"The question of how bad passwords are is more nuanced than it might appear at first"

Passwords are incontrovertibly awful, but - with the help of a huge US security agency - Davey offers some advice on making them less so

- DAVEY WINDER

Passwords, hate them or hate them, just won't die. Well, not quite yet anyway. That seems to be the takeaway from the latest RSA report into identity and authentication, and it really is, well, pants. Big flappy ones at that. While some 69% of organisations polled admitted to using outdated identity security systems, the more worrying statistic was that 90% said they were stalling in transitioning to passwordless solutions.

When I spoke to Anna Pobletts, head of passwordless technology at password manager developer 1Password - and yes, I feel the irony - a year ago she told me that “since we've used passwords for decades, they’re just too ingrained in our culture to go away overnight”. Pobletts wasn’t wrong then, and she’s not wrong now either.

So, I’m not going to cover old ground and bang on about how good passkeys are and how everyone should be moving to using them instead of passwords. You're probably fed up of hearing my broken-record whinging on that front. Instead, I want to look at just how rubbish passwords are, and how you can make them better if you can’t move away from them just yet.

Just how bad are passwords?

Actually, the question of how bad passwords are is more nuanced than it might appear at first. The classic piece of string comes to mind. There are really crap passwords, really crap password management processes (which oftentimes means none at all) and really crap password implementation from both the service provider or vendor and user perspectives. There are also password management, implementation and construction strategies, when served up as part of a multilayered authentication process, that are far from insecure. It's all a matter of getting it right, given what you have to work with.