After a long journey he was nearly there. In the distance there was the outline of the city wall. Moments later he approached the city gate.
“Halt!”, shouted a heavily armed guard.
He had grown used to this ritual, so he went through the motions.
“What is the pass word?”, the guard asked.
He spoke the phrase he had memorized. The guard nodded, lowered his hands from his weapon, and stepped aside to allow him entry.

The above is how I imagine passwords came into common usage long ago. Passwords are not very practical in the above scenario, which is probably why we now have passports: literally a document to pass through some port, such as a city gate or a border. Checks at the border can also be done using fingerprints. If the guard would take fingerprints and quickly compare them to a set of known prints, he could determine whether to let you pass based on a matching print.

Consider what these three things fundamentally represent:

1. A password is something that you know, you need to memorize it.
2. A passport is something that you have, you need to take it with you.
3. A fingerprint is something that you are, you always have it with you.

Most security systems combine at least two of these three factors:

Access to your bank transactions requires two things. Firstly, your debit card: something that you have. Secondly, your Personal Identification Number (PIN): something that you know. Entering a modern house also requires two things: the keys to your door and the access code to disable the alarm, which again combines something that you have with something that you know. Finally, entering a foreign country may even combine all three ingredients: a border guard may ask why you are entering the country and where you will be staying, he will ask for your passport and may scan your fingerprints.

Where am I going with this? Good security systems combine at least two of the three factors above. Think about how you access all your on-line accounts like Google, Facebook and LinkedIn. Do you use a password? Is that the only thing that you use to gain access? The answer to that is likely yes, and that is not a good thing.

Of all the three fundamental ingredients above, the password: something you memorize, is likely also the easiest to bypass. Not so much because of technical issues, although those do occur, but because of completely understandable human limitations.

The problem with passwords is that a complex password is hard to remember, and a simple password is easy to guess. Most people err on the side of making their passwords too simple. Why are such passwords easily too weak? For that we have to do some calculations.

Let us assume that you pick a single number between 1 and 10 as password. Let me think: you likely picked either a seven or a three, am I right? Even if I am not, people prefer some numbers over others, and that is exactly the root of the problem. Consider that with a single digit password I would need to guess only ten times and then I would certainly be right. If I can make my guesses a bit smarter – starting with the digits that are more often chosen – I may be able to guess ninety percent of the single digit passwords with only five tries.

Obviously we need something a little longer, a four digit password would have possible combinations, which is already much harder to guess. This is in fact the search space of the famous PIN codes. Some banks allow their customers to choose their own four digit code, which is a bad idea. Four digits are, from a memorization point of view, ideal for representing a birth date, or some other significant date. Consider that many such dates either start with 19 or 20 and we are left with only two numbers we need to guess: is a much smaller space of possibilities.

Digits are often not the only parts of a password, letters are often allowed. This seems sound, since adding twenty-six letters gives us an additional fifty-two possibilities, letters can be either lower or uppercase, yielding us possible passwords of length four. If we add in special characters this number grows even larger.

Adding extra symbols (digits, letters, other characters) to the possible password range may seem like a good idea. However, just as we saw with numbers: if the patterns are predictable they are easy to guess. Consider that if we make a word of two characters in English there are a limited number of actually valid words: ‘of’, ‘it’ and ‘to’ are all valid. In contrast ‘tj’, ‘gh’ and ‘lq’ are not valid words. Sequences of letters that are not words are difficult to remember. Hence, people rarely use them. This leads to predicable passwords that consist usually of nouns combined with predictable number sequences: ‘Ghost2012’, ‘lipgloss’ and even ‘password’.

Indeed the top five passwords are: ‘123456’, ‘password’, ‘12345’, ‘12345678’ and ‘qwerty’. Fortunately few people actually use these passwords. If you were to guess someone’s password using one of these top ten most popular passwords, you would succeed in about sixteen in one thousand tries. Which, while not spectacular, is still ridiculously high.

A thousand tries may seem like a lot, and it is if you would have to type all those passwords yourself. However, this can be automated quite easily. Trying all possible passwords is called ‘brute-forcing’. A modern computer can easily do this at a rate of five-thousand per second. Using some statistical insights, such as those mentioned above, this process can be made highly effective. In fact most passwords under ten characters can be easily broken in several hours using off-the-shelf computer hardware.

I hope it is clear by now that using only a password that you can memorize to secure your on-line accounts is a bad idea. So, how can we improve this?

There are at least two things that you can quite easily do with respect to passwords alone:

1. Generate passwords, instead of making them up yourself. No offense, but: a randomly generated password by a computer is most certainly better than something that you can think of.
2. Use long passwords, as we have seen the length of a password is a means to easily increase the difficulty of guessing it. A minimal passwords consists of ten characters, but as computing power increases, this may rapidly become too short. A password of twelve characters is a more realistic minimum nowadays, and sixteen to thirty-two characters is a safe range.
3. Use a different password for each service that you use. This way, when one account is breached, you do not get a domino effect.

Using a very long password, is one of the few exceptions where you could suffice with choosing your own. Consider that a long sentence as password is quite hard to guess: there are so many possible sentences! Even though a completely random password of the same length is harder to guess, this matters less if the password is sufficiently long.

