Too Many Passwords 516
LK3 writes "A survey of 1700 technology end users in the United States released today reveals some interesting findings about password management habits. 'The results suggest that having to juggle multiple passwords causes users to compensate with risky security techniques and creates a drain on productivity by taxing the resources of IT support centers.' Further, corporate requirements of frequent password replacement further exacerbates the toll on human memory. Is the solution a master password, with all of the potential problems that represents, or biometrics, or are we stuck with post-it notes and a call to the help desk?"
I know how it feels... (Score:5, Funny)
Re:I know how it feels... (Score:4, Insightful)
You know, I better go patent this idea before someone else thinks of it!
Re:I know how it feels... (Score:5, Insightful)
Someone should invent a special "web token" of sorts that would keep you logged in.
Tried that. Turns out, nobody wants all their online identities to merge together.
... MSN Passport? (Score:5, Informative)
-everphilski-
Re:I know how it feels... (Score:2, Funny)
He's talking about cookies, dumbasses.
Re:I know how it feels... (Score:5, Funny)
Argghhh, fer crisakes (Score:3, Interesting)
Take a look at this really cool presentation, even if you find the subject matter boring the presentation is sharp, http://www.identity20.com/media/OSCON2005/ [identity20.com]
Re:I know how it feels... (Score:3, Interesting)
- It only works on certain sites - javascript confuses it completely
- They keep changing the f***ing algorythm, so next time you install it none of your passwords work!
- If you're working on another machine you can't log in anywhere.
I gave up on it.. something like that shipped with the browser would probably work though.
Re:I know how it feels... (Score:3, Interesting)
Of course, it would probably also be done a lot better, but it would still have the issues of a hidden method of implementation and central storage of credentials. The latter part of that sentence would be ignored by a lot of people, though.
Can't remember already... (Score:3, Interesting)
Crap, what was the password to view
Better than post-it notes (Score:5, Interesting)
a-E9 b-?p c-&m
d-6K e-aY f-eP
g-!S h-gn i-D=
j-Hd k-vw l-Cb
m-W5 n-4$ o-R3
p-x% q-7M r-NF
s-+2 t-s* u-Ay
v-fL w-zG x-Zu
y-cX z-Qr
I then print this, laminate it, and put it in my wallet (a backup copy somewhere isn't a bad idea either). Then, for every password I just remember a word (maybe "bank" for my bank for example) which gives me a password of: ?pE94$vw
Hard to guess, easy for me to "remember". If someone gets my paper (say I lose my wallet), it is still not simple to figure out what my passwords are, or even what the heck that little paper is. Shoulder surfing doesn't work too well either, unless you can memorize the whole card and then figure out which word I am using (it would be easier to try to watch me type the password on the keyboard then get it off the paper. Luckily I type fast and get annoyed when people stand over me while I type a password
Re:Better than post-it notes (Score:5, Funny)
So could you please elaborate on this and also tell us how you remember other pieces of information, say, like, I don't know, just for example, your PIN, account number, and which bank you use? Just curious...
Re:Better than post-it notes (Score:5, Interesting)
One thing that I did find to be a signficant drawback to this is that some companies are demanding an upper case letter, a lower case letter, a number and a funny character. It is quite possible that the transform of an easy to remember work will not happen to have all of these. One solution, that actually makes this less secure, would be to have all vowels contain a lowercase letter and a funny character and have each consonant contain an uppercase letter and a digit. This really reduces the number of potential passwords, but such is the cost of making the 'powers that be' happy.
Re:Better than post-it notes (Score:5, Insightful)
Re:Better than post-it notes (Score:3, Interesting)
Re:Better than post-it notes (Score:3, Informative)
Re:Better than post-it notes (Score:3, Informative)
No offense, but get better sources. Checking for two dictionary words with a number or special character between them is standard, and in fact limiting it to 8 possibilities instead of 10 makes it less secure, albeit imperceptibly so.
Re:simple python script (Score:3, Funny)
Sorry, I don't recognise that spell.
What next?
> Aw-Uk-Ted-uld-Ac
Sorry, I don't recognise that spell.
What next?
> Nod-wac-Ib-Vawl
You summon a grue.
The grue eats you.
Your score was 0.
You cast 1 spell.
Play again?
Re:Pin Number (Score:3, Funny)
Re:Pin Number (Score:3, Funny)
No, he starts at the other end of PI.
