Why passwords are failing us -- still!

Computerworld - Passwords weren't the only fail in last week's widely publicized "epic hack" of tech journalist Mat Honan -- Amazon, Apple and, to a lesser extent, Google and Honan himself share the blame.

But passwords played a part in the perfect storm of user, service provider and technology failures that wiped out Honan's entire digital life. As he concluded in his account of the hack, "Password-based security mechanisms -- which can be cracked, reset and socially engineered -- no longer suffice in the era of cloud computing."

The essential problem is this: The more complex a password is, the harder it is to guess, and the more secure it is. But the more complex a password is, the more likely it is to be written down, shared or otherwise stored in an easily accessible location, and therefore the less secure it is. And the killer corollary: If a password is stolen, its relative simplicity or complexity becomes irrelevant.

Computerworld - Passwords weren't the only fail in last week's widely publicized "epic hack" of tech journalist Mat Honan -- Amazon, Apple and, to a lesser extent, Google and Honan himself share the blame.

But passwords played a part in the perfect storm of user, service provider and technology failures that wiped out Honan's entire digital life. As he concluded in his account of the hack, "Password-based security mechanisms -- which can be cracked, reset and socially engineered -- no longer suffice in the era of cloud computing."

The essential problem is this: The more complex a password is, the harder it is to guess, and the more secure it is. But the more complex a password is, the more likely it is to be written down, shared or otherwise stored in an easily accessible location, and therefore the less secure it is. And the killer corollary: If a password is stolen, its relative simplicity or complexity becomes irrelevant.

Password security is the common cold of our technological age, a persistent problem that we can't seem to solve. The technologies that promised to reduce our dependence on passwords -- biometrics, smart cards, key fobs, tokens -- have all thus far fallen short in terms of cost, reliability, or other aspects. And yet, as ongoing news reports about password breaches show, the importance of password management is greater than ever.

IT wants to be compliant and secure, but they also want to be fast and expedient when it comes to synchronizing user accounts.

Eve Maler, Forrester

All of which makes password management a nightmare for the IT department. "IT faces competing interests," says Forrester analyst Eve Maler. "They want to be compliant and secure, but they also want to be fast and expedient when it comes to synchronizing user accounts."

Is there a way out of this scenario? The surprising answer: Though there's little consensus on the solutions, conversations with consultants and IT executives reveal a healthy dose of optimism about the future. Sources cite technologies such as single sign-on, two-factor authentication, machine-to-machine authentication, and better biometrics as ways to strengthen security . . . eventually. For now, each of these still has its drawbacks, which means it does not appear that our password problems will be eased anytime soon.

The problem with passwords

Despite years of well-publicized breaches, weak passwords still subvert IT security, but the most obvious solution -- strong passwords -- comes with its own set of problems.

Complex passwords annoy or stymie users, who subsequently take up IT's time asking for password resets, thereby lowering productivity for both groups. The result, laments Maler: "IT ends up with both a lack of usability and a false sense of security."

What's more, both weak and strong passwords are vulnerable to human error -- writing down passwords, putting them in visible places online or on personal devices, sharing them or falling for phishing schemes, to name but a few.

It's a problem with old roots: Security expert Larry Ponemon of the Ponemon Institute worked on a project some 15 years ago for a government agency that required users create 15-character passwords and update them every 30 days.

• The 20 Best iPhone/iPad Games of 2013 So Far
• 9 Steps to Build Your Personal Brand (and Your Career)
• 7 Consumer Technologies Coming to an Enterprise Near You
• 11 Signs Your IT Project is Doomed
• A walking tour: 33 questions to ask about your company's security
• 15 social media scams
• The 7 elements of a successful security awareness program