I think the first step is to replace the term "password" with "passphrase" (25-50 characters instead of 8), that helps to introduce users to the idea of a more secure password and helps to aleviate the most common security risks, pathetically guessable passwords and yellow stickies on monitors. When us (the admins of the world) can get users to follow that bit of logic reliably, then we can look at two-factor authentication. Hopefully in that timeframe the big corporations will put their heads together and agree on a common standard. Bill Gates isn't saying anything new with this epiphany, like someone else said, he's just restating the industry line and ignoring the fact that not too many crackers out there are using password attacks to get into Windows systems, at least not on the corp level.

Oh yeah, and he's promoting .NET Passports.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/277/29188#29188