After that, he got as much time as he wanted.
During the formative years of the web, as we all went
online, passwords worked pretty well. This was due
largely to how little data they actually needed to protect.
Our passwords were limited to a handful of
applications: an ISP for email and maybe an ecommerce
site or two. Because almost no personal information was
in the cloud—the cloud was barely a wisp at that point
—there was little payoff for breaking into an
individual’s accounts; the serious hackers were still
going after big corporate systems.
So we were lulled into complacency. Email addresses
morphed into a sort of universal login, serving as our
username just about everywhere. This practice persisted
even as the number of accounts—the number of failure
points—grew exponentially. Web-based email was the
gateway to a new slate of cloud apps. We began banking
in the cloud, tracking our finances in the cloud, and doing
our taxes in the cloud. We stashed our photos, our
documents, our data in the cloud.
Eventually, as the number of epic hacks increased, we
started to lean on a curious psychological crutch: the
notion of the “strong” password. It’s the compromise that
growing web companies came up with to keep people
signing up and entrusting data to their sites. It’s the BandAid
that’s now being washed away in a river of blood.
One proposal to reduce problems related to text passwords
is to use password managers. These typically require that
users remember only a master password. They store (or regenerate)
and send on behalf of the user, to web sites
hosting user accounts, the appropriate passwords. Ideally
the latter are generated by the manager itself and are
stronger than user-chosen passwords. However,
implemen-tations of password managers introduce their
own usability issues [Chiasson et al. 2006] that can
exacerbate security problems, and their centralized