Passwords have been used for centuries but, according to some, their days are numbered. Bill Gates, for example, believes that arming everyone with yet more complex technology will make electronic transactions safer. While this may be true for those prepared or able to use such technology, there’s a lot more that communications networks can do to take the strain and keep things simple, argues Richard Baker, BT’s chief identity architect.

Every day for the past 700 years, a password ritual has been enacted at the Tower of London. At seven minutes to 10 o’clock every night, the Tower is locked down by the Chief Warder who is then challenged by a sentry to provide the right password. The dialogue runs:

Sentry - “Who goes there?”

Chief Warder - “The Keys”

Sentry - “Whose Keys?”

Chief Warder - “Queen Elizabeth’s Keys”

Sentry - “Pass Queen Elizabeth’s Keys.

All’s well.”

But all is far from well in the modern world. Passwords have become a currency amongst criminals who attack banks, businesses and individuals to steal cash and other assets. 

In our digital world, the majority of electronic transactions and security procedures are ‘protected’ by user name and password authentication.

Many people use the same password for everything while others use a different password for each system. Both approaches have serious weaknesses. The first enables a hacker who has successfully captured a password to tamper with not just one but all of a victim’s electronic accounts. The second requires people to remember dozens of different passwords and change them regularly. Understandably, people often forget their passwords, write them down or simply enter the wrong one, increasing the burden on helpdesks.

Beyond passwords, there are approaches to authentication that have previously been considered a ‘Gold Standard’. In reality, though, nothing is foolproof and there always has to be a trade-off between security, usability and cost. There’s no point, for example, in a bank spending a fortune on a system that is too cumbersome for its customers to use – such a system might drive customers away.

An appropriate level of investment, however, is essential to manage the risks involved in a rapidly evolving threat landscape. Fraud, money laundering and the financing of terrorists are activities carried out by ‘professionals’ who work to a business case just like any legitimate organisation. Fighting them involves working to a business case that has the opposite objectives and ensuring you are sufficiently fleet of foot to outwit the bad guys.