We need an alternative to passwords because people are idiots

I’ve been working in security research for twenty years, and as much as things have changed in that time, some challenges have persisted. When I think of today’s vulnerabilities, authentication — making sure only the right people get access to the right information — tops that list. This subject might seem pretty basic compared to more headline-grabbing security issues. But in recent years authentication problems have become much more pervasive, complicated and important. We’ve seen an explosion of people accessing the Internet from all sorts of new devices, both as individuals and behind corporate firewalls, and those access points remain primary targets for bad actors wielding advanced phishing techniques. With hundreds of thousands of attacks now occurring per day, we can’t solve this problem on a case-by-case basis; security today is about automation and scale, and a big first step is helping people keep themselves safer. At Google we’ve long been proponents of two-step verification, or 2SV, which adds an extra layer of protection even if someone has your password (and we’re glad this morning to learn that the President agrees).