An interesting article regarding Passwords!!!

The following is some of the key points taken from an article titled 'Kill the Password: Why a String of Characters Can't Protect Us Anymore.'

The article was written following the thefts of the authors (Mat Honans) passwords to basically his entire online presence. Everything from bank accounts to emails to social media accounts.
He is a massive advocate for the development of online security, it's quite a lengthy (and bulky) article, so i've tried to keep the following points brief.

• Credit card, bank details, personal photos, emails, conversations, thoughts, address, exact locations of internet access, all protected by relatively low encryption (strings of characters)
• Hackers can gain information thats available on one service to gain entry to another
• Common weakness = password
• Passwords have been relatively low problem, due to low level of data they have needed to protect
• False reality that 'stronger' (larger) passwords are more effective
• Trade-off between ease of access & privacy (could be presented in a diagram?)
• Sony had to pay out $171 million following a breach of privacy in 2011
• Passwords fail through being guessed, lifted from password library, cracked by brute force, stolen with a keylogger, or reset completely.
• Multiple factors of authentication, about the 'now' seem to be the way forward. An anology is seeing your friend in the street -  you don't just look at his hair colour to confirm it's him. You look at his jacket, the way he is standing, his mannerisms when he sees you, if he is in an area that he's likely to be
• Jeremey Grant labeled the new form of system an 'Identity Ecosystem'
• Problem with fingerprint scanner - too buggy, and infrastructure to support them doesn't exist
• Biometric scanners still have opportunity to be hacked - one factor authentication
• Idea: Phone snapping picture of your face, sends it to three friends, confirm your identity before you can proceed
• Google is already monitoring login, examining patterns in terms of location, device, and other signals the company wont disclose.
• Only movement forward is real identity verification - allowing full tracking of movements in metrics in all sorts of ways, and have them tied to our real identity.

Following this article, there is a MASSIVE discussion in the comments!!! (Mostly aimed at how the author of the article should have backed up his hard drive etc.) but there is some gold amongst it.

• Two questions that should be considered when deciding the level of security needed - How much does someone else want it? How important is it to you that they do not have it?
• From reading the comments - public consensus seems to fall in two ways. The first side says that information should not be put on the internet that is private (eg. banking, private emails). They share the opinion that if someone wants your information, they can get it. The second side want an increase in security, but are completely baffled as to how to get there.
• If you make it more difficult to get that the potential value return for the hacker, they will move onto lower hanging fruit
• Good infosec starts with three tiered system - something you have (smartcard, security chip etc), something you know (secure password, combination of characters), and something you are (biometrics, fingerprints etc).
• The weakest link is your internet connection

http://www.wired.com/gadgetlab/2012/11/ff-mat-honan-password-hacker/all/