I had a talk in 2005 and the person was saying passwords belonged to the past. 2014 and we're still there: Why?
- We have browserside certificates. Granted they're not sexy.
- We have logins by email tokens. After all, that's how to do password recovery anyway, so why not promoting password recovery to the normal login?
- We could have thousand kinds of SIM or USB passwords, such as YubiKey, which would have features like, you only auth while it's in the slot.
Instead the last gov website I've used to declare my payroll employees takes the birth date as the default password. And so many others accept my mother's maiden name as an authentifying proof.
- We have browserside certificates. Granted they're not sexy.
- We have logins by email tokens. After all, that's how to do password recovery anyway, so why not promoting password recovery to the normal login?
- We could have thousand kinds of SIM or USB passwords, such as YubiKey, which would have features like, you only auth while it's in the slot.
Instead the last gov website I've used to declare my payroll employees takes the birth date as the default password. And so many others accept my mother's maiden name as an authentifying proof.
How did we get there?