Pete Cordell scripsit:
> I'm surprised I'm in a minority of one on this. I've snipped out lots of
> comments in a reply, but my basic position is that we shouldn't be
> adopting a "buyer beware" position when it comes to handling passwords
> when we know there are better ways to do it, and we have known that for
> the best part of a decade.
We (if by "we" you mean human beings collectively) have known for decades
that two-factor authentication (two of "what you have", "what you know",
and "what you are") is the minimum requirement for decent security.
In particular passwords are a crappy implementation of "what you know",
since people most of the time either don't know them (the post-it on
the monitor) or do know them and so can anyone else.
--
John Cowan http://www.ccil.org/~cowan
Statistics don't help a great deal in making important decisions.
Most people have more than the average number of feet, but I'm not about
to start a company selling shoes in threes. --Ross Gardler