Re:Better than post-it notes (Score:2, Insightful)
Re:Better than post-it notes (Score:5, Informative)
That's more or less what he did. Look again. The table isn't a list of passwords, rather, it's a standard substitution cipher. For each of the letters, he simply looks up the value to produce the password. The scheme is reversable as well, so you can retrieve the keyword from the password.
Here's an article [wikipedia.org] on substitution ciphers.
Re:Better than post-it notes (Score:5, Insightful)
The browser could automate this pretty easily, of course
Re:Better than post-it notes (Score:4, Interesting)
Re:Better than post-it notes (Score:3, Interesting)
Re:Better than post-it notes (Score:3, Interesting)
1. you got to evilsite.com, and enter your public key
2. evilsite.com automatically connects to bank.com, and enters your public key
3. bank.com encryptes some string, and sends it to evilsite.com
4. evilsite.com sends the encrypted password to you
5. you decrypt the data, and enter that info to evilsite.com
6. evilsite.com forwards the data to bank.com
Now, while you play on evilsite.com, evilsite.com empties your bank account. Not lik
Re:Better than post-it notes (Score:5, Funny)
Re:Better than post-it notes (Score:2)
Re:Better than post-it notes (Score:5, Insightful)
your web-request-line account for WXKE radio, zGZuvwaY, doesn't have any
numeric or punctuation characters.
I think a lot of people fail to distinguish between cases where strong
passwords are needed, and where they aren't. For Amazon.com, with its
stored credit-card data, and PayPal, and my bank, and my user account
at work, obviously strong passwords are a good idea. But for slashdot,
nytimes.com, and other sites that just require them for your user-state
info, crappy passwords that never change are just fine, and putting those
on post-it notes on the monitor is also fine.
Great idea, until... (Score:5, Insightful)
I wonder how long before we figure out that this very requirement frequently leads to sequencing of the password, which completely defeats the purpose of changing it every so often.
I do like your idea, though, for places where I don't have to change the password every so often.
Re:Better than post-it notes (Score:3, Insightful)
Your method would be great except that it relies on you carrying around and frequently consulting a piece of paper in your wallet. As such it's only marginally less secure than just carrying around a note of your passwords in the first place.
How long would it take someone observing you to figure out what you were doing and swipe your wallet? (In an office it would probably be easy for a thief to xerox your codesheet). Then they just need a few guesses for your trivial "unencrypted" password and they're in.
N
Re:Better than post-it notes (Score:4, Interesting)
Use a phrase, like: SlashDot Keeps Posting The Same Thing Over And Over
Use the first letters: sdkptstoao
Modify it a bit: SDkptst0a0
You just remember the phrase and you are good to go!
Re:Better than post-it notes (Score:4, Funny)
I do something similar, but I use a simpler matrix:
So my bank password would map to "bank" and my slashdot password would map to "slashdot".
Re:Better than post-it notes (Score:4, Informative)
b-?p
a-E9
n-4$
k-vw
He actually did make it a bit easier to read, but he forgot to use the ecode tags. Try this version:
Keep it SIMPLE - Try this instead algorithm (Score:3, Insightful)
Re:Better than post-it notes (Score:2)
That tells you substitute b with ?p, a with E9, etc etc.
So, b (?p) a (E9) n (4$) k (vw) equals a password of ?pE94$vw. Make sense?
Taj
Re:Better than post-it notes (Score:3, Insightful)
If it were up to me, a password field would accept everything except enter and escape. Enter would process the password, and
Frustration (Score:2, Insightful)
Any good sysadmin knows that if you make the password policy to strick you could actually be worsening your security situation. People will start sticking their passwords under their keyboards or on their monitors.
as usual, blame the users for trying (Score:5, Insightful)
(BTW, this is basically a dupe from about four or five years ago...)
From the article (and the post):
First, I can't let this pass. I was on the IT team for a large company that had the described oodles of systems and oodles of passwords dilemma. And I'd been out on the floor where our users had to use these systems. The last thing in the world someone should be saying to them is, "You know how you are", as if these people are doing some wrong. Their jobs of dealing with the consumer public is hard enough without having to genuflect to the "security" (inconsistent, obfuscated, inane, ineffective, and myriad) measures of the systems from which they are supposed to server the consumers. I never had to deal with as many passwords as they did, but had I had to, I'd have been tempted to do the same thing.
