Goodbye, Passwords. You Aren’t a Good Defense.

Came across this interesting article on passwords in NT Times (August 9, 2008) by Randall Stross. Passwords won’t keep us safe from identity theft, no matter how clever we are in choosing them argues Randoll Stross. Some highlights -

THE best password is a long, nonsensical string of letters and numbers and punctuation marks, a combination never put together before. Some admirable people actually do memorize random strings of characters for their passwords — and replace them with other random strings every couple of months.

Then there’s the rest of us, selecting the short, the familiar and the easiest to remember. And holding onto it forever.

I once felt ashamed about failing to follow best practices for password selection — but no more. Computer security experts say that choosing hard-to-guess passwords ultimately brings little security protection. Passwords won’t keep us safe from identity theft, no matter how clever we are in choosing them.

The solution urged by the experts is to abandon passwords — and to move to a fundamentally different model, one in which humans play little or no part in logging on. Instead, machines have a cryptographically encoded conversation to establish both parties’ authenticity, using digital keys that we, as users, have no need to see.