Password panic: How often do you face it?

PART OF LIFE: “Password stress" has become part of everyone’s existence. It has become the worst enemy for some, and can rip relationships. With passwords we’re supposed to keep them to be uniquely ours and remember them by heart. Most of the time, we do (or don’t).

PASSWORD FATIGUE: When you try — and repeatedly fail — to log in to your account for the nth time, 'password fatigue' becomes a catchphrase of despair. And don’t even dare to ask your spouse. Whether s/he knows it or not, it’s bound to cause frustration to either side — or both. It’s a standard practice for most enterprises to require a password change every so often (i.e. quarterly) equivalent to 4 passwords changes a year to note down — equivalent to 40 passwords in 10 years and 160 passwords during one’s working lifetime.

TROUBLE OVER SAFETY: Passwords are ubiquitous — yet they cause so much trouble, as many can't seem to get them right. For end-users, passwords almost always guarantees end-user frustration. Worse: panic attacks induced by “I-forgot-my-password" episodes have also spiked.

GETTING THEM RIGHT: The risks and repercussions for getting them wrong are getting out of hand, according to “Security”. The magazine reported a 450% surge in security breaches globally containing usernames and passwords, quoting ForgeRock’s Identity Breach Report 2021. Verizon’s 2021 Data Breach Investigations Report shows 61% of breaches involve credentials.

'SOCIAL ENGINEERING': Weak password or poor password management are seen behind the spike in the so-called “social engineering” (SE) attacks which have cause companies dearly. Also, easy-to-guess passwords (123456 or 654321) are seen as the root cause of a number of cyberattacks, warned security experts. An example of SE attack is “phishing”, which describe cyber criminals who “fish” for information from unsuspecting users.

BAITING, QUID-PRO-QUO, TAILGATING ATTACKS: “Baiting” is a type of “social engineering” attack where a scammer uses a false promise to lure a victim into a trap which may steal personal and financial information or load the system with malware. The trap could be a malicious attachment with an enticing name. Other SE attacks include “Quid Pro Quo” (hacker requests the exchange of critical data or login credentials in exchange for a service), and “Tailgating/Piggybacking” (hacker closely follows an authorised user into the area without being noticed by the authorised user).


WHY DO WE MESS UP WITH PASSWORDS? Sometimes, there’s just too many to remember. Or, if you just one character you get wrong, your sanity is gone. As a rule, no two passwords should be the same. That’s where the problem lies. Our life is now dependent on passwords. Passwords are for grownups, as nappies are for babies. Most of the time they work, yet we cannot deny the times when they don’t.

HUMANITY DEPENDS ON IT: The whole of humanity today is completely dependent on passwords. We use it for everything. A password helps tell the system that we are who it "thinks" we really are. Yet, we all know that passwords — like nappies — aren't always foolproof. "Human factor" kicks in. And we all know that in every adult hides a "child within". Then it's a big mess.

STUCK WITH PASSWORDS? Nearly every person using a digital device face some form of password frustration. Which begs the question: why are we stuck with securing access with methods that users hate and hackers love?

3 AUTHENTICATION CATEGORIES: There are three categories of authentication that are easing solve password-failure-driven heart attacks: Password managers, single sign-on (SSO), and multi-factor authentication (MFA). Each category offers its own methodology and unique set of benefits — and drawbacks — to users.

PASSWORD MANAGER: A “password manager” is designed to have one password to rule them all. In a nutshell, passwords manaLgers generate, store, and “auto-fill” passwords for users who need only remember one master password. This way, it solves the key drivers of heart failures related to human error in authentication — such as inclination for short, weak, or patternised passwords, our tendency to reuse them, or forget them. For many, password managers have led to dramatic improvements in login experiences.

LIMITS: However, password managers are limited in scale. They do not work as authentication tools for larger user bases — like enterprises. While they are touted as a way to control employee password generation and use, they generally lack enforcement.

ANOTHER LIMITATION: Password managers cannot control how enterprise users create or interact with each password — they only suggest and lead them to the right direction — and only if or when they choose. Valuable time is also wasted by digital security staff sifting through false alarms from personal accounts that use enterprise password managers.

MUDDLED: Moreover, a clear view of the application inventory in a digital environment can be muddled through improper use or enforcement of password managers. One result: gaps are created by accounts not secured by a password manager, which lead to an unknown number of risks or threats.

ENTERPRISE SECURITY: As a rule, a good password and access management system is one that costs the least and causes the least disruption. Each user account hooked up to an enterprise environment represents significant risk and should be treated as such; an application with one user login can be just as risky as another with hundreds.

300 BILLION PASSWORDS: The world has become so accustomed to the necessity of passwords. They’re the entry point to the digital world, which gives every user a semblance of ownership. Globally, about 300 billion passwords are used — nearly 40 times the planet's population. 

CHALLENGE OF AUTHENTICATION: It will take a revolution in authentication before corporate users can find a viable alternative to passwords. Many have adopted biometrics (such as voice, fingerprint), and two-factor authentication system. But even two-factor authentication is not air-right: there are at least 5 ways it can be breached.

ALTERNATIVE SOLUTION? What’s the salvation for a password-weary world? No easy answers or solutions exist. Yet it’s a fact of file, and a fact of life: Many people grow weary of passwords, especially when one is obliged to change them often (quarterly?). Like them or not, passwords remain the most commonly used authentication method today. They seem to be the sole authentication method for enterprise systems and applications. There’s not much left in terms of choice. Best solution? Have a proper manual list of your passwords in a notepad. Don’t tell even your best friend where you keep that list. Otherwise, get ready for a password-driven heart failure.