April 11, 2005, 12:21 PM — How many passwords do you have? 10? 20? More? If you are like me, I am sure the answer is "too many". The problem with passwords is that they are inversely useful. They have to be complex to be secure, but they have to be easy enough to remember, or users have to write them down. From ATM pin codes to voice mail passwords, network passwords and even encryption pass phrases, passwords are one of the most frustrating items that users encounter.
New studies are showing that weaker passwords may be more secure for this very reason. It seems that attackers are more likely to exploit passwords that are written on sticky notes than passwords that they can guess or sniff off the wire. To traditional security thinkers, this seems like madness, but Gartner and other research firms are beginning to claim it is simply the mathematics of life in the cyber-age.
One alternative that has become increasingly popular is to deploy a password vault for your users. Passwords vaults are password simplification tools for users. The idea is simple. They are software packages that store passwords in a secure fashion. Your users enter their logins and passwords and then access them as needed for use. The entire password database is protected by some form of authentication, usually a password, and encryption. The winning point here is that users only have to remember one password - the one for the password vault. The machine does the work of remembering the rest.
Password vaults come in many flavors and run on platforms from cell phones and PDAs to all the various operating systems in common use today. They vary in security as well, from paranoid use of authentication and draconian access rules to easily circumvented and only slightly better than a sticky note. Thus, it is common in organizations using password vaults to identify one particular product and support that product in a secure configuration.
One password vault that is receiving quite a bit of attention and has been getting good reviews is "KeePass". KeePass is an open source password vault for Windows. It appears to be developed with attention to security and features some very useful functions, such as cut and pasting of passwords with a clipboard wipe after a few moments, strong encryption and the ability to access password databases stored on network servers instead of local hard disks. If this technology interests you, KeePass might be a good place to start looking.
Since passwords are unlikely to go away in the future, and we are likely to continue to get more and more, password vaults may represent a middle of the road solution between simplified password practices and the security your organization is seeking. With a little education and training, your users may actually thank you for helping them simplify their lives. Now all we have to do is handle the users that write their password vault passwords down on sticky notes
