Security Corner

Oct 16 2014   12:28PM GMT

Password Mindsets and Landmines

Jeff Cutler Jeff Cutler Profile: Jeff Cutler

Tags:
Authentication
computer
Data breach
Hackers
Security

The history of the password takes a few paths…none of which really makes sense if you’re focused on usability. But let’s jump in…

Once upon a time it was enough to be able to remember your first pet’s name and use that as your password for everything. Who would be able to crack the cryptic protection of the word ‘spot’ or the even longer and more secure ‘mittens’? Your online banking, MySpace account and Yahoo Fantasy Football team was perfectly safe. Then it fell apart.

Screen Shot 2014-10-16 at 8.26.36 AM

Hackers breached a few online sites, blogs suddenly required more characters and variations to sign on, and email servers went over the top asking you to use special symbols, numbers and capitalization to make your password safe. As security increased, difficulty and barriers to use appeared. No longer was it enough to remember a keyword, people had to start writing stuff down.

That was the turning point. While IT folks and security pros realized the need for stronger encryption and data protection, users were the ones actually using their workstations. In the quest for continued productivity, passwords were a speed-bump so people started to ignore them. This made IT wring their collective hands and implement password requirements.

Not quite the immovable object and unstoppable force, users and tech support were at odds. As a side note, I think this is what has caused employees to perpetually treat IT folks with disdain. If tech support didn’t have all the power, users might act with more acceptance to their suggestions. But onward…

Passwords had to be long and complicated. Users needed fast access to their stuff to do their job. Passwords were then written down on sticky notes or computers were left on and users stayed logged in. Not a great way to keep stuff safe.

While it’s a running joke that the best way to crack a password at any large company is to flip over the keyboard and read the sticky note, it’s based in reality. And it’s not going to change until education and/or process goes through a wholesale change.

Maybe I wrote this today as a wake-up call. Maybe I wrote this to remind myself to choose better passwords for my stuff. And maybe I penned this column to let you know the discussion surrounding passwords isn’t going to end soon. In fact, Oct. 22 on Twitter, a few of us are participating in an online discussion about the power and/or futility of today’s password process.

Join me online to support, dispute or solve any of the password thoughts I’ve shared above. Maybe you can help make all of us more secure. I hope so.

See you next week! Watch this blog for details on the upcoming Twitter chat!

 Comment on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: