You mention that a problem with passwords is that they don't uniquely identify anyone. This is true, but how much easier is it to steal someone's thumbprint or smart card? If my wallet gets stolen, now I have to worry about credentials being compromised as well.

The only way for passwords to be stolen is through user laziness - very easy passwords, passwords written down, etc. Yes, this is common, but by using authentication based on physical properties, those credentials themselves are inherently portable and more succeptible to compromise, in my opinion.

You make many good points, however "something you know" is only portable if you make it so.

I actually found this amusing, as I wrote the exact opposite opinion in my infosec blog around the same time, prior to reading your column (http://www.cloppert.org/blog).

Regards,
Michael Cloppert

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/277/29201#29201