In 2002 I sat in a local bookstore in Jackson Hole, WY that offered a few Internet-connected computers for hourly use. After chatting with the owner and petting the resident store dog, I took a few guesses at the password protecting these computers. It took me maybe 10 attempts. It was, of course, some variation of the dog’s name. While this is a very dated story, it’s this kind of story that still drives many people’s perception of why a strong password is necessary. We imagine some nefarious (well, not in my case) criminal sitting at a keyboard, guessing passwords based on pet names or children’s birthdays. That mental model is, of course, largely false. The risk of an individual human actor guessing your password by repeatedly typing it into a prompt is nearly zero.

So how do we modernize our understanding of the threat landscape when it comes to passwords? Well, the first step is to stop talking about passwords. As long as we continue to conceptualize the threat as being related to passwords, we’ll continue to miss the mark. Passwords are part of the overall authentication picture, but we stand to gain more in terms of securing our critical data, whether personal or professional, from expanding our understanding of authentication and the associated threats.

Credentials, Factors, and Trust

I’m a big proponent of adopting language to drive change. We should stop talking about passwords exclusively. Passwords are really a single component of the larger set of “credentials” that can be used for authentication. When we talk about credentials instead of passwords, we pull additional authentication factors into the conversation, such as biometrics, keys, SMS messages, and other authentication tokens. It’s true that passwords, especially ‘weak’ passwords, are the weakest link in the authentication chain. We’ve spent years advocating (Read more...)