Ric Richardson

Things are moving so fast in the quantum computer field that it's hard to gauge what is the current state of the art. The news that Microsoft has been making major advances in the field, for example, is more about the practicality of writing software for and providing production grade hardware components for what is at its core still very much an experimental technology. On the other hand, the recent news that Russian researchers have broken the 50 qubit threshold is of major significance to security professionals particularly. As a result, this article is an attempt to shed some light on the current state of the art in quantum computing and to give some background and context so that someone with limited technical knowledge can understand the main issues. Questions I’ll try and answer include: What is quantum computing in simple terms? Why can’t everybody build there own quantum computer? Why is it particularly powerful in breaking encryption? What is the sig...

Quite a bit of discussion came up after my article on Double Octopus and TokenOne who both rely on mobile authentication. For the uninitiated mobile authentication is the use of a mobile phone for primary or secondary authentication/ logon. So here are my top reasons that mobile authentication will not cut it: Reason 1: No one uses it today even though all the big companies have mobile authentication systems Google Authenticator is the most widely distributed and used mobile authentication app but…. look for it in the app stores top downloads list. It does not appear in the top 200 list for any market. And using the rule that there are 1,000 downloads for every comment then it’s a dead man walking. On top of that, I downloaded Google Authenticator so I am a downloaded but I only used it once. It feels like getting my keys out every time I want to go on a website. I wonder if any of the people touting mobile authentication have used it! Note: Google claims millions of downl...

Business-- - This month has been very busy on the business side of things for our CEO Rob Morrish and my partner and chairman Tony Castagna. The sales and partner pipelines are just busting at the seams. ---Engineering--- But September also marks the culmination of many moths of hard work for our engineers as we put the final touches on the cloud versions of our products. ---Public Understanding--- This month I'm also going to start addressing some of the issues that seem to have become really confusing in understanding security, privacy and the storage of sensitive information on enterprise networks. Articles coming this month: An Australian FinancialReview article positioned TokenOne as a major breakthrough in password-less logons. I'll be doing a pretty thorough coverage of why TokenOne is great but not the true password-less solution the world is crying out for. A comparison between Double Octopus and Haventec's Authentication . A review of a leader in the aut...

When I started Haventec over two years ago with my good partner Tony Castagna, I had invented the core technology for the express purpose of getting rid of passwords, replacing the with simple PIN's but making the logon process even more secure. A peripheral advantage that has since become the companies main focus is the removal of the headache of protecting and storing passwords on enterprise servers.

A very good friend of the company, Ted Pretty, saw this company hit his radar and I thought to get us to have a peek. The company looks like it has a slick product but… the elephant is the room is that it is yet another so called password-less solution that is hobbled by the need to get your phone out and authorise a connection. There is no way that a technology that requires you to get your phone out every time you want to connect on any device is going to be a true all-platform all-application replacement for passwords. Double Octopus along with PING and TokenOne all may have applications in high end high security authentication situations where users would otherwise have to use a dongle, or other secondary factor... but for the everyday people, the bank customer, the elderly logging on to their bank account from an older computer or the poor sharing a computer in myriad real life practical situations, the use of a phone as your main authentication is just not realistic. And conc...

Recently a well thought out and comprehensive evaluation of the state of user identification and authentication was presented by the New York Times and reprinted by the Sydney Morning Herald. The article can be seen here: http://www.smh.com.au/business/innovation/goodbye-password-banks-opt-to-scan-fingers-and-faces-instead-20160622-gpov42 I have paraphrased it in part to help anyone who is more than a bit interested in this subject to see why the article is well meaning but misguided: It fails to properly segregate the real issues involved with uniquely and securely identifying a person and; Helps promote a solution that in the end is very dangerous, namely Biometrics. You cant replace your thumb when its ID is hacked. You cant replace your Iris when its hacked. The enclosed PDF is a copy of the article with my comments in the margin. If you are interested in this subject it may be worth your investment of time to consider the points I make.

Naveen, Vernon and Ric during the Cloud Random Number Generator brainstorming sessions With Naveen at our local brainstorming/ caffeine haunt. It's about time that I share with you a secret weapon I have been relying on at Haventec. His name is Naveen Neti our chief engineer and resident clear thinker for many of our most important projects and innovations. Along with our Chief Architect Vernon Murdoch, we form Haventec's Red Team which is the small group who are usually tasked with breaking the back of the big problems we face in what is not an easy role as a cyber security company. Photo of Naveen during one of our brainstorming sessions at Byron Bay where we had just fleshed out how to do Cloud Random Number Generation  While all team members are A players, the core of our current efforts are around the meticulous and careful hardening and quality assurance of our core products which are becoming the first line of Defence in protecting millions of customers and...

About three months ago we started arranging our engineering talent at Haventec around a three team principle of personal strengths. Firstly let me say all our engineers are A players. So ability is up there. But people are happiest when they do things they are good at. A persons demeanour and other strengths mean they they will be more happy doing certain things over others. So our Red team does R&D. It can handle fast iterations and can quickly assess, test and dump ideas while trying to break the back of bigger more long shot problems. The Red team must also be able to handle continuous disappointment. Our Blue Team does our production code so attention to detail and quality tenacity are strengths here. Our Green team members are our release code engineers. They are sympathetic customer focussed fixers and refiners. This approach is working well and everyone gets in and helps each other when needed so there are no silo builders at Haventec. Micro pivot However yesterday...

