If a company says it "protects" your data with usernames and passwords, it's either lying to itself or lying to you, because human-readable credentials, like the ones exposed in the Equifax breach, cannot actually protect anything. They shouldn't be used as identification for any purpose. Yet year after year, the advice companies hand us stays the same as it was five or six years ago: make your password more complex. Usernames and passwords are obsolete, and at this point we should assume every one of them is already compromised, whether we know it yet or not.

So what can you actually do about it?

Speak Your Mind

Customers should push back, loudly, at any website or service that still requires a username and password to log in. These credentials can be compromised, and relying on them isn't just inconvenient to manage, it's a false sense of security dressed up as a real one.

Two-step verification doesn't solve this either. It adds friction without removing the underlying weakness, and traditional two-factor authentication is a Band-Aid stretched over a critical problem, not a fix for it. The only viable solution is strong, right-factor authentication built on "something you have." Few approaches do this more securely than WWPass.

Contact Your Elected Officials

Government has a role here too, and it's been slow to play it. Instead of issuing citizens smart card IDs, credentials that can't be counterfeited and can double as secure login for websites and services, most governments, including ours, still rely on obsolete "dumb" IDs like driver's licenses. These are regularly counterfeited and offer zero meaningful online security. Worse, when an ID like this is required to open a bank account, the information on it is entirely human-readable, which means it can be abused or counterfeited to commit fraud or identity theft just as easily as a stolen password can.

The only real solution worth considering is using a token, something you have, as the first factor in identification. With WWPass authentication, one smartcard ID can be securely linked to an unlimited number of personal accounts, with verification handled entirely through cryptography rather than left open to human error, deception, abuse, counterfeiting, or impersonation. It's both more convenient and genuinely more secure. Identity theft costs Americans tens of billions of dollars every year, and most of that is preventable with technology that already exists and is available to government today.

Consider All of This

The U.S. Office of Personnel Management was breached, and the security background investigations of more than 21 million people working for or connected to the federal government were compromised, including Social Security numbers, every address someone had ever lived at, the names of family members, friends, neighbors, and coworkers, plus full sets of fingerprints and psychological evaluations.

Organizations like the Department of Defense, the NSA, and the CIA can't seem to stop their own top-secret information from showing up on WikiLeaks. If agencies with that level of resources and motivation can't reliably control the information they collect, what's actually stopping unknown third parties from accessing the data gathered by surveillance tools and using it against you? Many people already distrust government with their information. Now consider what happens when a hostile criminal organization quietly gets access to the same data we've unknowingly entrusted our government to protect.

If the federal government can't protect highly sensitive records belonging to its own military and intelligence personnel, what makes anyone confident that the IRS, a state licensing department, or the Social Security Administration is doing meaningfully better protecting the rest of us?

We Are at War

It's time governments stop pretending we aren't all already engaged in an ongoing cyber conflict with one another. Traditional warfare is defined and bounded by internationally recognized laws of armed combat. Cyber warfare has no such clarity. You might not worry about foreign tanks or planes threatening your neighborhood day to day, but foreign cyberattacks are a different story, and they happen continuously, largely without real consequence for the people behind them. Part of why is simple: these attacks rarely get the kind of sustained media coverage a physical invasion would.

"Victims" like Equifax tend to be embarrassed by what happened and face real consequences, falling stock value among them, so they have their own incentive to downplay or delay disclosure. Governments, for their part, generally don't want to formally recognize these incidents as acts of war, so they get downplayed from that direction too.

Here's the bottom line: when an organization like Equifax has overwhelming evidence that relying on usernames and passwords will inevitably result in sensitive data being compromised, and keeps using them anyway, that organization isn't a victim when the breach happens. It's complicit, through gross negligence, in the harm done to the people who trusted it with their data. End of story.

FAQ

Why does the article call companies that only use passwords "complicit"?
The argument is that the risks of username-and-password authentication are well documented and have been for years. An organization that keeps relying on it anyway, with full knowledge of that risk, isn't simply an unlucky victim when a breach happens, it made a choice that made the breach more likely.

How many people were affected by the OPM breach?
More than 21 million people connected to the federal government had their security background investigation records compromised, including Social Security numbers, address histories, family and associate names, fingerprints, and psychological evaluations.

What's the alternative to driver's licenses and Social Security numbers for identification?
A cryptographically secure smartcard ID, one that can't be easily counterfeited and can also serve as a secure login credential for websites and services, replacing human-readable documents that are vulnerable to both counterfeiting and credential theft.

Why isn't two-factor authentication considered a real fix in this article?
Because it adds a step on top of the same vulnerable username-and-password foundation rather than replacing it. The argument here is that right-factor authentication, starting with something you have rather than something you know, addresses the actual weakness instead of adding friction around it.

Learn More

Ready to see how right-factor authentication actually works? Explore WWPass Multi-Factor Authentication to see how a single secure token can replace the credentials that keep ending up in the next breach headline.