We need an alternative to passwords because people are idiots

Most of us have enough personal information stored on our devices and online accounts that a malicious hacker could do some serious damage to our lives if they were to get their hands on it, and the only thing preventing them from doing that is an 8-16 character password. That’s why it’s important to make sure your passwords are strong, and that you’re taking advantage of things like multi-factor authentication to make your devices and accounts more secure. Unfortunately, the majority of people still refuse to take their digital security seriously, which is why researchers have been working to find an alternative to passwords that can guarantee digital security, no matter how ignorant people are of its importance.

I’ve been working in security research for twenty years, and as much as things have changed in that time, some challenges have persisted. When I think of today’s vulnerabilities, authentication — making sure only the right people get access to the right information — tops that list. This subject might seem pretty basic compared to more headline-grabbing security issues. But in recent years authentication problems have become much more pervasive, complicated and important. We’ve seen an explosion of people accessing the Internet from all sorts of new devices, both as individuals and behind corporate firewalls, and those access points remain primary targets for bad actors wielding advanced phishing techniques. With hundreds of thousands of attacks now occurring per day, we can’t solve this problem on a case-by-case basis; security today is about automation and scale, and a big first step is helping people keep themselves safer. At Google we’ve long been proponents of two-step verification, or 2SV, which adds an extra layer of protection even if someone has your password (and we’re glad this morning to learn that the President agrees).