Kiran Jonnalagadda ([info]jace) wrote,
@ 2007-08-07 16:01:00
Previous Entry  Add to memories!  Tell a Friend  Next Entry
Password etiquette
I'm standing in queue at my bank to encash a self cheque, because, for once, the transaction has to be done faster than online transfer between banks affords.

My signature barely matches what the bank insists it is. In about five years of holding this account, I'm yet to finish my first cheque book. I do all my transacting online. My password is my signature.

I use a different password everywhere. I remember all my passwords, or at least all the more frequently used ones, trusting the rest to a password manager.

I never change passwords. My method of remembering tens of unique passwords doesn't work when they have to change.

And so when a site demands a password change every fifteen days as security precaution, my system breaks down entirely. I cycle through the same three passwords across all such sites. My account's security is actually weakened as a result.

Some may say that this will all change with biometrics. I don't buy that. Biometrics will face far more resistance than passwords because it conflates identity with authorisation. It requires changing the fundamental trust patterns of society, which is not an easy sale.

We're going to be a password-based society for some time. How long will it be before a class on password management becomes as elementary as one on letter writing in school?



(12 comments) - (Post a new comment)


[info]skjaidev
2007-08-07 11:28 am UTC (link)
For sites that require changing passwords every 15 days, I change password twice when I have to and revert to my original one. Thankfully most of these don't remember previous passwords / md5 etc. BTW, NSE/SEBI requires 15 day password expiry for all online trading accounts.

I'm gonna resist biometrics as long as I can. I'd rather have my eye / finger than my money / email.

(Reply to this) (Thread)


[info]chaitrasuresh
2007-08-07 07:36 pm UTC (link)
What do you do when at work, you're asked to reset your password every month and that new password takes one whole day to 'percolate' into every place that might need it(CVS, intranet blah blah) and you're forced to remember both the passwords in the meantime and keep doing hit-miss thingie!!! :( !(*&(#*%@#@

(Reply to this) (Parent)(Thread)


[info]vaishaksuresh
2007-08-08 03:39 am UTC (link)
We have to change our password every 45 days or so, and it percolates in 15 min or less. bu the problem is that you cannot repeat the past 12 passwords :(

(Reply to this) (Parent)


[info]deponti
2007-08-07 03:48 pm UTC (link)
"Some may say that this will all change with biometrics. I don't buy that. Biometrics will face far more resistance than passwords because it conflates identity with authorisation. It requires changing the fundamental trust patterns of society, which is not an easy sale."


Could you explain that...I didn't understand...I,personally, would like biometrics, because my iris or my finger is unique...

(Reply to this) (Thread)


[info]jace
2007-08-07 05:29 pm UTC (link)
Your biometric signature is a facet of your identity. That means if it is ever stolen, you can't do anything about it.

The hardware device you interface with, whether a fingerprint scanner or iris scanner, converts your physical characteristics into a stream of bytes. The rest of the system depends on those bytes, not your actual physical characteristics. Those bytes are just like a password, except they never change. The same password everywhere, for all your life. And because they're digital bytes, a copy can be perfectly reproduced.

A signature or a password is a form of authorisation. You supply them to indicate you are authorising something. You are not your signature or password. Biometric authentication does not differentiate between the two.

When identity and authorisation are separate, you can do things like signing a blank cheque for a joint account or giving your daughter your ATM card with the PIN number to withdraw some money. You can't do anything of the sort with biometrics.

The deal breaker is not in how secure or insecure something is, but in the fact that it requires you to change the ways in which you trust and deal with the people around you to be able to use this technology.

(Reply to this) (Parent)(Thread)


[info]deponti
2007-08-07 06:02 pm UTC (link)
Thanks, that explained it much better. I had thought only as far as recognition, and had not thought of the digitalization which can then, as you say, be replicated...

You make me think, Jace, and thank you for that.

(Reply to this) (Parent)


[info]fus
2007-08-09 04:40 pm UTC (link)
i disagree
offline

(Reply to this) (Parent)


[info]jbritto
2007-08-07 06:17 pm UTC (link)
I was totally annoyed when icicidirect started insisting that I change the password every fourteen days. Apparently some bright soul at the NSE thought that this was the best way to increase security.

(Reply to this)


[info]teemus
2007-08-08 12:00 pm UTC (link)
I like HSBC's approach to online banking - password + RSA token.

(Reply to this)


[info]thaths
2007-08-10 11:05 pm UTC (link)
Can you recommend a good password manager on OSX? Something that can interoperate with Revelation password manager would be nice, but not required.

(Reply to this) (Thread)


[info]jace
2007-08-11 03:34 am UTC (link)
I'm quite happy with OSX's Keychain Access, the in-built manager.

(Reply to this) (Parent)


[info]januarybitch
2007-08-15 12:53 pm UTC (link)
I guess forgetting your password is a problem that can be solved easier as compared to getting pulled up cos the signature on the cheque you issued doesnt match the signature that you had initially submitted...4 years ago!

(Reply to this)


(12 comments) - (Post a new comment)

Create an Account
Forgot your login or password?
Login w/ OpenID
English • Español • Deutsch • Русский…