The digital revolution has completely revamped the way business and personal life are conducted, but with a cost: identity theft is at an all time high. In the old days, the most that people stole was your social security number. SSN theft typically lead to a rash of credit card grievances for the victim, from which they might never recover, as the government doesn’t re-issue SSNs.
As life itself shifts towards the online world, more of your life is up for grabs, and with less difficulty to steal. Nowadays, everything from online banking to message board accounts are vulnerable, leaving a would be victim with so much more to lose. Now, it’s not just your credit that gets dragged through the mud: so also go your name and all your hard earned money.
One of the biggest problems with this is the proliferation of passwords. Before, one might remember basic useful information, like social security number, mother’s maiden name, or *gasp* a PIN. In the online world, however, passwords are king, and with every site out there requiring registration, people are forced to remember more things just to get around. Got email? Got instant messaging? Shop at a few different sites? Read the news online? You can easily rack up several dozen passwords in a short time, and it’s harder than ever to remember everything.
So what’s one to do? Supposedly, you’re supposed to come up with incredibly difficult passwords to guess, and use a different one for each place you go. Somehow, this is preferable to using easy to remember passwords, or even the same hard password. Yet, the human mind doesn’t work that way. Remembering three difficult passwords is okay for the common person. Remembering a couple dozen is not so good. A Microsoft tech manager even suggested that people write down their passwords, which in the security field, is a no-no.
It’s a growing problem. You can’t use unchangeable metrics, such as a fingerprint, because someone could steal that and have access to whatever else is so protected for life (kind of like the SSN issue). You can’t use easy to remember facts, because hackers prey on that, so your favorite pet’s name or first girlfriend are out. You’re supposed to mysteriously come up with complex gobbledy-gook passwords on the fly, and remember them.
The solutions to this vary. Bruce Schneier’s Password Safe is an encrypted place to store all your passwords. Solutions such as SplashWallet allow you to keep your passwords on a Palm PDA. The idea is simple: if you have to keep a lot of passwords, you might as well keep them easily available in an encrypted format, so that you only need to remember one password, and can ignore the rest. This is okay until you find yourself away from the vault, and have to generate a password on the fly. Then it’s back to square one, remembering a password.
Another solution is to generate passwords based upon the site you visit. For instance, if you visit example.com, make your password some hash of the site name, such as take every other letter of the domain name, and add ‘pass’ to the end, e.g. ‘eapepass’. This is a terribly insecure password, but allows you to generate different passwords per site.
Yet another solution is to create a hard to guess password, and then use it everywhere. This is all fine and good…until just one of the sites you’ve visited gets hacked, and their unencrypted back end lets your password rosetta stone out into the wild.
Identity validation is basically a problem that rises at the same pace as identity theft: how does one verify identity, without crushingly difficult usage for the end user? There’s no good solution now, and no good solution in the near future. Until vendors as a baseline of business consider your information as extremely sensitive data and take measures to ensure its security, it’s a bit of a crapshoot as to whether or not you’re safe on whatever site you might peruse.
The best we can do is to be as safe as we can, use as much security as is not too inconvenient, keep a close eye on what information you give out, and wear our tinfoil hats while generating what we hope are sufficiently strong passwords. There’s a real problem with security these days, and unless you want to go off the grid, you’re going to have to make do with what we have. I just worry for the less computer-savvy: no one takes them by the hand and shows them what’s possible. Let’s hope our technology catches up before they experience serious problems.