0

Passwords and humans don't mix particularly well. We can't come up with random ones very well, we can't remember random ones very well, we re-use them (I'm talking about all humans here, maybe not those of you who browse this stackexchange), when we do come up with unique random ones we have to hide them behind a single point of failure in a password manager. Additionally, a lot of vendors/providers/websites store them improperly, either in plaintext or using a weak or fast algorithm.

However, they remain ubiquitous.

My question is two-fold:

  • when used with a second-factor, is the whole system (password+2nd factor) strong enough as a whole that the disadvantages of passwords become irrelevant?
  • Assuming the answer to the first question is "no, password disadvantages make the system too weak", what alternatives are there for us to use in the future?

I can imagine there are alternative technologies which are production-ready but which network effects prevent from breaking through into the mainstream. Or are there any technologies which are nearing the end of development? Or has no-one thought of a good alternative?

Will the replacement simply be something else we know (referring to the factors in security: something you know, something you have, something you are). Or will we move away from that model completely?

  • Technology that's ready that can't compete with network effects?
  • Technology ideas which need wrinkles ironing out?
  • Passwords, 2-factor (email, text, ...), encryption, smart cards, Biometrics - Fingerprint, Face ID, Retina. In my opinion there are options to be safe enough without much hassle. Note: I know not all of these are fail-safe and I too believe that we can come up with better ones, but I'd say I am happy for now! I'll vote to let them stay :) – Ebenezar John Paul Nov 9 '18 at 14:37
  • I'd advise you to simplify your question to focus on one primary issue you'd like to have answered and then change your title to describe it more precisely. – PwdRsch Nov 10 '18 at 3:10
3

When used with a second-factor, is the whole system (password+2nd factor) strong enough as a whole that the disadvantages of passwords become irrelevant?

For most purposes, having a second factor is probably sufficient to outweigh the problems with passwords, assuming the rather important condition that you implement the second factor correctly. In particular:

  • You need a properly defined recovery mechanism that's still secure. The OTP recovery codes that are provided by many sites which support 2FA are a good example of this being done right.
  • You need proper support for allowing multiple independent second factors. For example, allowing association of multiple U2F keys with a given account, or multiple fingerprints, or multiple TOTP apps. The reason this is important is that unlike a password, the second factor is usually not trivial to replace, so having an emergency backup is important.

Assuming the answer to the first question is "no, password disadvantages make the system too weak", what alternatives are there for us to use in the future?

I don't think there really are any that are anywhere near ready, largely because they have their own issues which are arguably much more complicated to deal with than passwords. Biometrics are still pretty easy to fool and aren't even entirely reliable to begin with. Hardware security devices are generally a joke as they are currently implemented, and are far easier to lose than passwords. Other technologies have their own further issues.


Beyond that, I'd like to actually challenge the premise of the question. You seem to imply that the issues are inherent to passwords, but I would argue that they all stem from how they are typically used.

Firstly, the concept of a 'strong random password' as most people think of it isn't actually all that good. It's pretty well established that what people classically called strong passwords (and what many websites still require you to use) are hard for people to remember but easy for computers to guess, and therefore not really all that useful. If, instead, you use something similar to the XKCD approach (XKCD #936), it's pretty trivial to remember, and if done right can be insanely secure (especially if you mix languages).

Now, even ignoring that though, most people actually can remember classically complex passwords without much difficulty if they use them regularly. The issue here is that many people use persistent login sessions (which are bad for other reasons as well), and have things set up to remember their passwords for them. If you're typing it in every day, you'll have it memorized, at least as muscle memory, after at most a few weeks.

Also, the point about weak storage is irrelevant, because it's not specific to passwords. It's just as possible for 2FA systems to have the same issues for the second factor as it is the password.

Altogether, that leaves reuse, but that's still an issue for many alternatives (it's not like you can realistically use a different retina for each retina scan, or a different finger for each fingerprint scan).

0

There are several options that have already replaced passwords, biometrics like fingerprint readers to unlock mobiles is quite common. Iris or facial recognition is another that is used. Some banks commonly use card readers, which isn't the most convenient, others have started texting verification codes which makes more sense to me.

All of these will take more work to implement so I don't see passwords going away any time soon but I think a mixture of the above will become more common without you even noticing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.