How many passwords do you use for online accounts? I have 250. That's a conservative estimate and doesn't include a plethora of hosting, database and SSH passwords. Despite using management tools such as KeePass, it's difficult to use different passwords for every site -- and I certainly don't change them as often as I should. Even then, I forget what I've used on specific sites. Logging in is often a matter of clicking "forgotten password", hitting an email link, entering a new password and finally gaining access. The average user has a couple of easily-remembered passwords for every account. There's no guarantee every one of those sites has implemented good security measures. Perhaps passwords are stored in plain text or accessible to their staff, developers, database administrators or those working at their hosting company. Could your banking account be accessed just because you used the same credentials at dodgysite.com? We're using the same ID and password mechanisms we implemented at dawn of the web. But a password backlash has begun. Passwordless logins have been proposed by developers such as Justin Balthrop and implementations have arrived, e.g. passwordless.net for Node.js. The main argument: passwords are obsolete because we all have secure email and mobile SMS accounts.
Continue reading %Would You Implement Passwordless Login?%
by Craig Buckler via SitePoint
No comments:
Post a Comment