Name: The tyranny of passwords – is it time for a rethink?
Brand: theguardian.com
SKU: theguardian-com-885
Availability: OnlineOnly

critic

The tyranny of passwords – is it time for a rethink?

preview

They are elusive, infuriating gatekeepers that rule our lives. Easy to crack and hard to remember, forgetting them is pricey – it cost Stefan Thomas £160m in lost bitcoinLast modified on Tue 6 Apr 2021 07.03 EDTThe tyranny of passwords; it colonises modern life. These petty dictators deny us access to our bank accounts, our baby photos, our phone contracts, even our heating. They reproduce as endlessly as bacteria, and yet, like Tupperware lids, you can never find the one you need. They are our boyfriends, our girlfriends, our children, our pets. A talented and motivated adversary could probably work yours out in the time it has taken you to read this paragraph.Most of the time, not being able to remember your password is merely irritating. But sometimes, password amnesia can be life-altering. After going public with his account of losing the password to around $220m (£161m) worth of bitcoin, German programmer , 33, sparked a conversation around passwords, loss, and how you grieve a fortune you’ll never get back.Thomas had three copies of his bitcoin passwords saved on hard drives and a USB stick, but the first two versions failed due to software updates, and the USB stick is password protected. If Thomas enters the password incorrectly 10 times, the data wipes. He has two attempts left, and he can’t remember the password. When we speak, Thomas is remarkably sanguine. “There are some days where I’m almost grateful for it,” he says cheerfully.“There were weeks where I would lie in bed, looking at the ceiling, just completely desperate,” he says. “I’d spend hours trying to think of ways to recover the data, jump up, run to my computer and try it and then it wouldn’t work, so I’d go back to staring at my ceiling.” Eventually, he decided: enough. He climbed out of bed, and forged a career in technology, before founding his own company, .Not everyone can move on from such a wringing loss. “I’m coming up against a brick wall,” says , his voice rising. “They don’t even want to have a conversation with me about it! Which is so silly, given the valuation.” He is referring to Newport city council, owner and operator of the rubbish tip into which he accidentally slung a hard drive containing the key to the bitcoins he’d mined in 2009.The bitcoins are now worth £210m, and the 35-year-old cryptocurrency trader from Newport is so desperate to get them back he’s offered 25% of his haul, or £50m, to Newport city council. The council has declined Howells’s offer repeatedly over the past eight years, due to the cost.As gently as possible, I ask if it might be better to let this go? “I’m just looking for an opportunity to search for what belongs to me,” he says, sounding wretched. “And I am willing to share it. But it’s hard to accept it’s gone without being given the opportunity to search. Knowing the hard drive’s there, and there’s still a chance.”We lose things; we forget. It is in our nature, it’s what makes us human. “The art of losing isn’t hard to master,” observed in her poem One Art. Life is a continual surrendering to loss. Some fare better than others: for every Thomas, there is a Howells. “Lose something every day,” Bishop writes, and we oblige her. We lose coats, books, bags, phones, friends, money, loved ones, mobility and eventually, ourselves. Most of all, we forget our passwords. The average person has close to 80 passwords, hardly any of which they remember.Technology companies have become the custodians of vast tranches of personal data, which they protect for us and mine for profit. I forgot the password to my Google photos album for many years, and then I got a new phone and it did that miraculous thing new phones often do and somehow logged me in. My life in 2013, preserved in aspic. It was jarring to realise that Google remembers more about my life than I do.Because passwords are tedious, humans are very bad at them. “There are literally billions of passwords breached every year,” says Gerald Beuchelt of the password manager LastPass. “It’s a total epidemic. It’s happening on a daily basis.” A Google/Harris poll from 2019 found that 52% of people reuse their passwords across multiple accounts, which is very bad security practice.“The best password is a random password,” says password researcher professor Lorrie Cranor of Carnegie Mellon University. “But people aren’t good at generating random passwords or remembering them.” Almost everything you intuitively believe about passwords is not correct. “If you struggle to remember your passwords,” Cranor says, “write them in a notebook and hide it at home. It’s highly unlikely that a hacker is going to get access to your house.”According to research published by the Garner Group in 2017, 20-50% of all IT helpdesk calls are for password resets. “It’s the biggest overhead on IT helpdesks,” says Siân John, a cybersecurity strategist at Microsoft. “It’s usually in the first week of January, or after the summer holidays – people go on holidays, come back and forget their passwords.”The average person has close to 80 passwords, hardly any of which they can rememberOur passwords reveal a humanity that is much more shared than we think. “We all think alike,” says Cranor, “and we all do similar things, in creating passwords. People think they are being smart by going diagonally on the keyboard,” Cranor says. “But it’s in all the hacker dictionaries.” John used to play a game where she’d ask her friends five questions, before guessing their passwords. “I’d ask them their parents’, siblings’ and children’s names, anniversaries and birthdays, their pet’s name, and their favourite sporting team,” she says. “I’d usually get 70% of them right.”We would not leave the door to our house open and yet many of us leave our digital accounts vulnerable to cybercriminals every day, because of our laissez-faire attitude to password security. Sometimes, criminals access accounts using personal information a person has shared online, or matching passwords from previous data breaches but, increasingly, hackers also use brute-force software – programmes which match thousands of dictionary words until something fits. “You can brute force most eight character passwords within 10 