Getting past the password tyranny

I was asked to submit my home electricity and gas meter readings this morning. I clicked on a link on an e-mail which took me to a mobile web page of the meter provider which .. asked me to enter a username and password.

Why is this still OK?

I’ve clicked on a link in an e-mail, i’m using the same phone I used last time, so the company can identify me fairly securely. And the data I’m entering, a meter reading, has no security value whatsoever.

I can’t see the password I’m typing because it comes up on a screen with stars. That’s a bit of a problem when entering the password with a mobile phone. It is a Blackberry, so I can at least feel which key I am pressing, which you can’t do when typing on a glass screen. For the 99 per cent of phone users who don’t have a Blackberry it must be nearly impossible.

Compare this to Google, which feels that it has identified me enough, once I have logged onto my computer, to show me all my e-mails without any other password entering at all.

The whole password system is becoming nonsense. In the early days, we could all use the same easy to guess password on every website and there were no problems. I understand we can’t do that now. But the idea of using a different password on every computer we logon to, and not writing it down, and using a mixture of upper case, lower case, numbers, punctuation marks, and in one particularly bad example, no repeated letter, is ludicrous.

Surely just about all of us have about 200 different logins to different systems we use these days.

The right answer is that the whole process is thought through much more deeply. How much risk is there of the wrong person logging into this? How sure can we be of the person without asking them to enter a password? If there is a password, why can’t we use a simple one? What are the risks if the worst happens and someone malicious in Russia finds themselves entering my meter reading? And if this does happen, how many flags would we have to know about it – the different device, different IP address, hinting at a different location, the meter reading very different from what the electricity company is expecting. Does the software company count how much frustration it is causing from people who would have liked to enter their meter readings but were blocked by the login screen?

This stuff doesn’t seem so difficult – yet it doesn’t happen – perhaps because the people like you and me who have to use the systems have little say in how the process is built. Perhaps a more interesting question is how this might be fixed.