A recent study undertaken by Microsoft has had the web in a roar. Passwords are a waste of time.
“Most security advices simply offers a poor cost-benefit trade-off to users,” wrote the author Cormac Herley, a principle researcher for Microsoft Research. (Source)
The study went on to point out that while users are asked to change their passwords regularly, redoing them isn’t a very effective way of preventing the nasty attacker (or colleague) unless they only use the password they stole from you after you’ve already changed to a new one. About as likely as the nice man who stole your car keys only using them after you’ve changed the locks.
Essentially his overview said that the benefits of all the security measures we’re being asked to implement is somewhat outweighed by what we have to do in order to carry them out. In short, they are long and tedious tasks that take up valuable time.
Of course, this doesn’t mean that you should stop doing this. His view is that IT should make people’s lives easier, not harder, and that the stringent demands of password changes on our time are not necessarily good time value. It’s well worth reading through the entire article to see exactly what Herley says in greater detail and the other options he offers up as a solution.
One thing is for sure, a reliable security software solution is a good place to start. One that keeps your system safe from recent bugs and attacks and demands very little personal maintenance is a good bet. Check out Trend Micro’s Internet Security that comes free with ASUS machines (well a 60-day trial period, anyway) as a possible solution as it doesn’t munch up a lot of space and has quite a few customisable goodies.
Another option, especially if security is essential for your business or personal life, is to invest in technology that has biometric devices built in. These are not the holy grail but they are a very effective measure against intrusion.
Biometric technologies use an individual’s unique biological traits, such as fingerprints or facial characteristics, to determine identity. The most common form in use across the consumer and enterprise markets is currently fingerprint identification with the number of devices shipping for PCs, laptops and peripherals reaching the millions.
The Eee PC 1018P includes the AuthenTec identity management software and is the first netbook in the world to incorporate this particular biometric security system. When you consider that over 30 million netbooks (overall) shipped in 2009, it’s probably a good idea to make sure that these little guys are nice and safe.
So perhaps it’s time to consider two or three rotating passwords in conjunction with some nice biometric security, rather than the hideously tedious password upkeep that takes up so much of our precious time. Certainly I think that the fact that Microsoft, the biggest password nagger in the world, was the one to release this study is very interesting indeed.