minutes,” says Beuchelt.The World Economic Forum estimates that cybercrime costs the global economy $2.9m every minute. Around 80% of those attacks are password-related.Matt Hall, a 44-year-old electrician from Walsall, lost his £52,000 life savings through a password breach. He was in the process of buying a house in October 2019 when an email from his solicitor was intercepted. Fraudsters replaced his solicitors’ bank details with their own. “It was the worst day of my life,” he tells me, “apart from losing family members.” Barclays, has yet to refund his money. Hall isn’t sure if it was his email that was hacked, or his solicitor’s – he insists his password was secure. Still, he changed all his passwords after it happened. What are they like now, I ask? “Strong!” he jokes.Modern society’s insistence on password protection can be disenfranchising for older people, who find the number of passwords they’re expected to memorise bewildering. “She doesn’t hear the questions on telephone banking because she’s hard of hearing,” says Anashua Davies of her mother, Dima, who is 84, “and then she forgets her password and tries to put the wrong code in.” Davies often has to help her elderly parents get back into their accounts. Last year, Davies had to drive Dima to the bank because she locked herself out of her telephone banking. She doesn’t blame the bank for having strict security protocols. “People are out there trying to steal from other people,” Davies says. But she wishes there was a way of making things easier. “It’s unfortunate for people like my parents, who don’t have the technology skills to keep up.”There is a solution to all this chaos and confusion: a password manager. “These are apps or small pieces of software,” says Beuchelt, “that store all your different usernames and passwords in secure vaults.” A password manager like LastPass (Google also has a version) will randomly generate impenetrable passwords for all your various accounts, and store them for you. “All users need to do is remember your master password,” says Beuchelt, “and LastPass remembers the rest.” It’s the equivalent of having a book in your house, with all your passwords written in it – only digital and highly secure. Of course, your master password needs to be extremely strong: LastPass recommends a minimum of 12 characters, but the longer the better. A long passphrase, composed of random words, numbers and symbols, that is pronounceable – meaning you’re likely to remember it – but doesn’t use personal information, works best. LastPass doesn’t store its users’ passwords centrally, meaning that even if hackers were able to get into their internal systems they wouldn’t be able to break into accounts. “That gives users the highest degree of security you can get,” says Beuchelt.Before speaking to Beuchelt, I’d viewed people who use password managers with a sort of horrified respect. Who has the foresight to endure the tedium of setting one up? But after speaking to Beuchelt, I’m a convert. I spent a rainy weekend afternoon setting up LastPass.But wouldn’t it be even better to never have to remember another password again? That day is almost nigh. “We’re on the cusp of a passwordless future,” says John. “I’d say, for the ordinary consumers, passwords will be gone within the next two to five years.”The solution is biometrics. The Israeli start-up BioCatch has developed software that can analyse the unique way a person drags their mouse, and use it to catch cybercriminals impersonating users. Other firms are developing technology based on the unique contours of a person’s ears. It is also possible to use the accelerometer sensors that detect motion in smartphones to identify users, based on the way they hold the phone. “We will have a constellation of biometrics,” Cranor says, “not just your fingerprint, but your voice, how you hold your phone and your gait.”I ask Google’s security and identity director Mark Risher whether Google is developing hi-tech alternatives to fingerprint and face ID. He says not. “We want to be equitable because we have users in every country. Fingerprint sensors are cheap now and robust. Technology like ear prints and breath detectors are more esoteric – they’re still at the science project stage. As the technology becomes more mainstream, we’re hoping to invest in it.”The key to integrating biometric data into our lives smartly is to ensure the data never leaves the device. “I love biometrics if they are local,” says Beuchelt. “If they’re on your own phone or laptop and the information isn’t shared anywhere else, that’s good biometrics… Giant centralised databases in India or China – that’s not good. Then you end up creating extremely sensitive databases that are incredibly valuable to cybercriminals and oppressive regimes.” You can change your password, but you can’t change your face.The tyranny of passwords – it is coming to an end. We may soon move seamlessly through life, unencumbered by passwords, like an ermine-wearing oligarch with a chauffeur opening doors. Until that day we labour on, brows furrowed, fingers typing in hope, before an endless flashing computer screen that reads “access denied”.

They are elusive, infuriating gatekeepers that rule our lives. Easy to crack and hard to remember, forgetting them is pricey – it cost Stefan Thomas £160m in lost bitcoinLast modified on Tue 6 Apr 2021 07.03 EDTThe tyranny of passwords; it colonises modern life. These petty dictators deny us access to our bank accounts, our baby photos, our phone contracts, even our heating. They reproduce as endlessly as bacteria, and yet, like Tupperware lids, you can never find the one you need. They are our boyfriends, our girlfriends, our children, our pets. A talented and motivated adversary could...

public

I write features mostly for @guardiang2 and am a Guardian angel for @gdnsaturday. Want to do something nice for a nice person? 📧 guardian.angel@theguardian.com

Sirin Kale

TheGuardian.com, formerly known as Guardian.co.uk and Guardian Unlimited, is a British news and media website owned by the Guardian Media Group. It contains nearly all of the content of the newspapers The Guardian and The Observer, as well as a substantial body of web-only work produced by its own staff, including a rolling news service.

The tyranny of passwords – is it time for a rethink?

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS