Tech Security Black Monday

It's not a good day for IT security. Two vulnerabilities were announced today, one affecting WiFi for almost everyone, and another that affects public key encryption.

Those who know me are aware that I often relate to most conversations about IT security as alarmist, and often find measures taken in Enterprise security to be self-defeating.

But this time, it's different.

This time the scope of these vulnerabilities is so widespread that many are calling this Black Monday.

How You Manage Passwords

Okay now, tell the truth.

With all the passwords you have to manage just to do your job and stay in touch with friends and family, you cannot possibly have a separate password for every account you manage, can you?

Some systems want you to have the password be a certain length, some want you to use at least one digit and one special character, (but it can only be from a certain subset of acceptable characters,) and some insist that you change the password on a periodic basis.

So you do what almost all the rest of us do. You use a standard personal password for most of your trivial accounts (like the Hilton Honors program and the Starbucks rewards program and your local gardening community forum site), and something special and (hopefully) secure for your online banking or your important social media accounts. But even with that strategy,  it's unlikely that you can keep all those passwords in your memory. So you write it down somewhere, don't you?!

Yes you do! Even the more progressive companies that require you to maintain credentials are beginning to acknowledge this age-old fact. No security system is stronger than the Post-It™Note.

So what are your alternatives? There are two. We'll talk about one today because it's something that's completely within your control

P@$$w@rdS Must Die!

...okay look here.

Every one of us wrestles daily with the problem of both protecting our online assets, and reliably gaining access to them. It's crazy, and as Cloud Computing comes into its own for mainstream use, the problem is going to just get more unmanageable.

Let's talk about passwords a little bit, and maybe we can agree on what's reasonable for the future.

When individual computers used to be a Big Damned Deal, we could rely on some primitive measures to protect them. First, there were only a few people who knew what to do with them, and then they had the only boot disks, so the machine couldn't even start unless they were there.

It's sort of appalling that entire offices actually did meaningful business with one or two "IBM compatible" computers in them, and with these marginally trained jealous harridans to guard them.

But then something happened to change everything...

Through with Passwords? Almost.

...if you're like me, you hate passwords with a passion.

They're almost gone from our lives, but it won't happen for some time yet. (Even if it takes another 2 years, that's about a generation and a half in Internet Years.) In the meantime, there is hope!