As for the dilemma of too many passwords... yeah, there are too many passwords. And the funny thing about that is, they (in my opinion) provide little to no security and may even subtract from the overall security of the network. Especially in a closed access building (which these users were), passwords were and are a hindrance, not an enabler. I'd submit the entire organization would function more effectively were they all allowed access to the various systems sans passwords once they'd entered the building. Most stolen and broken passwords are via social engineering, and half the social engineering is just gaining access.
In the personal computing arena, I'd be awfully surprised if even 10% of the problems occur because of too many passwords. More likely it's because of incorrectly configured access levels for general users.
I'm guessing the world of passwords will never go away, but in settings where users have to deal with many (in the case described above, literally hundreds) of systems and their various password paradigms, passwords SHOULD go away (NOTE: the use of the plural... I'd be okay with somehow consolidating total access down to ONE password). Somehow it must be comforting to PHB's to know their universe is multiply protected by multiple schema, whether or not it affords any protection.
Re:as usual, blame the users for trying (Score:3, Insightful)
I hate to say it, because the whole concept is so incredibly simple to me, but it's just not going to happen with users.
Further, they want to be _told_ that they're secure, they want to make somebody else suffer when thei
Re:as usual, blame the users for trying (Score:2)
Re:as usual, blame the users for trying (Score:2)
Huh? The study came out today! Poor Zonk catches enough flak already, without hassling him over this.
Unless you're saying that we've heard this before, which is certainly true (we get a story like this every week or two), but until the lesson starts to sink in to admins' heads, I say keep 'em coming!
kwallet (Score:5, Interesting)
I just use the same 4 passwords for everything, but trying to figure out which one of the four a certain one is can be a problem, since in some cases you only get 3 login attempts...
Re:kwallet (Score:2)
Don't forget (Score:5, Interesting)
I won't answer that! (Score:3, Funny)
I'd answer, but then it'll give insight into my password preferences, and then I'll get c00tz0rs from t3h l33t h4x0r2!!1!eleventyone etc.
IT requiring password changes (Score:5, Interesting)
Re:IT requiring password changes (Score:3, Interesting)
Given up (Score:2)
Information Security (Score:4, Informative)
Something you know (password)
Something you are (biometrics)
One is good, two is better. Give your users an RFID card, smartcard, RSA SecurID (or similar) or fingerprint reader. Tie in your gift(s) to your authentication scheme.
You can't lose your finger NEARLY as easily as you can lose your physical token or forget your password.
Re:Information Security (Score:2)
Disclaimer: I install such systems for a living, so I might be a bit bia
Re:Information Security (Score:5, Insightful)
Something you have (physical key)
Something you know (password)
Something you are (biometrics)
I strongly object to this bastardization of traditional authentication scheme theory. "Something you are" is a load of crap. It is an attempt to graft biometrics onto existing theory without evaluating how they really work. Biometrics identifiers are just something you have and need to be evaluated on their strengths and weaknesses on that basis. For the most part biometrics are something you have that you keep with you all the time and cannot easily remove or change. This is good in that it makes them harder to steal and less likely to be lost. This is bad because you cannot put them away somewhere safe and are constantly exposing them to the possibility of being copied. It is also bad because unlike other things you might have and use to authenticate, biometrics are almost impossible to change, so once compromised are a nearly permanent vulnerability. Finally, biometrics are bad because they can lead to the escalation of a crime in that their theft can be physically damaging. Take note of the man who was first kidnapped, then had his thumb cut off when car-jackers wanted to be able to start his fancy thumbprint lock car. Criminals don't need to be given extra motivation to commit mutilations.
Biometrics proliferate these days largely on their "cool" factor. The more blinking lights and high-tech gadgets the more secure it must be, right? Sadly they are being used to replace either the something you know or something you have in traditional biometric schemes, with the end result being less overall security. Biometrics have their place, and that is in a tightly controlled environment, supplemented by human observers to prevent copies from being easily used, and as an additional security measure on top of "something you know" and "something you have" that can't be copied from your beer glass at the bar. They do not belong in an authentication scheme in place of either a traditional "something you know" or "something you have" unless your goal is to have very, very convenient placebo security that is trivially bypassed by design.
