Create Profile

Creating your profile will enable you to submit photos and stories to get published on News24.

Please provide a username for your profile page:

This username must be unique, cannot be edited and will be used in the URL to your profile page across the entire 24.com network.

Facebook Sign-In

Hi News addict,

Join the News24 Community to be involved in breaking the news.

Log in with Facebook to comment and personalise news, weather and listings.


'Password fatigue' haunts internet masses

25 June 2013, 12:06

Washington – Looking for a safe password?

You can give HQbgbiZVu9AWcqoSZmChwgtMYTrM7HE3O bVWGepMeOsJf4iHMyNXMT1BrySA4d7 a try. Good luck memorising it.

Sixty-three random alphanumeric characters – in this case, generated by an online password generator – are as good as it gets when it comes to securing your virtual life.

But as millions of internet users have learned the hard way, no password is safe when hackers can, and do, pilfer them en masse from banks, email services, retailers or social media websites that fail to fully protect their servers.

And besides, with technology growing by leaps and bounds, why does the username-and-password formula – a relic of computing's Jurassic era – remain the norm?

"The incredibly short answer is, it's cheap," said Per Thorsheim, a Norwegian online security expert and organiser of PasswordsCon, the world's only conference dedicated to passwords, taking place in Las Vegas in July.

"If you want anything else – if you want some kind of two-factor authentication that involves using a software-based token, a hardware-based token or biometric authentication – you need something extra," he told AFP.

"And that will cost you extra money."

Back in the beginning, it was all so easy.

The very first computers were not only room-sized mainframes, but also stand-alone devices. They didn't connect to each other, so passwords were needed only by a handful of operators who likely knew each other anyway.

Then along came the internet, binding a burgeoning number of computers, smartphones and tablets into a globe-girdling web that required some virtual means for strangers to identify each other.

Passwords have thus proliferated so much that it's a daily struggle for users to cope with dozens of them – and not just on one personal computer, but across several devices.

There's even a name for the syndrome: password fatigue.

"People never took passwords very seriously, and then we had a number of really big password breaches," said Marian Merritt, internet security advocate for software provider Norton.

"As people are increasingly accessing websites from smartphones and tablets, typing passwords is becoming an ever bigger pain," added Sarah Needham of Confident Technologies, developers of a picture-based password alternative.

In a 24-nation survey last year, Norton found that 40% of users don't bother with complex passwords or fail to change their passwords on a regular basis.

Rival security app firm McAfee says its research indicates that more than 60% of users regularly visit five to 20 websites that require passwords, and that a like-sized proportion preferred easy-to-use passwords.

The most popular passwords, infamously, are "password" and "123456," according to Mark Burnett, whose 2005 book "Perfect Password: Selection, Protection, Authentication" was among the first on the topic.

Biometrics are coming

Carl Windsor, director of product management at California-based network security firm Fortinet, said he once ran John the Ripper, a free program to crack passwords, through an employer's Unix system with its consent.

Within seconds, Windsor had one-third of its passwords. Within minutes, he had another third. "I also won a bet by finding the 'super secure' password of a colleague in less than five minutes," he told AFP by email.

Password alternatives are in the pipeline.

Google is toying with the idea of users tapping their devices with personalised coded finger rings or inserting unique ID cards called Yubikeys into the USB ports of their computers.

The Fido Alliance, a consortium that includes PayPal, is pushing an open-source system in which, for instance, websites would ask smartphone users to identify themselves by placing their fingertips on their touchscreens.

"These (biometric) technologies are coming to a place where they are highly mature, cost effective and in a position to roll out into the consumer market today," Fido's vice president Ramesh Kesanupalli told AFP.

Kesanupalli said Fido technology could be available as early as this year, bettering IBM fellow David Nahamoo's prediction in 2011 that biometrics would replace passwords within five years.

In Washington, the US Patent and Trademark Office has recently published several patent applications from Apple that envision facial recognition and fingerprint scanning.

Motorola's head of research Regina Dugan has gone further, proposing a "password pill" with a microchip and a battery that would be activated by stomach acid. The resulting signal would emit an unique ID radio signal.

"I take a vitamin every morning. What if I take vitamin authentication?" said Dugan at the D11 tech conference in California last month, quoted by TechWeekEurope.

For now, many internet services are embracing two-factor authentication, that challenges users with a bonus security question – like "What is your dog's name?" – or emits a one-use-only numeric code via SMS messaging.

Online password managers with names like Lastpass, KeePass, 1Password, Dashlane and Apple's just-announced iCloud Keychain have also been popping up like mushrooms.

They pledge to securely stash an individual's entire password collection, accessible via one master password. Some experts, however, consider the idea a Band-Aid solution pending the definitive password replacement.

Until then, security experts widely agree on two core principles: make your passwords as long as possible, mixing up words with some numbers and symbols, and never ever use the same password for more than one website.

Beyond that, just cross your fingers and pray that the website you're using is doing all it can at its end to protect the mental keys to your virtual world.



Read News24’s Comments Policy

Comment on this story
Comments have been closed for this article.

Read more from our Users

Submitted by
Wilson Ochieng
DP Ruto accuses Raila of selling ...

DP Wiliam Ruto has castigated Raila Odinga for seeking western support to fund his 2017 election bid. Read more...

Submitted by
William Korir
Peter Kenneth announces Uhuru 201...

Peter Kenneth has announced that he will support President Uhuru Kenyatta in the 2017 elections. Read more...

Submitted by
Wilon Ochieng
Labour Party to dump both Jubilee...

The Labour Party of Kenya is likely to avoid supportoing both the CORD and Jubilee factions during the 2017 General Elections. Read more...

Submitted by
William Korir
Ukambani MP quits Jubilee, to run...

An Ukambani MP has quit the Jubilee Party, citing voter apathy as his reason behind leaving the ruling coalition. Read more...

Submitted by
Victor Tinto
Government launches probe into Po...

The government has launched an inquiry into the circumstances that could have led to two National Police Service helicopter accidents in August and September this year. Read more...

Submitted by
Wilwon Ochieng
Deputy Governor's ally found with...

The EACC has recovered KES 2 million in fake currency from a close ally of Deputy Governor for Tharaka Nithi Eliud Mati. Read more...