BoilerKey—Purdue’s attempt at two-factor authentication. Not only was it not well-thought through, but ITaP also offered very little support for it, all while forcing it on all students and faculty on the same day. Typically, two-factor authentication is a very helpful feature. However, Purdue’s implementation of it has served to not only confuse students and faculty but also has reduced security in some ways. By using PIN,push, the complexity of your password is significantly hindered, from at least 8 letters/numbers/symbols down to only 4 numbers.
In almost any other implementation of two-factor authentication, users have an app on their phones that generates six-digit one-time passwords. These are used in combination with your pre-existing password. When logging in, you enter your username and password like usual and then are prompted to enter the six-digit one-time password. This serves to add to the existing security. Although this is only anecdotal evidence, it seems to me like I’ve received significantly more spam emails from clearly hacked Purdue accounts, after BoilerKey was implemented.
With BoilerKey, users are asked to replace (but not entirely, more on that later) their password with a flimsy, four-digit PIN. In addition, all people must do is tap a notification on their phone, instead of purposefully opening an app. In the defense of BoilerKey, this is easier than opening an app and typing in the six-digit one-time password. However, this may also serve to reduce security, as most college students would just instinctively press the “Allow” button without thinking. The nice time-saving measure is quickly nullified, however, as you must use BoilerKey every time you log in. With most other two-factor authentication implementations, you’ll stay logged when using the same device.
This brings me on to my next point, which is that BoilerKey isn’t ubiquitous across places where your Purdue Career Account credentials are used. Some platforms use it, and others don’t. For example, logging into your email or a campus computer doesn’t require BoilerKey, but logging into most other products do. This is very confusing for users, as Purdue has not made it clear where we need to use BoilerKey and where we need to use our normal career account password.
In conclusion, BoilerKey has been a big disappointment to many and has seemingly managed to make the phishing problem on campus worse than it already was, despite its goal to do the complete opposite.
In almost any other implementation of two-factor authentication, users have an app on their phones that generates six-digit one-time passwords. These are used in combination with your pre-existing password. When logging in, you enter your username and password like usual and then are prompted to enter the six-digit one-time password. This serves to add to the existing security. Although this is only anecdotal evidence, it seems to me like I’ve received significantly more spam emails from clearly hacked Purdue accounts, after BoilerKey was implemented.
With BoilerKey, users are asked to replace (but not entirely, more on that later) their password with a flimsy, four-digit PIN. In addition, all people must do is tap a notification on their phone, instead of purposefully opening an app. In the defense of BoilerKey, this is easier than opening an app and typing in the six-digit one-time password. However, this may also serve to reduce security, as most college students would just instinctively press the “Allow” button without thinking. The nice time-saving measure is quickly nullified, however, as you must use BoilerKey every time you log in. With most other two-factor authentication implementations, you’ll stay logged when using the same device.
This brings me on to my next point, which is that BoilerKey isn’t ubiquitous across places where your Purdue Career Account credentials are used. Some platforms use it, and others don’t. For example, logging into your email or a campus computer doesn’t require BoilerKey, but logging into most other products do. This is very confusing for users, as Purdue has not made it clear where we need to use BoilerKey and where we need to use our normal career account password.
In conclusion, BoilerKey has been a big disappointment to many and has seemingly managed to make the phishing problem on campus worse than it already was, despite its goal to do the complete opposite.
Comments
Post a Comment