With the recent password failure of Lifehacker, Gizmodo, Gawker, etc. It's should be painfully obvious to several million users that passwords suck and the various solutions for solving password hell are also pretty terrible.
Why are they so bad?
- Humans are bad at remembering random alpha-numeric strings with upper-case and lower-case combinations. This is something that computers can do with ease but people tend to be really bad at this.
- Humans are bad at securing websites. Even companies that in theory should know what they are doing frequently mess up, because getting security right is complicated. Just sprinkling encryption pixi-dust and hashes doesn't make something secure.
- The internet as a whole isn't setup for password managment. The closest we've come are solutions like trusting Google, Microsoft or Facebook to handle authentication and security. (Google Login, Microsoft Passport, Facebook Connect)
- Password managers are bad. They get in the way between me and the website I want to visit. They perpetuate the problem by creating databases of passwords that I'm expected to manage.
- Internet standards like OpenID in theory begin to solve some of this but in practice have made little progress because the UI is wacky.
I'll stop, perhaps you have your own reasons why you think passwords are bad. Let's move on.
Every website that wants you to login:
- Needs at minimum two things. A username and a password. (username is sometimes an email)
- Needs a mechanism for you to update these two things (possibly others but these two are minimal)
- Needs to validate that the username/password match something in the website database.
- Needs a way for you to recover if you forgot your password.
The traditional approach has been to present UI on the screen to have you input this information and then ask you to re-enter this information anytime you want to login. Stupid waste of time. Don't even get me started on Capchas.
The browser should know who I am. The browser should also know how much information I've agreed to share with any particular site. Yes, junior privacy is important. The website should never know my true password. Think of it like Facebook Connect. Perhaps "Browser Connect" where the browser will log you in.
Why is this better?
- Only the browser knows who you are. Your private information and master password don't need to be sent across the internet.
- Signing up for a a basic website is two clicks. Sites can still control their sign-up experience asking for more info if needed but they shouldn't ask for passwords anymore.
- If one website is compromised it doesn't impact any other.
- Users don't have to remember different passwords per site. The computer does this for you. It'll even log-you-in. Zero clicks is better then one.
- Browsers can decide how they want to secure your information on your computer. This means that smart people who build browsers and spend their time thinking about security can make the web secure while people who run blogs can focus on telling me when the next iPhone is coming out.
- Browsers can do nice things like support syncing across browsers and mobile devices, they can also support biometrics (fingerprint readers), password recovery and other stuff that will allow me to remember less passwords.
In technical terms this would likely be something like Oauth with the browser but I'd prefer that it be coined as NoAuth as the goal should be to make passwords suck less.