For more than 15 years, there have been various predictions from tech leaders about the death of passwords. Bill Gates predicted it back in 2004 and Microsoft has predicted it for 2021. There have been numerous similar proclamations in between, alongside ongoing criticism of passwords as an inadequate means of protection.
Yet passwords remain a common aspect of cybersecurity, something people use every day. What’s more, passwords show little sign of disappearing yet. But many people still use them badly and seem unaware of recommended good practice.
It’s very common for cybersecurity experts and companies to blame users for using passwords poorly, without recognising that systems permit their poor choices.
Many websites offer no upfront guidance on how to choose the passwords they require us to have, perhaps assuming we know these things already or can find it out elsewhere. But the fact that people persist in using weak passwords suggests this is an optimistic view
Rules to follow
Of course, having highlighted the lack of effective guidance, it would be remiss to end without actually offering some. The NCSC’s guidance about choosing and using passwords are listed and briefly explained below:
- Use a strong and separate password for your email – as this is often your route to accessing other accounts.
- Create strong passwords using three random words – this will give you stronger and more memorable passwords.
- Save your passwords in your browser – this prevents you forgetting or losing them.
- Turn on two-factor authentication – this adds an extra element of protection even if your password is compromised.
It’s useful to supplement this with additional reminders not to use the same password across multiple accounts for fear that a breach of one leads to breach of all, not to share them with other people because then it’s no longer your password, and not to keep a discoverable record of them. Storing them in a protected location, such as a password manager tool, is fine.
It’s worrying to think that passwords have been around for decades and we’re still getting it wrong. And they’re just one aspect of cybersecurity that we need to be using properly. This doesn’t bode well for cybersecurity more widely.
Source: theconversation
