One of the most important things to remember about security is that it is a process, not a product.  All too often, people think of security as a specific problem with a specific solution.  Unfortunately for us, security (in almost any context) is a moving target.  What was a strong password yesterday is weak today.  There are good reasons to require users to change their passwords, but it’s only part of the solution.  Forcing user’s to change their password too often invariably results in weaker passwords that are easier to remember.

To understand why this is a problem we first need to define what a strong password is and what makes one weak.  Numeric passwords are the worst as there are only 10^N possibilities where N is the number of characters.  Using letters is a little better as that’s 26^N for english.  Using both upper and lower case gives you 52^N, while a full alphanumeric set gives you 62^N.  Use of a full alphanumeric characterset on passwords 8-characters and higher was considered strong enough until recently.  After all, 218 trillion possibilities seems pretty large doesn’t it?  Considering some of today’s high-end graphics cards can perform over 2 trillion floating point operations per-second, breaking even a completely random 8-character alphanumeric password is trivial.  Adding the full set of special characters   on most english keyboards yields an additional 30 characters for 92^N or 5 quadrillion possibilities for an 8-character password.

You’re probably noticing a problem; we’re out of usable characters.  From this point on, the only way to increase password security is to make them longer and longer.  Obviously we can only keep up with this for so long before technology overtakes our ability to remember a secure password.  Clearly simple password-based security is insufficient for protecting anything of real value.  What’s needed is a multifactor system that uses 2 or more separate components to authenticate a user’s credentials.

A multifactor authentication system could be as simple as the combination of a password and a physical token such as a smartcard.  To authenticate, the user must insert the smartcard and type his or her password.  Either factor by itself will be rejected.  The beauty of this system is that any data protected in this way is inaccessible without each piece of the authentication puzzle.

A system is only as secure as its weakest link.  In many cases we humans are unfortunately that link.  We have limited memory and are vulnerable to social engineering attacks that get us to reveal sensitive information to complete strangers.  A strong password is useless if a user gives that password away or writes it down.  Adding a unique physical component to the equation raises the level of difficulty for an attacker significantly.