Wired News has a good article that looked at MySpace passwords (the author got them from a phishing attack that resulted in their publication), and compared them to workplace passwords. He found that on average they were more effective than the ones most people use at work.

In the end, however, the author states: None of this changes the reality that passwords have outlived their usefulness as a serious security device. Over the years, password crackers have been getting faster and faster.

I agree that passwords are an ineffective security device. Most people don’t use effective passwords for the practical reason that they are too complex to remember, especially when we need them for so many things.

I am optimistic (delusional??) that eventually an effective biometric authentication method will be developed. That concept has its own challenges. For example, biometric “signatures” can’t be stored just like a password, as there would be no way to change it if it was compromised.

Read the Wired article