Passwords are not secure! The solution for developers
By: Nishant Upadhyay
Tags: Startup, Paas, Privacy, Authentication, Developers Update

The Problem

WHEN THE COMPUTER security company Hold Security reported that more than 1.2 billion online credentials had been swiped by Russian hackers, many people were worried — -and justifiably so. Hold isn’t saying exactly which websites were hit, but with so many credentials stolen, it’s likely that hundreds of millions of ordinary consumers were affected.

Some of these may be incredibly complex passwords — -with lots of jumbled numbers and symbols. And some may be incredibly simple — -using just the simplest of English words, like, say, “password.” But after the hack, most all of them have left their users vulnerable to attack. According to Alex Holden, Hold Security’s founder, the “vast majority” of the passwords he uncovered had been stored in plain text on company servers.

What this shows that a complex password isn’t necessarily a secure password. As the wired have written before, password systems have a very annoying way of putting most of the hard work onto the shoulders of the users. You’ve got to mix up a jumble of numbers and letters (some in capitals, please) and special characters. Some passwords time-out after 90 days, forcing you to reset them. But that doesn’t mean they’re that much safer than simple passwords.

Read this to: Harsh truth of Digital India

Some of our ideas about passwords date back to the 1980s, when the National Institute of Standards and Technology came up some guidelines for creating secure passwords for local area networks. Back then, they’d mail them out to interested computer security types via U.S. Post. Now, NIST is trying to help the U.S. move beyond the password, says Donna Dodson NIST’s chief cyber security advisor. “Putting the burden of security on the end-user and making it more complex just doesn’t work,” she says. “The security has to be usable for the end-user. Otherwise they’re going to find workarounds.”

In some situations, a complex password can help you. But in others — -like when the company holding your password stores it in plain text, without encrypting it — -that complexity is meaningless. And some passwords may seem complex, when they’re actually pretty easy to guess. They can trip you up, even if they’re stored using cryptographic techniques, when someone hacks into the machines that they live on. The lesson here is that system administrators — -the people who oversee all those password rules you have to follow — -need to shoulder a bit more of the work. They need to better understand what makes a secure password — -and how passwords should be stored.

“Everyone is confused in this space,” says Cormac Herley, a Microsoft researcher who’s been studying passwords for years. System administrators will lay down rules for passwords but often, “we don’t know half of why we’re doing this stuff.,” says Herley. And they may not realize they should be spending their time securing systems in other ways.

Either way, pinning your security on an insanely complex password is a fool’s wager. Just ask the people running the airline, travel and social networking sites that got hacked by Alex Holden’s Russian hackers. “Why are we burdening users with demands to chose stronger and stronger things with the goal of withstanding increasingly sophisticated guessing attacks when 1.2 billion credentials are just spewed from servers that are improperly protected,” says Herley. “That seems like a big waste of effort.”

The Solution for Developers

The solution's are ranked on basis of how easy it is for developers to implement: