I thought the second part of his conclusion was a bit hasty: "... and change all your logins every six months at least." Does he have any idea how impractical this is? If I could even remember every login I ever made, it would probably take more than 12 hours to do the manual labor of changing the password for them. No thank you!
Forced changing of passwords every x months is pretty common in the workplace, especially if the company is Windows based. The problem is it's so easy to make your passwords be +1, then +2, etc. I've worked at places that detected that pattern and didn't allow it, so I would just hold down the shift key and iterate anyway, yielding +!, then +@, +#, etc. So even forcing your users to change their passwords will most l…
Re: You have exactly three passwords, don't you?
#61biometrics will still require a fallback for any general purpose system. For example, you can't require fingerprints because there's a chance you'll get users without fingers. You can't require retinal scans because there's a chance you'll get users without eyes. You could probably ask the user to spit and check their DNA, but there's a higher chance of spreading disease that way. Eventually you'll need a fallback of a password/key, and if I were an attacker, I'd always attack the fallback (it's often the least well thought out part of auth).