Your password will probably be hacked soon, and how to (actually) solve the problem

By Brian D. Earp

See Brian’s most recent previous post by clicking here.

See all of Brian’s previous posts by clicking here.

Follow Brian on Twitter by clicking here.

Your password will probably be hacked soon, and how to (actually) solve the problem

Smithsonian Magazine recently reported: “Your Password Will Probably Be Hacked Soon” and delivered a troubling quote from Ars Technica:

The ancient art of password cracking has advanced further in the past five years than it did in the previous several decades combined. At the same time, the dangerous practice of password reuse has surged. The result: security provided by the average password in 2012 has never been weaker.

After the Twitter accounts for Burger King as well as Chrysler’s Jeep were recently broken into, Twitter apparently issued some advice to the effect that people should be smarter about their password security practices. So: use lots of letters and numbers, passwords should be 10-digits or longer, use a different password for every one of your online accounts and so on.

But this is nuts. Does Twitter know anything about how human beings actually work? Why do you think people reuse their passwords for multiple sites? Why do you think people select easy-to-remember (and easy-to-discover) factoids from their childhoods as answers to security questions?

Because we’re not good at remembering things, that’s why. And we’ve got so much going on that it’s very difficult to be bothered about setting up a complex password protection-and-management scheme. Meanwhile, the incentive to be “plugged in” to multiple online networks is huge (and growing), and so we carry on our merry way. As the Smithsonian article concluded:

Chances are, even knowing that passwords are easy to crack, most of us will keep our silly p@$$w0rd tricks that don’t actually protect us.

Yes, that’s right. Human beings are limited, fallible creatures. We are prone to a huge array of decision-making biases, and we don’t fathom risk very well. Thanks to the recent efforts of psychologists and behavioral economists, this insight is now widely recognized and it most profoundly ought to influence how we design our institutions and social practices, online and off. It’s the idea behind “nudging” or reshaping the choice matrix people encounter to encourage better decisions without cramping autonomy or freedom of choice. And it’s the idea behind good product design – the “It Just Works” philosophy of companies like Apple.

If Twitter cares about the account security of its millions of users, it should invest in real solutions to the password-hacking problem: solutions that take into account the rangebound psychological architecture of actual, real-life humans. Asking people to memorize multiple sets of long strings of random number-and-digit combinations in order to safeguard their online portals and personal information is a losing strategy. What might be a smarter approach?

What about something like finger-print identification for access to online accounts? Nearly every screen being manufactured these days is a touch-screen, and if someone can get the technology right, and convince me it’s safer and more fool-proof than my own pathetic memorization skills, I’d very happily press my phalanges onto my phone or computer screen to gain privileged, less-hackable access to Twitter, Facebook, and wherever else. Nothing to remember. Same gesture for every account. No one else can do it.

Apparently, some HP Notebooks come equipped with a version of this technology. But why isn’t it on my Mac? Why am I not doing this at the bank to get money from the ATM? Why can’t I pay for groceries at the store with the press of a pinkie?

I’m sure that the futurist tech nerds on this blog (and among its readership) will point out some holes in my idea here — and perhaps the specific notion of finger-print access isn’t the way to go — but the core point, I think, is sound: password protection is huge a deal, and people are not inherently good at it. Asking them to remember lots of sets of alphanumeric character strings is probably not going to work in the long run. Some will pull it off. Most will not. More creative thinking is needed for a workable solution.

What are your ideas?

________________________________________

See Brian’s most recent previous post by clicking here.

See all of Brian’s previous posts by clicking here.

Follow Brian on Twitter by clicking here.