Think your internet password is safe? Think again...

Are you one of those naive types who believes that choosing the name of your first pet as an internet password is going to protect you from hacking and fraud? Be very, very afraid, warns Memphis Barker, who has discovered some deeply unsettling facts about the increasing sophistication of data breaches.

Until the beginning of this month, I used one tinpot password for pretty much all my activity online. Eight characters long – without numbers or symbols – its prime value was sentimental, the product of a relationship that started in the era of the floppy disk. Then paranoia struck. On 1 February, 250,000 Twitter passwords were stolen by hackers. Had the hackers cracked mine – and found their way to the Gmail and bank account daisy-chained to it – well, they wouldn't quite have been able to retire, but the fear (and raunchy spam I'd been a vessel for) was enough to spook me into a radical overhaul of my online security.

I won't pretend this is a dramatic tale. It is, however, a drama relevant to many garden-variety internet users. As work and social life shift on to the internet, and people freight their profiles with more valuable data, there's growing consensus that passwords – 'icecream', 'tomcat', 'loveyou' – are no longer up to the job of keeping out intruders (be they 14-year-old 'script kiddies' or state-sponsored agents). Passwords can be forgotten, guessed, tricked or stolen from databases. Bill Gates was among the first – almost 10 years ago – to pronounce them "dead"; now the reedy voice of Microsoft's founder has been joined by a chorus of hundreds – from hacked individuals to governments to Google itself.

These password-o-phobes foresee higher hurdles. More complexity. Biometrics. Soon, many hope, you will sign in to your bank or email via fingerprints, voice recognition or the veins in your palm.

Alarm bells have been ringing for security professionals more or less continuously over the past three years. In 2011, the number of Americans affected by data breaches increased 67 per cent. Every quarter, another multinational firm seems to trip up. PlayStation was a larger casualty, forced to pay $171 million (£112.8m) to protect gamers after its network was broken into. Before Twitter went down, 6.5 million encrypted passwords were harvested from LinkedIn, 250,000 of which later appeared 'cracked open' on a Russian forum. ('1234' was the second most popular choice; 'IwishIwasdead' and 'hatemyjob' appeared on one occasion each.) Now all these once-precious words have been added to gigantic lists that hackers can spin against other accounts in future attacks.

It seems security fears spread best, however, from person to person. Late last year, Wired published a cri de coeur from writer Mat Honan, detailing how hackers destroyed his digital life in an attempt to steal his prestigious three-letter Twitter handle, @mat. Much of Honan's work – and pictures of his newborn child – were wiped. Dire warnings ("you have a secret that could ruin your life… your passwords can no longer protect you") punctuate the report – and in the two days after it was published, a quarter of a million people (myself included) followed Honan's advice and signed up for Google's two-step verification process. If his story doesn't do it for you, try the woman held to ransom for her email account, or ex-President George W Bush, who found images of his paintings hacked and published across the web.

But a long queue of critics doesn't mean that a slide away from passwords is being slipped down by all. "Despite their imperfections," says Dr Ivan Flechais, a research lecturer at Oxford University's Department of Computer Science, "they're convenient and a cheap option for developers… I don't see passwords changing across the board anytime soon." This line has been unwaveringly accurate since the first articles dismissing passwords appeared in 1995.

And internet users who don't own valuable Twitter handles – or weren't aware there was a market for such things – might be thankful to find a body of opinion sticking up for the right to use whatever brittle codes they choose. Reluctance is understandable. At the moment, safer also means more time-consuming. That half a second needed to chug through the memory for a complex password ("*874 or 8*47?") or go through Google's two-step process (which pings a code to the user's telephone), can feel gratingly out of sync with the warp-speed of modern computer habits. Chip-and-pin devices for online banking are still seen by most as a necessary evil.

Can we just armour-plate existing password technology? To an extent, yes. Nineties security gurus advised going h@ywire w1th symb()ls to keep out intruders – but free hacking software now available has common substitutions learned by rote, so besides frying the human brain (which struggles to deal with mixed alphabets), these are of comparatively little use today. Instead, passphrases are in vogue, chains of dictionary words – such as 'battery connect horse staple' – that generate a hardy level of length and randomness. Mine (seven in total) include the middle name of a writer, a fictional beast and a species of plant.

In the unwillingness to ditch passwords altogether, some spot a gap in the market. Ravel Jabbour, formerly part of a password research team at the American University of Beirut, argues that any biometric replacement technology (such as fingerprint verification) will have to be "state of the art" and most likely "costly to implement at a wide scale". The solution developed by Jabbour – an amateur drummer – is admirably make-do-and-mend. While a hacker might never be prevented from guessing or stealing a word, he realised that if users had to remember a 'beat' to which the word was typed in (say 'W.o…..r.d') then the code alone would be so many useless letters: its key locked in a user's head. Jabbour's idea flamed through the press but, without commercial investment, falls into the category of unrealised brainwave.

