Re: [xml-dev] RE: Encoding charset of HTTP Basic Authentication

[John Cowan <cowan@mercury.ccil.org>]

Pete Cordell scripsit:

> I'm surprised I'm in a minority of one on this.  I've snipped out lots of 
> comments in a reply, but my basic position is that we shouldn't be 
> adopting a "buyer beware" position when it comes to handling passwords 
> when we know there are better ways to do it, and we have known that for 
> the best part of a decade.

We (if by "we" you mean human beings collectively) have known for decades
that two-factor authentication (two of "what you have", "what you know",
and "what you are") is the minimum requirement for decent security.
In particular passwords are a crappy implementation of "what you know",
since people most of the time either don't know them (the post-it on
the monitor) or do know them and so can anyone else.

-- 
John Cowan      cowan@ccil.org         http://www.ccil.org/~cowan
Statistics don't help a great deal in making important decisions.
Most people have more than the average number of feet, but I'm not about
to start a company selling shoes in threes. --Ross Gardler