There are also some very horrible encrypted password managers, such as Gator, which we know are rife with spyware.

Let's not use a techno-crutch. What exactly is wrong with writing it down and putting it in your wallet? Would you leave your credit cards on your desk? As long as users understand the importance of safekeeping the password, I would rather they do that than call the helpdesk thrice weekly to have a password reset... in cases such as that they will do all they can to circumvent security (namely passwords). Our goal should not be to frustrate them, but to show how they can work within the system to effect security.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/220/25077#25077