No wonder we get scammed so often

At least we aren't hiding in the hills!

Afraid to come onto the Info Highway

Consumers haven't truly taken stock off how much their passwords and access data are worth. They just want to ignore the issue. Like when you're sick and pretend not to be so you don't have to go to the doctor. ;)

New technologies, be they password managers or federated ID platforms, are going to have to take hold in the professional or business world first - where there's a clear idea of the worth of access data, the cost of not protecting it, and the costs of employees forgetting passwords.

Consumers may love Facebook connect. I doubt they would care much about the privacy concerns. I also doubt many enterprises would trust FB as the company SSO.

Now look how much damage I can do (all over the web) by just compromising your single FB account.

Guess who the new attack target for hackers will be....

And the solution is neither password strength nor continued fear.

The problem is _passwords_ and the solution is _stronger authentication._

@TheMindRelaxer, the vulnerability of a strong password is EQUAL to the vulnerability of a weak one if the threat is a keylogging trojan OR phishing (which are the two main threats.) Your recommendation is vapor.

The solution: choose one of the secure OpenID providers that secure the login with something above and beyond a password. Good choices are myVidoop.com (free) and myOpenID.com (paid.)

Let's look for solutions instead of fear. My grandmother died having never used a telephone using "logic" like the comments here.

Imagine a scenario where a malicious web service implements an innocent looking gmail/yahoo mail contact importer function just to harvest the login credentials. A certain percent of thoes email/password combos are also going to be used to log into fbook, paypal, myspace and the list goes on.

Or suppose a site that requires email/password regestrations is breached. If the hacker then takes every combo and trys automatic logging attempts on several of the popular sites without capchas then a percent of those combination will authenticate.

There was an emotional dam that was almost always breached when we asked about password management. We know from our data that by far the majority of US adults on-line are very frustrated with remembering and organizing passwords. We also know that the focus of their anxiety was largely financial value eg. hacking a bank account, BUT their attention is increasingly on social value eg. hacking into personal info, friends lists and health records. Finally we know that over a third of online adults have stopped entering a web site for fear of their IDs and passwords being compromised.

It is therefore a BIG problem (defined by size of population it affects + change in behavior it causes + commercial impact it has)and one we KNOW is not going to be fixed by password length, complexity or challenge questions.

The problem can however be resolved by an openID solution securing the login and authenticating the user without the hassle of conventional passwords - myvidoop is one way.

Until people feel there's a real risk of losing something of course we won't change. I use 3 passwords on the web - and in 15 years I've NEVER had an issue. Combine that with the confusion about so and so being an openID provider but not a consumer etc and the fact is that openID is a hassle and solves a problem that I don't need solved.

Finally, some of this is psychological. You can explain authentication until you're blue in the face, but for the regular web user having one set of credentials *feels* riskier. Like it or not, people relate this stuff to real world analogues like their keys etc...and who would have one key that opens every lock they use? No one.

And the idea that "People immediately understand what it means to sign in using their Facebook account", whereas they don't understand what it means to sign in using OpenID, just doesn't make sense, because the login flow would be *identical* in either case. The only difference in the OpenID case is that other accounts (like Myspace) could be used as well.

Count me among those who use the same password most everywhere. However, not all passwords are created equal. I use different ones for more important sites like banking, shopping, or my main email.

I wish I could read that Gartner study to understand what exactly was being measured. If I were in this survey, then it would show that I too am using a single password on 90% of the sites I visit. But am I being insecure? I don't think so.

Mostly, I think it's up to the users to understand security concerns and protect whatever they care most about.

Say you had a login at this site:
Username = forrester
Password = 4TheTree$

If you used this at all or the majority of sites you signed up with, then anyone who knows you use this combo here can then try this combo at all of the most commonly used webmail services, every online banking site, facebook, twitter, myspace, etc. and potentially have windows of opportunity for financial theft, identity theft, spamming on all of your channels, and all kinds of havoc.

Before usernamecheck.com went offline, there was a simple resource for determining where your username was registered at over 50 different websites. It wouldn't take a hacker much more work to write a similar script that does the same thing but also tries to authenticate using the same username/password at those and any other sites they would want to try to login to.

For myself, I try to manage my passwords like every one else. Not doing the best job.

But for one thing.

I have many EXISTING accounts far and wide across the web. Blogs. Forums. Shopping sites. Email. Website management for myself and for clients. And on, and on.

Not a single one of them will allow me to sign in to the EXISTING account with my EXISTING OpenID forever and forever, world without end, and forget the current username/password. My only recourse would be to establish a brand new account under the OpenID, and either re-enter or at least copy all info from the other account (and risk rejection due to existence of the other account).

For me, OpenID is not an option. At all.

Just because one is an OpenID provider, doesn’t mean that one supports signing on with it.

So, rather than being a bad news for OpenID, the fact that people uses the same password everywhere clearly establishes the case for a unified authentication system—good news for OpenID.

So, rather than being a bad news for OpenID, the fact that people uses the same password