• From: John Cowan <cowan@m...>
• To: Pete Cordell <petexmldev@c...>
• Date: Mon, 30 Jan 2012 10:18:52 -0500

Pete Cordell scripsit:

> I'm surprised I'm in a minority of one on this.  I've snipped out lots of 
> comments in a reply, but my basic position is that we shouldn't be 
> adopting a "buyer beware" position when it comes to handling passwords 
> when we know there are better ways to do it, and we have known that for 
> the best part of a decade.

We (if by "we" you mean human beings collectively) have known for decades
that two-factor authentication (two of "what you have", "what you know",
and "what you are") is the minimum requirement for decent security.
In particular passwords are a crappy implementation of "what you know",
since people most of the time either don't know them (the post-it on
the monitor) or do know them and so can anyone else.

-- 
John Cowan      cowan@c...         http://www.ccil.org/~cowan
Statistics don't help a great deal in making important decisions.
Most people have more than the average number of feet, but I'm not about
to start a company selling shoes in threes. --Ross Gardler

• References:
  • Re: RE: Encoding charset of HTTP Basic Authentication
    • From: Greg Hunt <greg@f...>
  • Re: RE: Encoding charset of HTTP Basic Authentication
    • From: "Pete Cordell" <petexmldev@c...>