In “The Password is Dead: Long Live the Password,” Ryan Wade argues against our continued reliance on passwords in an age of cheap alternatives like biometrics or two-factor authentication. As a ten-year network security researcher and lecturer, I must say I find Mr. Wade’s views compelling, intelligent, and—perhaps most importantly—well worth heeding.
Wade’s repeated use of phrases like “outdated,” “outmoded,” and “dead technology” in the first paragraph all accurately describe the state of text passwords. His first point, that increases in processor speed mean faster brute-force attacks, is mathematically sound, and his second, that the “weakest link in a corporate infrastructure can still be the gateway to serious disruption,” comes validated by the weekly headlines about major corporations and their customer data breaches.
The dependence is ludicrous, Wade claims, when you can buy a USB-powered thumbprint scanner at any major department store. This, too, is true—though I’d argue that the lack of major websites adopting biometrics as an optional secondary verification creates a self-feeding chain. Until consumers see the power of a piece of technology in a format they can connect with, they aren’t likely to adopt it. In at least this respect, Wade could have noted the shared responsibility.
Outside of security, passwords can be a hassle when complexity requirements meet bad memory, Wade argues. Since words and even phrases are falling to faster processing power, many companies require employees to create what is in essence a line of gibberish—and the longer the line, the harder it is to remember. Resetting passwords can create security breaches as well if employees tend to cycle patterns when creating them. However rare it is, Wade claims, it only takes one mistake in the right people to “cause a lot of people a lot of hassle.”
Perhaps the most interesting leg of Wade’s argument compares the relatively low cost of switching to a biometric solution for the individual, and how that cost can skyrocket depending on the number of employees and facilities needing computers. In some cases, he says, the cost isn’t too terrible, using a fast food restaurant with a single voice-activated timepunch as an example. Others, like large IT firms, could potentially spend millions installing the least expensive microphones by themselves, then millions more finding software to use with them.
Wade stresses, however, that things are getting better. Even if they first have to suffer a major IT breach due to the weaknesses of passwords, many companies are making the switch in spite of costs. Second, many laptop and even desktop computers come with things like HD video cameras and high-quality microphones integrated into their hardware, making installing new authentication processes quite a bit easier than in the days of driver discs.
If things don’t continue their upward trajectory, however, Wade says a major password attack may be the only wakeup call some get. As a researcher who had his own laptop compromised, I’m inclined to agree. My hacker experience pushed me into buying a thumbprint scanner for my home devices.