But what do hackers themselves think? Matthew Gough, Principal Security Analyst at Nettitude, an ethical hacking firm, says ideas like Jabbour's are a "stop-gap". He should know. As an ethical hacker, Gough makes a living from finding the weak points in a company's security ("I'm trained to break stuff," he says). He looks nothing like the hacker of stereotypef – he's tall, clean-shaven and, when we meet in the Independent offices, is wearing a blue-and-white gingham shirt under a smart fleece. I had hoped he'd take a crack at my new personal passphrases, but Gough declined. His trade has regulations. Plus, since I was standing in front of him and asking for it, he'd lost the critical element of surprise.

When it comes to the identikit internet user, suggests Gough, hacks are carried out most often not through a crack or a guess but via what's known as "social engineering": tricking us into giving up their passwords, either through clicking on a bad link ("phishing") or sleight of hand. "If you stopped 10 people in the street with an appropriate story," he says, "you'd get one or two to give their passwords up." Gough once infiltrated a private company's legal team for a week, nobody questioning the alibi that he was "needed for IT". It is, he says, this unreadiness for attack that hackers – ethical and otherwise – prey on most. "Most people just aren't aware of the threat."

That may be true. But the clearest sign the password could soon be usurped – and the threat lifted off our gullible shoulders – can be worked out from the players involved in the race to redefine online security. Google and Intel are among those kicking up dust, so too the FIDO alliance, a group whose members include Paypal. The first to come up with a not-too-boring solution will gain an invaluable market share.

Google, for example, wants us to put a ring on it. Eric Grosse, their vice president of security, co-authored a paper published in late January starting from the familiar point that passwords are "no longer sufficient to keep users safe" and revealing his company's response – a tiny USB card that logs you into your Google account, or a smart-card embedded finger ring that can sign you in to a computer through a single tap. Grosse doesn't claim these are for certain the answer to our security woes; he does claim, however, that if it's not them, it will be "some equivalent piece of hardware".

Google's ubiquity gives them something of a head-start. But qualms have gathered like static.

First, as Nettitude's Gough points out: people will "lose [these devices], break them, or have them stolen". Second, fashion and tech don't always sit pretty together. To the only semi-security-conscious, a Google ring might feel like an uncomfortably concrete pledge of allegiance to the internet giant. "Till death do us part…" etc.

Move a technological step forward – to biometric authentication – and the ring or key becomes part of the human body itself. Biometrics remove the need to stash a token about one's person, and a hand or finger or iris can never be pilfered. Sridhar Iyengar, director of security research at Intel Labs, has developed a palm-vein sensor.

Unlike fingerprints, which aren't completely unique (they have a one in a million repeat rate) and – if you leave a fingermark on your computer – can be cracked with the aid of a gummy bear (YouTube it), the veins in your palm have no partner on Earth, according to Iyengar. In Japan, where touch is avoided as much as possible, this style of sensor already grants citizens access to cash machines.

There are drawbacks here too, both in terms of the cost of technology itself and sceptical public opinion. But one of the main fears about biometric authentication, explains Iyengar, is something of a chimera. UK citizens guard privacy seriously. While government-issue ID cards are the norm in Nordic countries and India, the idea was reeled in over here after a hail of criticism. The prospect of registering one's own body parts to some shady central database, then, is unlikely to appeal. Cloud storage systems (like LinkedIn's) have been breached before and will be again.

But the benefit of biometric measures like Iyengar's is that the security circle starts and finishes with the user. Should palm-vein sensors win market-share, your palm's special pattern will be verified by the sensor alone, not checked against a record held centrally by Intel – so a break-in would be immaterial.

Does this mean they'll be commonplace in five years' time? It's a gamble. IBM predicted biometrics would go mainstream by 2015 but sound a more cautious note today. Ian Robertson, executive architect of IBM's privacy and security practice, tells me that developers see it as a "chicken-and-egg" problem: they'll only launch a fingerprint verification system, for example, when "confident that a very high proportion of their customers were in a position to use it".

There is one point of agreement. Representatives of Google, Intel and IBM all foresee a world in which our main security device will be the mobile phone. Always in our pocket, its 'smartness' can be harnessed to perform the role of high-tech key. The most likely mid-term step, says Robertson, will see log-on devices like Google's USB "become yet another 'app' on a smart-phone". In the "long-term", he adds, we may see "biometric readers on mobile phones". At which point, hacking would presumably become a far less appealing career and we could go back to worrying about what our emails say, not who might be snooping.

