Password

A password is a form of secret authentication data that is used to control access to a resource. The password is kept secret from those not allowed access, and those wishing to gain access are tested on whether or not they know the password and are granted or denied access accordingly.

Alternatives to passwords for access control

The numerous ways in which reusable passwords can be compromised has prompted the development of other techniques. Unfortunately, none of them has become universally available for users seeking a more secure alternative.

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

• Single use passwords. Having passwords which are only valid once makes many potential attacks ineffective. Most users find single use passwords extremely inconvenient. They have, however, been widely implemented in personal online banking, where they are known as TANs. As most home users only perform a small number of transactions each week, the single use issue has not lead to significant customer dissatisfaction in this case.
• Security tokens are similar to single passwords, but the value to be entered is displayed on a small fob and changes every minute or so.
• Access controls based on public key cryptography e.g. SSH. The necessary keys are too large to memorize and must be stored on a local computer, security token or portable memory device, such as a flash disk or floppy disk.
• Biometric methods promise authentication based on unalterable personal characteristics, but currently (2005) have high error rates and require additional hardware to scan, for example, fingerprints, irises, etc. Because these characteristics are unalterable, it can be difficult to reuse them if they are comprised, such as by unauthorized fingerprint lifting or close eye photographing.
• Single sign-on technology is supposed to eliminate the need for having multiple passwords. Such schemes do not relieve user and administrators from choosing reasonable single passwords, nor system designers nor administrators from ensuring that private access control information passed among systems enabling single signon is secure against attack. As yet, no satisfactory standard has been widely adopted.