This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
This is a topic of great interest, and I believe it will stay that way until it's solved.
Several studies detail what we already knew: passwords aren't worth much when it comes to protecting sensitive information. That's why systems requiring stronger protection rely on OTPs, which, despite the RSA debacle, remain an effective way to protect information. On top of that we can add a third factor, something we are (the triad of what we are, what we have and what we know). There's also the approach of X.509 certificates on physical tokens, which can reach authentication level 4. However, having seen how much resistance there is to using such technology, we may need to rethink how we deploy our security measures.
When the mainstream media start mocking passwords and the systems in place, the problem has become serious. The NY Times gives a nice playful demonstration of how a regular person sees the authentication mechanisms in place. If that's the best we've managed to put in place, maybe it's time to start from scratch and build a system on new foundations.