by Martha Irvine

FILE – In this Feb. 27, 2013 photo illustration, hands type on a computer keyboard in Los Angeles. Frustration over passwords is as common across the age brackets. Bill Lidinsky, director of security and forensics at the School of Applied Technology at the Illinois Institute of Technology, recommends using a simple mental algorithm, including those that use a space, if a site allows that. (AP Photo/Damian Dovarganes, File) ( Damian Dovarganes )
INTERNET SECURITY
Cybercrime, hacking and other security coverage.
CHICAGO — Good thing she doesn’t need a password to get into heaven. That’s what Donna Spinner often mutters when she tries to remember the growing list of letter-number-and-symbol codes she’s had to create to access her various online accounts.
“At my age, it just gets too confusing,” says the 72-year-old grandmother who lives outside Decatur, Illinois.
But this is far from just a senior moment. Frustration over passwords is as common across the age brackets as the little reminder notes on which people often write them.
“We are in the midst of an era I call the ‘tyranny of the password,'” says Thomas Way, a computer science professor at Villanova University.
“We’re due for a revolution.”
One could argue that the revolution is already well underway, with passwords destined to go the way of the floppy disc and dial-up Internet. Already, there are multiple services that generate and store your passwords so you don’t have to remember them. Beyond that, biometric technology is emerging, using thumbprints and face recognition to help us get into our accounts and our devices. Some new iPhones use the technology, for instance, as do a few retailers, whose employees log into work computers with a touch of the hand.
Still, many people cling to the password, the devil we know — even though the passwords we end up creating, the ones we CAN remember, often aren’t very secure at all. Look at any list of the most common passwords making the rounds on the Internet and you’ll find anything from “abc123,” “letmein” and “iloveyou” to — you guessed it — use of the word “password” as a password.
Bill Lidinsky, director of security and forensics at the School of Applied Technology at the Illinois Institute of Technology, has seen it all — and often demonstrates in his college classes just how easy it is to use readily available software to figure out many passwords.
“I crack my students’ passwords all the time,” Lidinsky says, “sometimes in seconds.”
Even so, a good password doesn’t necessarily have to be maddeningly complicated, says Keith Palmgren, a cybersecurity expert in Texas.
“Whoever coined the phrase ‘complex password’ did us a disservice,” says Palmgren, an instructor at the SANS Institute, a research and education organization that focuses on high-tech security.
He’s teaching a course on passwords to other tech professionals later this summer and plans to tell them that the focus should be on unpredictability and length — the more characters, the better.
But it doesn’t have to be something you can’t remember. If a site allows long passwords and special characters, Palmgren suggests using an entire sentence as a password, including spaces and punctuation, if possible: “This sentence is an example.”
He also suggests plugging in various types of passwords on a website developed by Laguna Hills-based Gibson Research Corp. to see how long it could take to crack each type of password: https://www.grc.com/haystack.htm
According to the site, it could take centuries to uncover some passwords, but seconds for others.
Lidinsky recommends using a “simple mental algorithm,” including those that use a space, if a site allows that. As an example, he says one might try “Ama95 zon” for an Amazon account, and “Yah95 oo” for a Yahoo! account, and so on. (But choose your own combination.)
There are other ways around the password headache.
Some people have taken to using password generators, which create and store passwords for various sites you use. Generally, all the user has to remember is a master password to unlock a generator program and then it plugs in the passwords to whichever account is being used. There are numerous password managers like this, including LastPass and Dashlane and 1Password.
Some wonder whether it’s wise to trust services like this.
“But sooner or later, you have to trust somebody,” says Palmgren, who uses a password manager himself.
Other solutions are surfacing, too.
Researchers at the University of York in England are developing a new authentication system called Facelock that asks you to identify familiar faces to get into an account or device.
The Canadian government, meanwhile, has partnered with a company called SecureKey Technologies, which allows citizens of that country to log onto government sites, such as the country’s tax bureau, using a username and password from partner financial institutions, including TD Bank. Because SecureKey serves as the go-between, the system’s developers say the bank username and password are not ultimately shared with the government site. Nor does the bank receive any information about which government site the user is accessing.
SecureKey is now working with the U.S. Postal Service to provide American citizens with similar access to federal health benefits, student loan information and retirement benefit information.
Ultimately, experts say, reducing the stress of online security — and decreasing reliance on passwords — will rest on what’s known as “multi-factor identification.”
Those factors are often based on three things:
1. “What you know” — a password, security question or some sort of information that only you would know (but that doesn’t have to be difficult to remember, just exclusive to you);
2. “What you have” — a phone, tablet or laptop — or even a card or token — that an online site or tech-based retail outlet would recognize as yours;
3. “What you are” — biometric information, such as face recognition or a thumb print.
Banks could use this authentication process, for example, using cameras that already exist at ATMs, says Paul Donfried, chief technology officer for LaserLock Technologies Inc., a Washington, D.C.-based company that develops fraud prevention technology for retailers, governments and electronics manufacturers.
“We now have the ability to shift complexity away from the human being,” Donfried says. And that, he adds, should make the pain of the password disappear.
Back in Decatur, Spinner has to think about all that for a moment. It sounds rather daunting, she says.
For one, the issue of privacy is still being debated when it comes to biometrics.
But then Spinner considers the piece of paper that contains all her passwords — the one she typed that’s gotten so difficult to read because she’s crossed them out and created so many new ones.
“Anything to make it easier for those of us who are technology-challenged,” she says,” I would be in favor of.”