4 ms·

Much of security is also a people problem, though. You can have all the best encryption/firewalls/etc and still get hacked because your CEO uses their first nam

• geofft 7y ago
  The existence of passwords is a problem, though. Perhaps it was the best approach in the '70s and '80s, but the world has changed: - Most people use their own computers with high-quality local hardware, not a shared workstation, a public terminal, or a dial-up / serial line. So "store a secret on the client" becomes viable. (One of the biggest quiet successes in security, in my opinion, has been that everyone uses SSH as standard practice instead of telnet, and most of them use SSH keys or similar instead of passwords. It is significantly better to authenticate with unencrypted SSH keys on a laptop you keep in your bag or house than with a password.) - Most people carry a phone around with them, and you can authenticate them by whether they have the phone. - You can get a tiny USB device that does serious cryptography to authenticate you (and authenticate the site you're connecting to) for about $10. You can get two of them and put one next to wherever you keep your birth certificate, in case you lose the first. All of these are technical wins worth celebrating, and now we're at the point where the people problem is not so much convincing the CEO to use a better password as convincing systems to use one of the above methods instead of using passwords at all.