Rumours of the death of the password are exaggerated, for now

Biometric authorisation is becoming more common, but it’s still underpinned by the traditional password

Almost every day appears to be a ‘Day’ of some sort, but one you may have missed occurred on May 7th. ‘World Password Day’ is designed to remind us all of the importance of updating our important passwords on a regular basis. In a number of reports released to coincide with the annual event, McAfee¹ revealed that the growth in remote working in the first three months of this year has resulted in many poor security practices as Remote Desktop Protocol (RDP) systems were brought online at speed amid the turmoil of the coronavirus pandemic. The company cites weak passwords as – still – the most common method by which attackers gain access, with P@ssw0rd, 123456 and NULL123 featuring strongly. Furthermore, most people hadn’t changed their passwords since their system was installed.

Weak passwords are vulnerable to so-called ‘brute force’ attacks, in which computers crunch thousands of potential passwords. They can largely be foiled by ‘three attempts’ limits common to many systems, or the much disliked (by users) ‘two stage authentication’ protocol. But an increasing risk is now recognised as coming from ‘insiders’, either deliberately leaking access information or using ‘shadow IT’, in which unauthorised devices, such as phone apps, compromise system security. The danger here is that, as a Cisco executive outlined at a recent IIC event, such breaches are commonly (and unacceptably) not detected for months, leaving hackers plenty of time to find and distribute all the information they want.

In theory, the answer to this should be to move to biometric access. This was announced last year by Microsoft, among others. The problem is that the current technologies, including fingerprint, voice, and facial recognition, are not always completely reliable and may themselves be vulnerable to mimicking. As a result, passwords are still commonly used as a ‘fall back’. In a recent survey by FindBiometrics², cyber security insiders expressed a range of views on whether passwords could ever fully be replaced, but even the optimists – 59% – said that it could take up to a decade and nearly a quarter said ‘never’.

What’s clear is that passwords, along with our apparent inability to make them easy to remember and hard to guess, will be with us for several years yet. An equally safe prediction is that on 6th May 2021 – the next World Password day – P@ssw0rd and 123456 will still be top of the password charts.

¹ https://www.infosecurity-magazine.com/news/criminals-exploiting-remote/
² https://findbiometrics.com/year-in-review-2019-the-roundup-901149/