Re:Information Security (Score:5, Interesting)
Biometrics is a bad idea, if for no other reason than thieves will chop off body parts: Malaysia car thieves steal finger [bbc.co.uk]
Password manager (Score:2)
For everyday users I don't think constantly rotating passwords is a good idea. It's too inconvenient for them. Once that happens they start to write them down. I think a combination of a hardware key and a passphrase offer better security. As the saying goes, something you know, something you have or someth
And for the contrary opinion (Score:3, Informative)
Then there's also the fact that Lloyds performed a survey [lloydstsb.com] that contradicts the findings - passwords are fine as long as there's proper education.
Get rid of them (Score:2)
A simple solution would be to just eliminate password protection on most of them. They're only available on the intranet -- is there really a serious threat of people hax0ring other workers' accounts and taking their online sexual harassment training for them?
Re:Get rid of them (Score:4, Funny)
Funny you should ask... I found the web-based Sexual Harassment training a stupid waste of time and energy. I tried to get it stopped, but management wouldn't listen. So, I wrote a script that pulled everyone's username from LDAP and completed the training for them on the first day it was available. Everyone got a "thank you" email and nobody wasted any time (except me - but then I spend my day reading slashdot).
Re:Get rid of them (Score:4, Funny)
The right tool for the job (Score:2)
Is the solution a master password, with all of the potential problems that represents, or biometrics, or are we stuck with post-it notes and a call to the help desk?
Just use the right tool: MyPasswordSafe [semanticgap.com]
There is also a GNOME or GTK tool that is similar, but I didn't like the features nearly as well. This thing will store your passwords in an AES encrypted file protected with (I believe) an arbitrary length passphrase (mine is about 100 characters). I believe that it similar to the password safe (or
One solution... (Score:2)
Keep it simple (Score:2)
I use Password Safe (Score:5, Informative)
This solution works well for me. Just make sure you back up your pen drive.
Simple Method (Score:2)
I never seem to run into this problem. I have one password, with roughly four levels of complexity. Each version has the same meaning, and as such they're all easy to remember. Which one I use depends on the criticality of the resource it protects, but no matter which one it is, I'm never more than 3 tries away.
Now, when there are policies in effect that enforce password changing and prohibit reuse of old passwords, this presents a problem: it's hard to continue generating new obfustications of the same
What about passphrases? (Score:2)
Although we'd still have to deal with most of my co-workers using "Git r dun!" as a passphrase...le sigh.
I work in web hosting... (Score:2, Interesting)
Prime example. When a customer wants to cancel their account, we direct them to an online form which asks for their registration # or domain name and their password to verify their identity. Invariably, the customer forgets their password and when we respond that we can't cancel their account without that information, they ALWAYS ask, "can you tell me my password?"
I am not joki
I'm suprised that nobody has mentioned..... (Score:3, Interesting)
Security (Score:4, Informative)
With Password Safe, a free Windows utility designed by Bruce Schneier, users can keep their passwords securely encrypted on their computers. A single Safe Combination--just one thing to remember--unlocks them all. Password Safe protects passwords with the Blowfish encryption algorithm, a fast, free alternative to DES. The program's security has been thoroughly verified by Counterpane Labs under the supervision of Bruce Schneier, author of Applied Cryptography and creator of the Blowfish algorithm. Password Safe features a simple, intuitive interface that lets users set up their password database in minutes. You can copy a password just by double-clicking, and paste it directly into your application. Best of all, Password Safe is completely free: no license requirements, shareware fees, or other strings attached.
Re:Security for Apple Heads (Score:3, Insightful)
It integrates with most apps on the system so, for instance, if I go to a passworded site in Safari (the Web browser) and Safari can get the username and password from the keychain (by asking me for my keychain password) and then I can option
Text file with automatic encryption/decription (Score:2)
There's some decent password managers (Score:5, Informative)
Ideally it should run without being installed (and without too many dependancies), off a memory stick or PDA for portability. Some browsers have password managers, but it's a partial solution (only good for websites, and only work in this specific browser on this very PC), and I have problems trusting some of them (IE) to keep passwords secure at all.
Not sure what's out there for linux though...
App on my Palm Pilot (Score:2, Interesting)
I tried reasoning with the IT people (Score:3, Interesting)
Say, I choose an easily dictionary attacked password with just 5 lowercase letters. Whammo -- I'm told I can use that password for 3 days. So I make a 20 character, non-dictionary password with a mix of letters, numbers, random symbols, etc and I'm told I can keep it for a year.
