The Iron Yuppie

Interesting article on slashdot today about passwords

Too Many Passwords

The fact is that I think we're pretty much doomed for the near term and probably won't have anythnig decent for quite a while. The nearest I can figure is that we're going to have to carry around smartcards embedded in our driver's licenses that give us a unique extremely long randomly generated number as our password and is verified against a central authority. These chips will be inserted any time someone wants a password and then will require a simple pin. If it's stolen, you can log on anywhere and, before the thief ever has a chance to use it, the pin can be deactivated. It seems like that's the only way.

Simple math seems to support this. Today, assume everyone uses 10 character passwords:

94 (characters) ^10 = 5.38 × 10^19 different passwords

Not bad, and it'll take approximately a billion years if you try a million a second to figure it out. But in 18 months, it becomes 140 million years. Then 18 months later, it's 14 million. Then a million. You can see where this is going. And that's if you're not using any specialized hardware. Suffice it to say by 2020, no amount of complexity in your password is going to be enough.