Skip to main contentSkip to navigationSkip to navigation
Rows of office workers working on computers
Whether for work or personal accounts, the average Brit must remember 19 passwords. Illustration: Guido Rosa/Ikon Images/Getty Images
Whether for work or personal accounts, the average Brit must remember 19 passwords. Illustration: Guido Rosa/Ikon Images/Getty Images

Security v usability: cracking the workplace password problem

This article is more than 8 years old

Password policy hinges on what a business is trying to protect and must walk a balance between security, convenience and cost

Walk past any bank of office desks and you’ll see at least some of the monitors and laptops adorned with colourful post-it notes that reveal a host of passwords. As foolish as that may seem, it’s no wonder employees turn to post-its to remember passwords: the average Brit has 19 to remember.

But if IT admins find this method frustrating, it’s a sign that they’ve made a misstep with their password policy. But it isn’t easy deciding questions such as whether to dole out more difficult-to-guess, machine-generated passwords or let employees choose their own (so they’ll be easier to remember).

Which is it? The short answer isn’t immediately helpful: it depends. Instead, password policy – whether it’s across a corporation with tens of thousands of users, or simply yourself – hinges on what you’re trying to protect and must walk a balance between security, convenience and cost. “There’s always this sort of tension between security and usability. You’ve got to try to get that balance right,” said Martin Barnes, head of identity portfolio at BT’s security group.

Passé passwords?

Let’s get one thing out of the way: passwords are not dying. Yahoo may be killing them off in favour of sending one-time codes to your smartphone, and you can open your iPhone with a fingerprint, but for everything else it’s likely that you’re typing in a password and will be for a long time to come.

“I don’t think passwords will be completely ‘replaced’ but there will be more authentication methods – and passwords will increasingly be only one piece of the puzzle,” said Dr Joseph Bonneau, researcher at Stanford University and technology fellow at the Electronic Frontier Foundation.

Two-factor authentication (2FA) is one way of adding an extra layer of security, though it does add faff and cost. Some forms of 2FA include sending an extra code to your phone. Google, for example, will also email you if your account is logged into from a new device. Most banks have a PIN generator to add a layer of security; and many companies have security tokens that are required to access corporate networks.

There’s another easy way businesses can boost security, which doesn’t require fiddly fingerprint scanners or a desk covered in card scanners. Sean Sullivan, security advisor at F-Secure, believes we could be making better use of login names by keeping them secret. “The problem we’ve got with passwords is that we’re not also combining them with username secrecy,” he said. “For my bank account, you don’t know my login credentials nor my password. But you do know my Twitter username, so half the information is freely available.” Don’t let users log in to an office network with their name or email address. Add a unique identifier code to boost security.

Complexity

We all know that we should use more complex passwords; the most common choices – “123456” and “password” – are easily-crackable versus credentials that use upper and lower case letters, mix in random numbers and feature characters such as punctuation. But who can remember that?

Those setting policy must consider whether complexity is truly necessary. It’s fine to use a weaker, shared password across less important websites and save your effort for sensitive accounts, particularly email, as it’s the “cornerstone” of password resets.

“For many applications – social networks, shopping websites – passwords still provide the best balance of security versus cost,” Bonneau said. “Try to pick strong passwords for your important accounts – email, logging in to your phone/laptop – and keep those separate from the passwords you use for the rest of your online accounts.”

Earlier this year, GCHQ issued password advice that suggested companies shouldn’t generate passwords for users, letting them choose their own – or ask staff to change passwords every few months or so. As both are common practice in many firms, IT admins have questioned it, not least because it may seem foolish to take password advice from a spy agency.

Barnes said it may not be necessary for IT to generate passwords, but said instead that all organisations should enforce good password discipline. Let employees make their own passwords, he said, but force them to mix it up and avoid obvious patterns, which make them easier to guess. “Generated [passwords] are random, whereas anything we choose won’t be,” he said.

Bonneau agreed that machine-generated passwords are best. “For your strong passwords, if possible, randomly generate them,” he said, stressing that you don’t need a strong password for every account. “You will memorise them faster than you expect.”

Sullivan, meanwhile, agreed on the futility of forced changes. It’s wiser to ask users to memorise a more complex password upfront and keep it for a longer period of time, he said. “GCHQ’s advice in that regard is probably good, because people should be taking the human more into consideration.”

The root of the password problem

Sullivan’s own employer has forced password changes, but he’s found a solution. “I’ve been using essentially the same password here at F-Secure for almost 10 years now, because I made a long, complex one from the very beginning,” he said. “I have a long root and then the only thing I really change every three months is the last four characters – and then I’ve got a new password.”

Rather than put your complex password on a post-it note or slip of paper, Sullivan suggested that companies create encrypted notepads or password lockers on smartphones, so you can save your credentials – whether it’s your logins, bank account details or bike lock combination – in a secure place.

Of course, there’s a better way to remember passwords than sticking with a single one for a decade or writing it down. Password managers let you have a different, complex password for every login without the burden of memorisation. But despite the convenience, a Google survey earlier this year suggested that security experts were three times more likely to use such software than casual users.

It’s not clear why users avoid password managers, but rather than forcing staff, IT departments could try to encourage better behaviour, such as a gift card doled out to everyone who installs a password manager and uses it. “Because that’s what the security folks do: they use strong passwords and keep them in a password manager,” said Sullivan. “How to entice people to do that though, seems to be the trick.”

To get weekly news analysis, job alerts and event notifications direct to your inbox, sign up free for Media Network membership.

All Guardian Media Network content is editorially independent except for pieces labelled ‘Brought to you by’ – find out more here.

Comments (…)

Sign in or create your Guardian account to join the discussion

Most viewed

Most viewed