Experts Say It's High Time We Stop Relying on Passwords

Open sesame!

Key Takeaways

  • Cybersecurity experts suggest that passwords, by themselves, should no longer be considered adequate for securing accounts.
  • Users should enable multi-factor authentication (MFA) wherever possible.
  • However, MFA shouldn’t be used as an excuse for creating weak passwords.
Someone logging into a laptop computer using two-factor authentication on their smartphone.

Oscar Wong / Getty Images

The strongest of passwords and the most stringent of password policies aren't of much use when your online service provider leaks your credentials due to a misconfiguration in their servers. 

If you think such an eventuality would be a rarity, know that many of the biggest data leaks in 2021 were due to technical gotchas by the service providers. In fact, in December 2021, cybersecurity experts helped plug such a misconfiguration in the Amazon Web Services' S3 bucket owned by Sega, which contained all kinds of sensitive information, including passwords.

"Password use should become obsolete, and we should look for different ways to log into accounts," CEO of security vendor Gurucul, Saryu Nayyar, told Lifewire via email.

The Problem With Passwords

In December, The Sun reported that the UK's National Crime Agency (NCA) supplied over 500 million passwords to the popular Have I Been Pwned (HIBP) service, which it had uncovered during an investigation. 

HIBP enables users to check if their passwords have been leaked in a breach and are prone to abuse by hackers. According to HIBP's founder, Troy Hunt, over 200 million of the passwords supplied by NCA didn't already exist in the database

"Although the account credentials storing feature of browsers is very convenient... users are recommended to refrain from using it."

"It points to the sheer size of the problem, the problem being passwords, an archaic method of proving one's bonafides. If there was ever a call to action to work towards eliminating passwords and finding alternatives, then this has to be it," Baber Amin, COO of digital identity experts, Veridium told Lifewire via email, in response to the NCA's recent contribution to HIPB.

Amin added that leaked credentials don't just compromise existing accounts, as hackers now use them with AI-based analytical tools to identify patterns of how an individual creates passwords. In essence, leaked credentials jeopardize the security of other non-compromised accounts as well.

Passwords and More

Advocating for a better protection mechanism than passwords, Nayyar suggests that users who have the option to set up multi-factor authentication on their accounts should do so. 

Ron Bradley, VP of Shared Assessments, a membership organization that helps develop best practices for third-party risk assurance, agrees. "Turn on multi-factor authentication everywhere possible, especially apps that move money."

Securing an account with a password alone is known as single-factor authentication. Multi-factor authentication or MFA builds on top of that and secures accounts by adding an extra step into the sign-in process by asking users for another piece of information. Many services, including several banks, implement MFA by sending a verification code to a user's mobile number registered with the bank.

An illustration of a laptop and smartphone using two-factor authentication.

Mark Kolpakov / Getty Images

However, this verification mechanism is prone to an attack mechanism known as a SIM swap attack, where attackers take control of a target's mobile phone number by tricking the owner's carrier into reassigning the number to the attacker's SIM card.

While acknowledging such an attack that targeted some of its customers, T-Mobile said that SIM swap attacks have become a common and industry-wide occurrence.

Instead, a better option for enabling MFA is by using apps such as Duo Security, Google Authenticator, Authy, Microsoft Authenticator, and other such dedicated MFA apps.

Password Sprawl

However, all the cybersecurity experts we spoke to cautioned that using MFA shouldn't be an excuse for not taking adequate steps to secure the passwords. 

"Be a part of the one-percenters that have no idea what their bank password is because it's too long and complex," advised Bradley.

He adds that users should consider investing in a password manager when it comes to passwords. While there's no shortage of free password managers, and there's one built into your web browser as well, experts suggest that a free password manager is better than not having one at all, but users should exercise caution when using one.

"Be a part of the one-percenters that have no idea what their bank password is because it's too long and complex."

While investigating a recent breach of one company's internal network, cybersecurity researchers from AhnLab discovered that the VPN account used to break into the company network was leaked from the PC of a remote working employee.

This PC was infected with various malware, including one designed specifically to extract passwords from the password managers built into Chromium-based web browsers such as Google Chrome and Microsoft Edge. 

"Although the account credentials storing feature of browsers is very convenient, as there is a risk of leakage of account credentials upon malware infection, users are recommended to refrain from using it," warn the AhnLab researchers.

Was this page helpful?