_4Col.png)
You might attend one of the large cyber security trade shows or a national conference on defeating hackers and keeping your company's data safe, and emerge thinking "hackers don't have a chance of getting in". And then you see yet another headline on yet another big data breach, and reality kicks in. We're far from winning you think. But wait, there's a new technology in town, which has the ability to start levelling the playing field.
If a set of technologies clearly don’t work well, should you blindly keep on using them? That’s the question we asked ourselves several years ago when looking at today’s inadequate authentication systems and products. We could see that all of them suffered from major flaws. Perhaps the biggest is that they all require users to give up something valuable - like a mobile number or fingerprint (to name just two) - which can ALL be stolen.That’s worth repeating. Virtually all current authentication systems depend on user secrets or objects which can be stolen, rendering them weak and vulnerable. So we set out a number of years ago (around 2005) to create something where the user’s all-important “secret” could not be stolen, is never exposed, only resides in the user’s head, and does not depend on users having to carry extra bits of plastic (including phones) to prove who they are. Shayype technology we believe is the first real advance in cyber security for decades. Now users can enjoy the convenience of passwords, with the strength of 2FA - without the clutter and cost of having to use extra devices. Not even phones! Shayype displays a different code (a one-time passcode or OTP) on the user’s screen, meaning it’s far more secure than say vulnerable “two-step” authentication systems where users are sent codes by text. These can so easily be diverted to hackers’ own phones simply by taking over a user’s mobile account. We also hope to save the world from the burden of having to use longer and “stronger” passwords, which just get harder to remember – so end up being written down or stored en masse. All that’s now inthe past. The future now looks more secure for all of us, as at last cyber security can (pardon the pun) Shayype up.
Jackson is a CTO with 18 years’ experience in software and app development. He has successfully completed projects that saved companies £800k annually and contributed to the sale of a business for £3.5 million supported by technology he helped create.
John has long been a pioneer in FinTech and the Digital Trust model for internet transactions, having helped to found Barclays’ original Information security management team, and in 2000 helping to set up IdenTrust - a global bank joint venture. He is now heavily involved in the development of distributed ledger technology in fintech.
Jonathan is the founder of Shayype having pioneered pattern-based authentication in Europe as long ago as 2005. His background is in communications, media (both as print and broadcast journalist), public relations and conference organisation. In 2008 a company he set up to begin exploring the potential of device-less OTP authentication was awarded “Cool Vendor”status by Gartner, and in 2009 the same company won UKTI’s Franco-British Award for Innovation. Now as part of the Shayype team he hopes to save the world from the burden of passwords, replacing them with what is arguably the first new knowledge-based “factor” for use in human authentication in decades.
HOW CAN WE HELP?
Yes. Shayype Keycloak provides single sign-out, which means users only have to log out once to be logged-out of all applications that use Shayype Keycloak.
We’d say it’s far easier to remember a pattern. Our brains are hard-wired to recognise shapes like faces - far more so than horrendous hard-to-recall sets of characters. One of the brilliant things about Shayype is that it allows users to set up something extremely complex – a secret that’s really hard to guess – extremely easily!
Yes. There are other so-called IaM packages available, but we came across Keycloak (created by Red Hat, now part of IBM) and could see it was excellent and would allow us to offer off-the-shelf versions of Shayype to enterprises and other types of organisation. We refer to the combined solution as Shayype Keycloak.
No. That would betray your secret pattern. You just read off the numbers and input them on a separate keypad (on the device or using a stand-alone one on-screen). One of the strengths of Shayype is that it’s practically impossible for someone watching you to work what your pattern is – as there are at least seven of each digit. Which ‘5’ did you use, which ‘4’ etc.
Your security is vital. In today's world, we need a better way to prove who we are, when we can no longer see who we're dealing with. Some people (including UK Defence Minister Ben Wallace, have even described the online world as a “Wild West”. The tech giants who created our online world should have created a better way for all of us to prove who we are. Shayype is that system, allowing users far more control and security when online.
Yes. Like having multiple passwords, you can have more than one pattern. However (although this is up to individual users) you may decide having just one, or even two, patterns is enough.
You’ll be able to re-set your pattern securely. (Talk to us directly to find out how user security is maintained.)
Certainly. We will be able to offer an SDK (software developers’ kit) and our existing API library will adapt to any system.
Typically, you’d be directed (perhaps via an email link) to a webpage containing a ‘blank’ grid. You then just click on a few dots to create a secret pattern or shape (guided by a neat ‘strength’ meter). The system then suggests you try out your pattern by seeing a dummy ‘real’ grid and reading off numbers. If you can do that OK, the system will ask if you want to save your pattern, and you’re done. It’s as simple as that.
Instead of vulnerable fixed strings of characters, users are armed with secret patterns or shapes, which when applied to small grids containing numbers (typically 5X7) populated with random (frequently repeated) single digits, neatly and elegantly provide users with new ‘one-time’ codes for each transaction, while resisting threats such as shoulder-surfing.