THL Toolbox > General Principles > IDs and Passwords
IDs and Passwords
Contributor(s): David Germano
THE best password is a long, nonsensical string of letters and numbers and punctuation marks, a combination never put together before. It is also the worst password from the viewpoint of actual use by real people.
However, choosing hard-to-guess passwords ultimately brings little security protection. The problem is the log-on procedure itself, in which we land on a Web page, which may or may not be what it says it is, and type in a string of characters to authenticate our identity (or have our password manager insert the expected string on our behalf). Password-based log-ons are susceptible to being compromised in any number of ways. Phishers trick us into clicking to a site designed to mimic a legitimate one in order to harvest our log-on information.
The solution urged by the experts is to abandon passwords — and to move to a fundamentally different model, one in which humans play little or no part in logging on. Instead, machines have a cryptographically encoded conversation to establish both parties’ authenticity, using digital keys that we, as users, have no need to see. In short, we need a log-on system that relies on cryptography, not mnemonics.
As users, we would replace passwords with so-called information cards, icons on our screen that we select with a click to log on to a Web site. The click starts a handshake between machines that relies on hard-to-crack cryptographic code. The necessary software for creating information cards is on only about 20 percent of PCs, though that’s up from 10 percent a year ago. Windows Vista machines are equipped by default, but Windows XP, Mac and Linux machines require downloads. However, Web site hosts must also be persuaded to adopt information-card technology for sign-ons.
We won’t make much progress on information cards in the near future, however, because of wasted energy devoted to a large distraction, the OpenID initiative. OpenID promotes “Single Sign-On”: with it, logging on to one OpenID Web site with one password will grant entrance during that session to all Web sites that accept OpenID credentials.
OpenID offers, at best, a little convenience, and ignores the security vulnerability inherent in the process of typing a password into someone else’s Web site. Nevertheless, every few months another brand-name company announces that it has become the newest OpenID signatory. Support for OpenID is limited, however. Each of the big powers supposedly backing OpenID is glad to create an OpenID identity for visitors, which can be used at its site, but it isn’t willing to rely upon the OpenID credentials issued by others. You can’t use Microsoft-issued OpenID at Yahoo, nor Yahoo’s at Microsoft. The companies see the many ways that the password-based log-on process, handled elsewhere, could be compromised. They do not want to take on the liability for problemsoriginating at someone else’s site.
Microsoft and Google are among the six founding companies of the Information Card Foundation, formed to promote adoption of the card technology. BUT perhaps information cards in certain situations are convenient to a fault, permitting anyone who happens by a PC that is momentarily unattended in an office setting to click quickly through a sign-on at a Web site holding sensitive information. This need not pose a problem, however. Users on shared systems can easily set up a simple PIN code to protect any card from use by other users. The PIN doesn’t return us to the Web password mess: it never leaves our machine and can’t be seen by phishers.
