Passwords, passwords everywhere

Our world seems to be awash with passwords. Passwords for work, passwords for e-mail, passwords for shopping, passwords for the bank. They are all supposed to be different, they are all supposed to be memorised and we are told never to write them down. It’s just not practical. It’s password hell. There has to be a better way.

What not to do

We’ve all seen some of the things you mustn’t do. You can’t use passwords like “password123” or the name of your dog. You can’t have post-it notes stuck to your screen as a reminder.

One surprising security failing is people’s willingness to tell other people what their password is. Your password is yours only and never tell anyone what it is. Imagine if you were careless about your computer password at work; a few weeks later a load of pornography is uncovered and the IT people say that they can see it was put there by you. And here’s something else you can’t do. Don’t buy a pocket notebook helpfully labelled as “password logbook” – madness.

The slightly better way

One slight improvement on password hell is to use one of many password vault services that manage your passwords for you. But it’s only a sticking plaster; you still have to worry about what happens if the password vault gets hacked.

Another small security improvement is two-factor authentication, where you have a password and a device that generates a one-time code. The banks are busy introducing this with their mini card readers and apps for your mobile phone. Trouble is, this might make the banks more secure but it doesn’t help us. We still have the password to remember plus we’ve now got more hassle.

The best way

The altogether better way to manage all your passwords is to get a business-quality management system. Single Sign On (SSO) is an up and coming technology that has the potential to deliver a solution. You log on to an SSO service such as OneLogin or Okta. That’s the only password you need. The SSO service gives you password-free access to all the other services you have subscribed to. It feels much like a password vault but the technology is a lot smarter and much more secure.

The future?

All we want is what we see in sci-fi films – your computer, your bank and your workplace just recognise you with a sotto voce “Good morning, Mr Smith”. We might just get there, but the key to success is the ability for a computer to recognise you, or at least some part of you.

Fingerprint recognition was regarded as a great way forward but it’s just not secure enough, apparently. The next body part that could be used for identification is iris recognition. The technology is there and camera resolution in laptops and phones is good enough. Then there is face recognition, as used in the automatic passport-control booths at airports. If they can be quick enough and cheap enough, these biometric technologies could be a huge step forward for individual recognition.

Also creeping on to the security agenda is the sort of identity chip that your cat or dog probably wears. It’s very big brother-ish but if it makes our life a lot easier, it could just catch on. Think about the impact of being able to turn on your laptop and it knows who you are; no need to log in. Your phone is paired to you and no-one else, so it won’t work if it gets stolen. You walk into the bank and their systems authenticate you before you get to the counter. Would you volunteer to be chipped?

All these things could happen, but there is no way to predict which. What is a certain is that the era of passwords has to end soon.