By Elizabeth Millard
www.EcommerceTimes.com, March 13, 2004

"The way passwords are used is dangerous right now," said Michael Wood, vice president of sales at Lavasoft, a firm that produces anti-spyware software. He told the E-Commerce Times that he often hears stories about individuals gaining control of a company network by using keylogging spyware, which records a user's keystrokes.

At the recent RSA conference, user authentication was a strong theme, and Microsoft chairman Bill Gates hinted at the direction of future technology in this area, predicting the traditional password is headed for its demise.
In his speech, Gates noted that people will begin to rely less and less on passwords because they cannot secure data or systems in a reliable way. Any CIO who has walked past a row of desks knows Gates has a point: The number of Post-It notes affixed to computer monitors and emblazoned with passwords is alarming.

However, technologies like smart cards that offer a different path to user authentication have been slow to catch on in widespread fashion. With the refinement of these alternatives, that could change.
Are passwords finally on the way out?

User Error

The reason why password-based security needs to change is simple: People cannot be trusted. More specifically, computer users at companies are often given so many passwords for different systems and network accounts that they end up writing them all down. Such a document left in the open creates a security hazard.

Just as dangerous, users who are asked to set their own passwords often use the same password on different systems and then fail to change that password often. If a malice-minded individual were to discover just a single password, he would gain access to multiple systems.
"The way passwords are used is dangerous right now," confirmed Michael Wood, vice president of sales at Lavasoft, a firm that produces anti-spyware software. He told the E-Commerce Times that he often hears stories about individuals gaining control of a company network by using keylogging spyware, which records a user's keystrokes without his or her knowledge and then sends that info to whomever launched the spyware.

Read More Here