Honestly, we all suck at passwords, and yeah, maybe you personally use unique, impossible
to guess. 50 character randomized passwords for all your accounts, but unfortunately you'd be
the exception rather than the rule, you special little person you.
According to a 2019 Google study, about a quarter of Americans use some absurdly unsecure
passwords like one, two, three, four, five, six. And according to a different study from the same year, around three quarters of users
in the US and Canada reuse passwords, while around half only change one character when
they're forced to update their passwords. And to be fair, a big part of the reason this happens is that the average person has so
many online accounts now that they can't keep their passwords straight, and many people
aren't even aware that password management software even exists.
Then you have the fact that passwords sometimes aren't even stored on the servers themselves
in a secure manner. All you need is to take one look at the headlines about password dumps to see that.
But do we even need passwords at all?
Even though we're all still used to punching in passwords, people in the computer industry
have been discussing eliminating them for quite a while now.
Back in 2004, Bill Gates himself pointed out that the whole idea of a password was flawed
for situations where a high level of security was needed.
But if this is true, what would we use instead?
Microsoft seems to think they've got it all figured out. If you have a Microsoft account, you could actually go into your settings right now and
choose to convert your account to password lists.
Instead of using a password, you can use the Microsoft Authenticator app to secure your
account. Each time you want to log in, you'll either get a verification code from the app or through
SMS or email, get prompted for a physical security key, or use biometrics like Windows
Hello face scan. The password list isn't just something Microsoft is doing, though it has stolen the headlines
considering it means you can go entirely password lists on Windows.
Many mobile apps have allowed you to log in with a fingerprint after just a first time
setup. And the signs also point to Google moving to a password list model with those one tap
authentication prompts that show up on your phone, possibly being the way of the future.
In fact, Google builds security keys directly into Android phones themselves in order to
verify that it's actually you trying to get into your own account.
Of course, even though none of this will sound super novel to anyone who's ever used
two factor authentication, as all of you should be, we probably still have a ways to go before
passwords really become a thing of the past. While large firms like Google and Microsoft will probably lead the way in implementing
it, it won't be trivial for smaller organizations to switch all of their infrastructure over
to password lists, especially as users often have to log into multiple services that might
not automatically play nice with each other. It's for this reason that IT departments might be looking more at a concept called the
Federated Login, which essentially means that one login will get the user into all the services
they need. But this takes work to implement, and this isn't the only barrier to ditching our passwords.
If all of this sounds like two factor authentication with, you know, one less factor, you'd be
right. Although not having a password sounds super convenient, it has the potential to make things
a massive headache if a user loses their phone or their physical access token.
So cybersecurity workers face a challenge in figuring out a practical way to verify
a person's identity if the worst happens.
Personally, I'm a fan of good old fashioned secret handshakes.
So thanks for watching guys. If you liked this video, hit like, hit subscribe, and hit us up in the comment section with
your suggestions for topics that we should cover in the future.