Seems to me that's a reasonable approach: reward people for better passwords.
Suffice to say, I was told: "No way, we like it as it is"
Biometrics not the solution (Score:4, Interesting)
Re:Biometrics not the solution (Score:3, Interesting)
But, a bigger problem (for now) is someone cracking your database of biometric data, and being able to retrieve the information you store to identify people. This is why there is research into Replaceable Biometrics [computerworld.com].
If the stored database cannot be related to the person, then again a criminal is forced to go directly to the source (you) to copy or steal the finger or retina. Ideally, they would then be stopped by not knowing your password, or n
Its easy.. (Score:2, Informative)
Revelation [gnomefiles.org] for linux/gnome.
Lots more you can find on http://tucows.com/ [tucows.com] or your favourite software download site..
I have close to a hundred logins stored (encrypted) and gave up trying to remember them all a long time ago.. its really not an issue with such a program. Just make sure to keep a backup somewhere or you are screwed when your pc dies.. ;)
Password Management Software (Score:2)
I prefer FlexWallet for all of my passwords. I use more than 30 passwords just for systems I am responsible for accessing. It has a desktop app and a pocketpc version that syncs when docked.
Triple encrypted goodness on the database it uses. Now I just have to remember the password for that.
My System for Passwords (Score:3, Interesting)
My girlfriend does this (Score:2)
Didn't there used to be a keychain fob for this? (Score:2)
Seems like exactly the sort of thing that would be useful in this sort of situation. Anybody else had experience with this gadget, or similar?
What's news? (Score:2)
This is the same damned thing that's been going on for almost twenty years. And y
I write my passwords down. (Score:4, Interesting)
I have offloaded Internet security into Material security.
I use a separate password for every forum I care about. My passwords on my personal computers are changed regularly. I can do this, because of my password book. Without it, this would be implausible.
It is conceivable that someone will get my password by taking my book from me, and snapping pictures of the password pages with their cell phone. Very well then, let someone make the $500 airplane trip over here, come into the office, find my book, and then start snapping pictures. Or maybe find me on the streets if it's lunch time, and rip the book out of my backpack. Conceivable.
But I think this is prohibitively expensive for most people. It would be cheaper to hack a website, and get some other guy's password, and see where else the password might be usable.
I think it is less risky to keep a watchful eye on my password book, than to use only a finite number of passwords.
If someone thinks this is wrong, tell me what you do, and tell me why it is more secure. Not what you can imagine doing; Rather, tell me what you really do.
Re:I write my passwords down. (Score:3, Informative)
Simple, elegant solution (Score:3, Interesting)
You have a single password. This password is combined with the domain name and then processed with an appropriate mechanism (e.g. MD5) to produce a unique password for an individual site.
I think that's a great solution and think it should be incorporated into all open source web browsers. The user doesn't even have to know it is happening. Much more practical than biometric solutions.
Use tokens, and let users pick their passwords (Score:3, Interesting)
I changed my password this morning (Score:4, Interesting)
Total cost of the password change? Maybe a manhour's worth of time (between myself and waiting on the teks, and the teks stoping their work to fix my account). So maybe a hundred dollars or so. But we have 800+ employees in 5 branches. That's a lot of password change headaches.
-Rick
Password expiring (Score:3, Interesting)
Then IT thinks its good to change passwords every 30 days on some sites, password management alone takes 1-2 hours a week, not counting the times I have to change passwords for other people.
If anyone knows a opensource robotron replacement that works in both IE and Firefox, reply. As for password safe, been trying a new opensource one called Keepass [sourceforge.net] that looks pretty nice, and ported to multiple platforms.
the key problem (Score:3, Insightful)
the best way to secure something without taxing the average persons feeble brain is to use a password and an ssh key on a swipe card or a usb drive.
that way even if someone gets one they are very very unlikely to get the other. it also means you can change the ssh key on them without them having to remmeber anything. hell in a system i'm impementing everyone get a new key when they swipe in for the day and it expires after 24 hours.
Password safes considered unsafe (Score:3, Interesting)
Windows (as would be any OS that attained broad use) and/or disk hardware are sufficiently unstable that I occasionally have to scrap my existing data and start over from scratch. Additionally, I use many different computers on different networks to access the same websites, etc. Backups are a pathetic workaround for this, and are themselves a vulnerability.
