for 2nd Factor Authentication, is an additional layer of protection that typically requires a device that is unique to the holder. The OneKey Pad is such a device. The password generated in this device is only privy to the device’s user.
................

This is a quick little introduction on factor authentication to an average user. It was originally something I made at work to help users understand why they would want to use Google Apps' two factor authentication. I made it with nothing but Keynote and Camtasia for Mac. This version was originally posted over at friendsintech.com

UNDERSTANDING CYBER SECURITY

Did you know that cyber bandits can steal your identity, money, personal information and much more?

Practice cyber security to keep your online transactions safe!

As online fraud and identity theft become more widespread, online Service Providers such as securities trading firms and banks have introduced more stringent cyber security measures to protect their users’ financial transactions.

OneKey is your answer to convenient, worry-free online transactions!

ABOUT NAF & 2FA

National Authentication Framework (NAF)

The National Authentication Framework (NAF) is a nationwide platform to provide trusted and cost-effective authentication for online services, so as to protect the public’s online transactions.

What is Authentication?

Authentication is the process of validating a person’s identity for security purposes.There are three recognised factors of authenticating individuals:

"Something you know", such as a password or PIN

"Something you have", such as hardware security token

"Something you are", such as a fingerprint, a retina scan or other biometric

A system is said to use strong authentication when it requires at least two of the three factors before access to the system is granted. This contrasts with traditional single-factor authentication, which requires only one authentication factor (normally the knowledge of a password) in order to gain access to a system.

2FA stands for 2nd Factor Authentication, which is the use of something you carry as proof of identity. 2FA makes it much more difficult for an attacker to impersonate you and access your computer, accounts, or other resources. The OneKey device provides 2FA with its One-Time Password (OTP) function.

Click here to watch an introductory video on 2FA:

http://www.youtube.com/watch?v=E6NkWYzKcvw

HOW ONEKEY WORKS

OneKey is the world’s first national 2nd factor authentication device for all users of private and public sector online services.

One Person One Device

Frustrated with having to carry around many different transaction security devices? OneKey can be used to transact with multiple service providers, offering you the most complete and convenient solution!

One Device, Three 2FA Functions

OneKey provides you with 2FA and Transaction Signing for maximum cyber security.

What is Transaction Signing?

Transaction signing is the process of keying a specific portion of your transaction details (eg, account number or transaction amount) on your OneKey to authenticate an online transaction.

This is like signing an online cheque!

OneKey offers three 2FA functions: One-time Password, Challenge Response and Transaction Signing.

Click here to learn how to use your OneKey for more secure online transactions!

ABOUT ASSURITY

Assurity Trusted Solutions Pte Ltd ("Assurity") is a wholly-owned subsidiary of the Info-communications Development Authority of Singapore ("IDA"). It has been set up to operate the NAF and provide 2nd Factor Authentication services.