1962 was the year I was born. It was also the year usernames and passwords were first used to stop shared computer users from using up computer time on another persons account. That at all comes to an end this year with the mainstream rollout of Haventec's passwordless authentication. It it is true that PINs have gradually replaced passwords on most mobile applications, the fact is that most PINs are being used as a surrogate for passwords that still persist and lie waiting to be hacked on enterprise networks everywhere. As it turns out, the man who invented the computer password back in the early 1960s agrees. In a recent interview with The Wall Street Journal, 87-year-old Fernando Corbato said that the password has become “kind of nightmare". That ends this year. Haventec's technology uses PINs on everything... mobile, desktop, laptop, cloud and browser. And what is more no PIN or password or anything user identifiable is stored anywhere! Especially not on ...

Two years ago I introduced what I thought was the first password-less logon system in history. Since that time there have been dozens maybe hundreds of claimers to that throne. Anyone with a thumb print sign-on, or an app that opens their website on a PC is claiming to be password-less. Well here are some things to consider: If a web site supplies an app that uses Apple's fingerprint sign-on as a log on capability, is this password-less? No. If you still have to use a password on ANY of your devices to access your account, you are not password-less. Your password is still stored on their enterprise network and can still be hacked. Password-less means just that... NO PASSWORD. Just an FYI, Apple's fingerprint scanner is only a surrogate for your password... it just gets sent to the site in the background as a result of you using your thumbprint.. so it is definitely NOT password-less. Some new technology (such as PING ) asks you to open your phone and access a sec...

Here are some references from one of Australia's leading crypto experts who recently shared his expertise with us at Haventec. All I can say is that we are entering a dangerous new world. https://www.quantamagazine.org/20140515-forging-a-qubit-to-rule-them-all/ Really great explanation of real life Qubit building scenario https://www.quantamagazine.org/20150908-quantum-safe-encryption/ Explains the growing concern for cryptographers over Quantum computers cracking/ brute force capability http://csrc.nist.gov/publications/drafts/nistir-8105/nistir_8105_draft.pdf A report from Feb 2016 outlining specific implications of quantum computing an specific cryptographic uses.

Just had a friend send me a link as follows: Digi.me bags $6.1M to put users in the driving seat for sharing personal data  TechCrunch article . What a great little project with incredibly ambitious plans. From what I can tell here is their approach... Google gets to leverage their incredible user base by offering services in return for looking over the shoulder of their users and monetizing what they find out, usually by advertising. Digi.me asks users upfront to trust them with your personal data and then goes about hawking it or distributing it with your express approval. If it is used by a company for income then they may sure you as the user gets a benefit.. but the basic difference is that Google asks for forgiveness after the fact of sharing your data (while assuring us they will "do no evil") and Digi.me asks for permission... up front. This approach will be a long haul. But it's a big prise. Could Haventec do this with their Digital Wallet product...

Because Haventec has branched out from a core of Authentication to secure personal data management and Blockchain applications, it may be a bit confusing to work out what space the company is focussed on and who and who are not Haventec competitors. First of all it is important to understand how Haventec's three core products fit together. Haventec Authentication enables users to securely connect to even high security enterprise networks without storing any personal information on the network. Plus it does not rely on thumbprints or facial recognition or any other device specific capability. You can use a multitude of user identity methods but the key thing is that nothing hackable gets stored on the server or network so it solves the biggest issue facing enterprise C suite decision makers… how to limit breach risk. Haventec Digital Wallet moves sensitive information off corporate networks onto users devices but secures them by physically separating the location of the data (on...

Quantum computing is clearly the next phase in computing progress. It's the difference between having a vocabulary of two (Yes and No ie binary) and being able to use millions of words to calculate and communicate... faster, more accurate, efficient and powerful. The problem is that anyone with the advantage of a Quantum computer can totally overwhelm someone relying on old YES/NO technology. Enter Encryption. It's current role is to scramble information so that the processing power of someone with a key can unscramble the information millions of times faster than someone who does not have the key but has to guess it. Quantum computing means that key finding is so fast that encryption as a protection is almost pointless. But Quantum computing (that uses qubit rather than bit) is only coming in the medium term future isn't it? We are a decade off at least... right? Well for a relatively long time IBM's 5 qubit Quantum computer was considered the ceiling for...

The news has been speculating on how the FBI has broken into an alleged terrorists iPhone and after thinking about it a while here is my guess... Here is what I'd do: 1. I'd take apart the iphone and make a flash copy of the memory of the iphone. 2. Then Id run up one hundred flash copies of the original image in its original state. 3. Then I'd test three of the possible 10,000 combinations on each individual image until each individual image self destructs. Thats three hundred attempts in each cycle. 4. Then I'd keep doing it until I found the combination that worked. That is only 333 cycles to try all ten thousand pin combinations. Ahhhh, this makes me think of a way to stop this attack... I wonder if Apple is interested in a solution?

A lot has happened since the SMH article last year . Here are some highlights: A company was incorporated to commercialise the technology. I have partnered with a respected co-founder We have been working in the banking industry The technology is officially working We have an initial customer We have secured funding And will soon have an experienced CEO in place to roll out market entry Why all the secrecy? Well there isn't really, its just that with this project, that we have called Haven, we have opted to quietly go about executing. Also the fact that the players involved are all significant well known people and institutions, it would be improper for me to speak for them in my blog. That being said, when the time comes it will be really exciting for me as this project is by far the fastest moving most successful project I have ever worked on.