In fact, any scheme that relies on a password safe resident on one machine will always be susceptible to catastropic lossage, and is a pain to use on other machines. And any scheme that relies on 3rd party storage of the passwords is vulnerable to attacks on that storage and is inherently harder to maintain.
Personally, I think the only thing that will eventually solve this problem is a single password plus a smartcard-like system (with automated backup to some other local storage). We're not going to get there easily, though. And it's not a panacea either, because smart cards can be lost, stolen or fried just as easily.
Ironically, this problem is essentially another variant of the fundamental issue surrounding identity theft: in an information society, it's absolutely crucial that we be able to reliably uniquely identify every person, but anything we use to do that will end up being abused just like SSNs.
The password pyramid (Score:3, Insightful)
If you follow that system, you'll end up with only half a dozen passwords or so, and you'll still be pretty secure, as the important passwords aren't used as often as the less important ones.
easy password (Score:4, Funny)
I worked for a company that had the most retarded rules for passwords. It had to have a number and a capital letter in it. The number had to between the first and last letters. We had multiple logins for various systems. We had a separate login for our computer, then a login to access our application suite, then a password for each application. And we had 7 or 8 of them. Needless to say, I kept the same password for as many of them as I could. My password was ih8Sprint. And then they made us change them every 60 days, so it became Ih8sprint, then iH8sprint, then Ih85print. You'd never guess who I worked for.
Mobile phones? (Score:3, Interesting)
I don't work for sun, but I think that the mobile phone makes a pretty good store for passwords encrypted by a master password.
The PC is obviously out of the question if you use different operating systems... for instance, my home PC is primarily a KDE desktop, so its wallet app is used for storing all passwords. But I have no simple way to access that wallet from the Winblows machine I have to use at work.
Phones, however, usually have this "code memo" feature these days, which lets you wrap any information you want in crypto, and seems to be quite useful for password storage.
Of course, the same master password problems apply... if you lose that one password, you lose them all. And if someone steals that one password (and the phone) they steal all your passwords. But it's better than a simple text file on disk somewhere, and much better than the post-it notes.
Security versus the ability to work (Score:5, Interesting)
Later on, we learned better, and adopted a much more relaxed regime, in which we specifically didn't force expiry or insist on passwords like tH1s#0n£3&@ for most of the users (we were stricter with people who could order goods or edit the payroll!).
The main reason was that we evaluated (for a range of typical users) the potential financial cost and likelihood of being prevented from working by our password regime, against the potential financial cost and likelihood of suffering a security breach. And in almost all cases, our security policy turned out to be much more damaging than any plausible security breach.
dedicated PDA (Score:3, Informative)
I picked one of my PDAs fully dedicated for only password database, plus other technical details for my machines, net services or other accounts. Methodically not using it for anything else, no network, no usb plug to any machine, ever. Backups on flashcards. Second identical PDA in the drawer, without data but ready to accept backup flashcard at any moment, usualy used for playing with NetBSD.
Today, the database has 726 records of active nick/identities, Maljin Jolt on Slashdot among others. What a pile of sticky labels could that be!
Re:Just use your Social Security number. (Score:2)
Re:Just use your Social Security number. (Score:2)
Re:Just use your Social Security number. (Score:2)
-everphilski-
Re:Just use your Social Security number. (Score:3, Insightful)
That kind of stuff makes me crazy. Any system I design has completely obfuscated passwords, the sort that can't be retrieved but have to be reset. To authenticate I mangle the password
Re:Just use your Social Security number. (Score:3, Informative)
No.
That's about as secure as your mother's maiden name, or your dog's name.
Which is to say, it's the worst password imaginable.
Do you want your father/mother to have access to all your accounts?
Hell, for wellsfargo.com, your SSN is your username!
Not to mention there are under 10^9 possible SSNs, and the first 3 (5?) digits can be calculated based on your place and date of birth! That reduces your number space to 10^6 or less, which, at one
Re:Just use your Social Security number. (Score:2)
Hmm.... For all these guys worrying about using a different password for each website - would it be legal to "make up" fake SS#s when dealing with stupid organizations who shouldn't really have access to it anyway. Personally, I think I'd feel quite a bit safer if my school (where I know the guys running IT) didn't have access to the same SS# for me as etrade.
And for that matter, I'd feel even safer if flakey companies like Visa who use even flak
Re:My password (Score:2)