Windows 8 to Remember Your Passwords

Security - By admin on Wednesday, January 18, 2012 - 09:44

As well as coming up with a new secure way for users to log-in to their PCs, the picture password, Microsoft has been working on ways it can help users to create and store unique passwords for all their other online computing needs.

In a post on the MSDN blog, Dustin Ingalls, a group program manager on the security and identity team, talked about how Microsoft wanted to "help you manage your digital identity in a way that is both convenient and secure."

Most of Us Only Use 6 Passwords

We all have to use passwords for a variety of sites, some for fun, some social media, some related to work and others for banking and shopping. According to Ingalls, Microsoft's research "has shown us that the average person using a PC in the United States typically has about 25 online accounts. That’s a lot to keep track of! In fact, the data also shows that the number of unique passwords across those 25 accounts is only about 6. For folks who spend time thinking about security, that’s a worrisome finding as it shows that the average person reuses the same password quite frequently across accounts. Additionally, given that different websites have different password policies (some require alphanumeric with special characters, some disallow special characters, some have minimum password lengths, some don’t, etc.), it’s likely that the number of unique passwords across accounts would be even lower if websites actually had the same password policies."

A Gift to Hackers

Of course, for most of us, remembering even 6 different passwords and usernames is a bit of a handful. It would be quite difficult to remember a unique password for each site, even though we know that is what we really should do to protect ourselves from hackers.

Especially as Ingalls explains, "password reuse is very useful to hackers…they know that if they can learn your password for one site, it’s highly likely that you use the same password on other sites. Even worse, an attacker can often use your sign-in information to reset the password for other accounts where the password actually is different. For example, if an attacker can somehow gain access to the password for one of your accounts, there’s a strong probability that you use the same password for one of your web email accounts. Given that there are only a handful of major web email providers, finding yours is often pretty easy. Once an attacker gains access to your email, they can go to other common sites (major banks, major online merchants, etc), and use the 'lost password' functionality to send a password reset link to the email account that they’ve already taken over."

Windows 8 Secure Solution

What Microsoft has been working on is a way to allow your Windows 8 to store all your usernames and passwords and to securely submit them to sites for you, thus keeping your passwords safe and enabling you to have a unique password for each site you visit.




When you log-in to Windows 8 using a Windows Live sign-in, you can manage your password and credentials for logging into sites and to share these credentials with your "trusted PCs".

Ingalls continues: "When you store credentials in conjunction with signing in to Windows with your Windows Live ID, Windows enables you to set your password for each account to something that is both complex and unique; since Windows 8 will automatically submit the credential on your behalf, you’ll never need to remember it yourself. If you need to see the actual password at some point later, you can view it in the credential manager shown here, from any of your Trusted PCs."

Plus as Ingalls explains, if you sign in with a Windows Live ID, you are protected even if you forget your initial password as "you can reset your password from another PC. If your Windows Live ID password was stolen somehow, you still have the benefit of a number of Windows Live safety features that are designed to detect compromise and limit your account usage until you can successfully prove that you are the rightful owner of your account and recover your account."

So, is this the end of the notebook full of scribbled down passwords and usernames? What do you think?