News: 1620348779

Google has marked World Password Day by declaring "passwords are the single biggest threat to your online security," and announcing plans to automatically add multi-step authentication to its users' accounts.

A mere eight years after Intel [1]began promoting World Password Day as a way to raise awareness about the importance of strong passwords, Google is ready to wipe them from memory.

At the 2004 RSA Conference, Microsoft co-founder Bill Gates [2]predicted passwords would become less important in the years ahead. The Windows biz has pushed to make that happen by supporting [3]FIDO2 security keys for authentication and switching to token-based authentication to approve git operations [4]on GitHub , among other initiatives. But the password, like email, has so far defied its death watch.

[5]

[6]

[7]

Google's product management director Mark Risher, in [8]a blog post this week, noted that 66 per cent of Americans admit to using the same password across multiple sites, which is an ill-considered security practice. Account databases do get compromised, and any username and password so exposed can be easily fed to a bot that will try the combination out at popular websites, a technique known as credential stuffing.

And let's not forget that in 2017, a Google software engineer said [9]less than 10 per cent of active Google accounts were using two-step authentication.

[10]Crane horror Reg reader uses his severed finger to unlock Samsung Galaxy phone

[11]HashiCorp reveals exposure of private code-signing key after Codecov compromise

[12]Volunteer-run pirate Manga website attacked, loses hashed passwords, has ‘nobody’ to fix the mess

[13]UK's National Cyber Security Centre recommends password generation idea suggested by El Reg commenter

Today, Google has taken its two-step verification program (2SV) up a notch. This process, however, still involves passwords – entering your password is the first step.

It's also the second step, though it's not called a password in this context. Rather, it's a on-off, time-limited authentication code or token sent to the user's mobile device or generated via mobile app software or hardware or via a dedicated security key. It may even be a backup code printed out long ago just in case the second-factor device is unavailable.

In any event, authenticating using something you know and something you fleetingly have is more secure than just relying on " [14]solarwinds123 " or the like.

[15]

So it is that Google plans to make this two-step verification (2SV) ritual obligatory for those who have revealed enough about themselves and their possessions to the Chocolate Factory.

"Soon we’ll start automatically enrolling users in 2SV if their accounts are appropriately configured," explains Risher. "Using their mobile device to sign in gives people a safer and more secure authentication experience than passwords alone."

Nonetheless, Google isn't done with passwords, having built its Password Manager into Chrome, Android, and more recently iOS, and welded the code to its one-click Security Checkup, which alerts users when passwords have been publicly exposed, when they've been reused across multiple sites, and when they're too short or otherwise weak.

[16]

"One day, we hope stolen passwords will be a thing of the past, because passwords will be a thing of the past, but until then Google will continue to keep you and your passwords safe," said Risher.

One day, [17]all your base are belong to us . ®

Get our [18]Tech Resources



[1] https://itpeernetwork.intel.com/password-day/

[2] https://www.theregister.com/2004/02/25/who_needs_passwords/

[3] https://www.theregister.com/2020/02/25/fido2_azure_ad_hybrid/

[4] https://www.theregister.com/2020/12/17/github_bans_passwords/

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YJS7WdcZD5AgOv2nQCYs7QAAAII&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJS7WdcZD5AgOv2nQCYs7QAAAII&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJS7WdcZD5AgOv2nQCYs7QAAAII&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[8] https://blog.google/technology/safety-security/a-simpler-and-safer-future-without-passwords/

[9] https://www.theregister.com/2018/01/17/no_one_uses_two_factor_authentication/

[10] http://www.theregister.com/2021/05/06/samsung_galaxy/

[11] http://www.theregister.com/2021/04/26/hashicorp_reveals_exposure_of_private/

[12] http://www.theregister.com/2021/04/26/mangadex_data_breach/

[13] http://www.theregister.com/2021/04/09/ncsc_secure_passwords_three_words_advice/

[14] https://www.theregister.com/2020/12/16/solarwinds_github_password/

[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJS7WdcZD5AgOv2nQCYs7QAAAII&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJS7WdcZD5AgOv2nQCYs7QAAAII&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[17] https://knowyourmeme.com/memes/all-your-base-are-belong-to-us

[18] https://whitepapers.theregister.com/