- FBI warns Hit Man e-mail scammer back
- 20 tech habits to improve your life
- Industry mourns slain Cisco exec
- 10 Firefox add-ons for better browsing
- Wireless LANs face scaling challenges
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:App Performance | On Demand Security | Networking Solution | SOA | Value of WDS
What is the solution to the growing number and risks of the identities that are now connected with us all? Will a simple identity trust framework be part of such a solution? How will users be able to reduce the number of passwords they have to handle? This article will attempt to explore these questions.
One of the growing frustrations of the Internet is the number of password-based identities that we, its users, are required to accept. This is leading to a new kind of identity risk. The average Internet user is likely to have upwards of 50 identities. Because we are not very good at remembering that many different unique/strong passwords, we are likely to re-use passwords across different sites. Furthermore, these sites are not all capable of protecting our passwords to the same degree. Worse, we do not regularly keep changing passwords, which serves to exacerbate the problem. How can we effectively manage the security and currency of so many passwords for so many identities? Simply put, we cannot; at least not securely!
Why should I care?
Different Web site suppliers ask us to share different personal details. This enables someone with a criminal intent to harvest our identities by cracking a weak site and then using the identities and passwords obtained to visit different sites and extract further personal details. Often, as a treat for the hacker, we have allowed the Web sites to store our credit card details. Some sites even openly display the credit card numbers to the accredited user. Sites that don’t display numbers often allow products and services to be obtained and sent to alternate locations. It won’t be long before we see automatic harvesting using this approach – if it isn’t already being used.
Accepting that pass-phrases are more secure than passwords, we can immediately start reducing our risk by introducing simple methods that enable us to use different pass-phrases on each site, rather than passwords. It is, however, important that such approaches are not obvious. For example if a hacker finds that your pass-phrase on the Google site is: “mycorepassword?google!”, it will not take him long to work out your password for the PayPal site, despite it looking like a strong password.

Aging network systems and old habits have dictated how businesses spend their IT budgets. As a...
Implementing HA at the Enterprise Data Center Edge to Connect to a Large Number of Branch OfficesThis paper reviews the problem of creating a network where the dynamic availability of services is...
Enterprise Data Center Network Reference ArchitectureUsing a High Performance Network Backbone to Meet the Requirements of the Modern Enterprise Data...

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...
Harnessing the power of communications to increase workplace performanceDue to the convergence of IT and telecommunications technologies, the business workplace has been...
Stay out of the headlines: Detecting and preventing network intrusionsHow do YOU stay out of the headlines? There is no denying that risk exists in our computer-driven...

We have so many holes punched in our firewalls today that many industry insiders question the value...
IP address management in 2008 - six things to knowRead this Network World Special Brief to learn how Enterprise IT managers must update their...
The self-managed networkWe aren't there yet, but advances in network and systems management tools are making it possible to...
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask to prospective vendors to get the right endpoint solution.
Download the white paper.
Unauthorized applications: Taking back control
Employees installing and using unauthorized applications like IM, VoIP, games and peer-to-peer file-sharing applications cause many businesses serious concern. How do you control these applications?
Download the white paper.
Comment