In part, progress depends on us – the web's innocent masses. It's been four weeks since I changed my password to a cavalry of new passphrases, and muscle memory still sees the old beloved word (a retro chewy sweet) typed into password boxes across the web. Companies will struggle to create security that gets under this convenience limbo. But the web is a darker place than most of us realise, and while we wait for better technology to filter through, it's probably best to get used to slowing down and locking up. Bad passwords are as out of date as 'whambars' (no going back now).

i100 In this video, the late actor Leonard Nimoy explains how he decided to use the gesture for his character
Arts and Entertainment
Secrets of JK Rowling's Harry Potter workings have been revealed in a new bibliography
arts + ents
Robert De Niro has walked off the set of Edge of Darkness
news The Godfather Part II actor has an estimated wealth of over $200m
Arts and Entertainment
Fearne Cotton is leaving Radio 1 after a decade
radio The popular DJ is leaving for 'family and new adventures'
Life and Style
ebookNow available in paperback
ebookPart of The Independent’s new eBook series The Great Composers
Robbie Savage will not face a driving ban
football'Mr Marmite' faced the possibility of a 28-day ban
Life and Style
Nearly half of all young people in middle and high income countries were putting themselves at risk of tinnitus and, in extreme cases, irreversible hearing loss
It was only when he left his post Tony Blair's director of communications that Alastair Campbell has published books
people The most notorious spin doctor in UK politics has reinvented himself
Life and Style
The new model would be a “pedal assist” bike in which the rider’s strength is augmented by the engine on hills and when they want to go fast
Arts and Entertainment
arts + ents
Life and Style
Arts and Entertainment
James Franco and Zachary Quinto in ‘I Am Michael’
filmJustin Kelly's latest film tells the story of a man who 'healed' his homosexuality and turned to God
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating

By clicking 'Search' you
are agreeing to our
Terms of Use.

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    Ashdown Group: Front-End Developer - London - up to £40,000

    £35000 - £40000 per annum: Ashdown Group: Creative Front-End Developer - Claph...

    Ashdown Group: QA Tester - London - £30,000

    £28000 - £30000 per annum: Ashdown Group: QA Tester - London - £30,000 QA Tes...

    Ashdown Group: Linux Administrator - London - £50,000

    £45000 - £50000 per annum + bonus: Ashdown Group: Linux Systems Administrator ...

    Ashdown Group: Business Intelligence Analyst - London - £45,000

    £40000 - £45000 per annum: Ashdown Group: SQL Server Reporting Analyst (Busine...

    Day In a Page

    HIV pill: Scientists hail discovery of 'game-changer' that cuts the risk of infection among gay men by 86%

    Scientists hail daily pill that protects against HIV infection

    Breakthrough in battle against global scourge – but will the NHS pay for it?
    How we must adjust our lifestyles to nature: Welcome to the 'Anthropocene', the human epoch

    Time to play God

    Welcome to the 'Anthropocene', the human epoch where we may need to redefine nature itself
    MacGyver returns, but with a difference: Handyman hero of classic 1980s TV series to be recast as a woman

    MacGyver returns, but with a difference

    Handyman hero of classic 1980s TV series to be recast as a woman
    Tunnel renaissance: Why cities are hiding roads down in the ground

    Tunnel renaissance

    Why cities are hiding roads underground
    'Backstreet Boys - Show 'Em What You're Made Of': An affectionate look at five middle-aged men

    Boys to men

    The Backstreet Boys might be middle-aged, married and have dodgy knees, but a heartfelt documentary reveals they’re not going gently into pop’s good night
    Crufts 2015: Should foreign dogs be allowed to compete?

    Crufts 2015

    Should foreign dogs be allowed to compete?
    10 best projectors

    How to make your home cinema more cinematic: 10 best projectors

    Want to recreate the big-screen experience in your sitting room? IndyBest sizes up gadgets to form your film-watching
    Manchester City 1 Barcelona 2 player ratings: Luis Suarez? Lionel Messi? Joe Hart? Who was the star man?

    Manchester City vs Barcelona player ratings

    Luis Suarez? Lionel Messi? Joe Hart? Who was the star man at the Etihad?
    Arsenal vs Monaco: Monaco - the making of Gunners' manager Arsene Wenger

    Monaco: the making of Wenger

    Jack Pitt-Brooke speaks to former players and learns the Frenchman’s man-management has always been one of his best skills
    Cricket World Cup 2015: Chris Gayle - the West Indies' enigma lives up to his reputation

    Chris Gayle: The West Indies' enigma

    Some said the game's eternal rebel was washed up. As ever, he proved he writes the scripts by producing a blistering World Cup innings
    In Ukraine a dark world of hybrid warfare and murky loyalties prevails

    In Ukraine a dark world of hybrid warfare

    This war in the shadows has been going on since the fall of Mr Yanukovych
    'Birdman' and 'Bullets Over Broadway': Homage or plagiarism?

    Homage or plagiarism?

    'Birdman' shares much DNA with Woody Allen's 'Bullets Over Broadway'
    Broadchurch ends as damp squib not even David Tennant can revive

    A damp squib not even David Tennant can revive

    Broadchurch, Series 2 finale, review
    A Koi carp breeding pond, wall-mounted iPads and a bathroom with a 'wellness' shower: inside the mansion of Germany's 'Bishop of Bling'

    Inside the mansion of Germany's 'Bishop of Bling'

    A Koi carp breeding pond, wall-mounted iPads and a bathroom with a 'wellness' shower