If you are not into the long passwords, then the best solution is using a password manager of some sort. Keepass and Lastpass are popular solutions that are easy to use. There are two caveats to these services:

1. They usually use one strong ‘master’ password, which gives access to all the site-specific passwords. This is a single-point of failure is some sense, and can also lead to a domino effect, but this is not a major problem if you have a sufficiently strong master password combined with two-factor authentication: more on that later.
2. Some of these services may store your passwords ‘in the cloud’ in encrypted form. Understandably not everyone is okay with that. Fortunately, there are also variants which store your passwords locally on your own machine.

In a sense using a password manager in some way may feel like ‘writing down your password on a piece of paper’. This is true, but a strong password written down on a piece of paper that you keep in a safe place, is much better than a weak password that you have memorized. The same applies to password managers: the benefits outweigh the risks.

Improvements to your password do not address the most pressing concern: remember that most systems combine at least two of the three factors: something you know, something you have and something you are. A password is still only one of those ingredients. Hence, where possible you should add another one of these ingredients.

Almost all major on-line service providers – Microsoft, Google, Facebook, Yahoo, et cetera – offer some form of two-factor authentication. One popular mechanism called TOTP consists of codes that are generated using an app on your phone. How does this work? You take a picture of a QR image on the screen once, and a security app uses the data in this image to generate access codes that change every thirty seconds. You can set things up so that you are asked for a code only once a month on computers that you regularly use. So the effort is minimal and the security benefit is huge: in addition to guessing your password an attacker would have to gain access to your phone, which is way more difficult.

Some other services may rely on sending you an SMS with a code, or an e-mail with a clickable link. This is a bit less secure, but still way better than only using a password, and thus certainly worth it. If you use a password manager, then securing it with some type of two-factor authentication is an absolute must.

Say that you want to secure some other service X that does not offer two-factor authentication.
What to do? Well, the service may offer logging in via OpenID. This means that you can log in to the service using one of your main on-line accounts, like Google or Facebook. If you have secured that on-line account by enabling two-factor authentication, then transitively the account of service X is now also protected using two-factor authentication.

To wrap up: I recommend that you:

1. Always use two-factor authentication wherever it is offered.
2. Always construct sufficiently long passwords.
3. Seriously consider using a password manager.

After a long journey the data packet, the first in a long data stream, was nearly there. Residing inside the last switch, in the distance was the faint hum of a server. Moments later the packet had entered the server system. The server unwrapped the data packet and found a password inside. But it knew the password was not enough. The server generated a code that it was expecting. It unwrapped the next packet in the stream and found the exact same code it had generated just a moment ago. It allowed the rest of the stream op packets to enter.

The most profound characteristic of the networked era we live in today is that ‘ordinary’ people can easily create and distribute their own content. Sites like YouTube and Vimeo are more than Internet versions of America’s Funniest Home Videos. Indeed, they enable budding filmmakers to showcase their works, singers to attract their own following, and artists to use the screens in people’s homes as their canvas. Most importantly, this direct form of broadcasting eliminates the need for a slew of middlemen, moderation and the accompanying politics. It does not end there, writers can publish their novels as e-books, journalists can report the news by using web logs, and everyone can share their day-to-day activities via social networks like Facebook, Twitter or Google+.

Never before have there existed so many options to distribute and create one’s own content. Not all of this is of high quality, nor does it really need to be. As the ability to publish taps into the basic human needs of self expression and sharing. However, there are limits, because whatever anyone creates, there is one thing that protects every creative expression: copyright.

The origin of copyright stems back to a very old invention: that of the printing press. Prior to this, literacy rates were fairly low and reproducing texts was labor intensive: the manual letter-by-letter copying by writing was performed by educated monks in monasteries. The mechanical printing press changed everything, as it made it significantly easier to produce exact duplicates of a text. And this is exactly where the tension between authors of original works, publishers/distributors and consumers originated.

An unprotected work, one that is in the public domain, can be reproduced without the original author’s consent. Indeed, one may even take a work in the public domain, change nothing and republish it under one’s own credentials. There are no limits to how works in the public domain can be used and there is no legal protection for them. Luckily, a work is not in the public domain by default. Anything you create is at least protected by copyright automatically, with some minor exceptions. However, as we will see later, this is also a double-edged sword.

As Europe became more literate, the demand for books increased and concerns grew over the monopoly of the large printing companies. After all, they could republish any work without consent, and profit solely from the act of printing without compensating the original author. To remedy this, copying restrictions were introduced, first by self-regulation at the industry level, and later government enforced by copyright law.

The duration of copyright is limited, sharing some resemblance to the patent system. After you have created some original work, you have a set time to profit from it by displaying, selling or transmitting it. You also have the exclusive right to produce derivative works and naturally: to copy it. The (expected) return based on all these rights is intended to cover the costs it took in terms of your own labor as well as other resources to produce the work. This incentive may be an explanation for the proliferation of creative works over the last couple of centuries. After the copyright expires, your work enters the public domain. So, for how long is a work covered by copyright? Initially, this was about 14 to 28 years, but most countries now use the lifespan of the author plus 50 to 70 (!) years.

The expiration of copyright and the existence of works in the public domain give rise to a somewhat odd dichotomy. One can produce a derivative of a work in the public domain, and then produce a new original copyright-protected work from it. Do you know of anyone who has done this? I bet you do, since one of the most famous examples is Walt Disney.

This brief clip shows that Disney relied on many existing works. He created original derivative works by creating modern adaptations of them. In some sense this is exactly how human culture works: you build upon the works of others. Whether those derivative works should then by fiercely protected by a profit-driven entertainment company, is an interesting other debate.

In some way copyright seems entirely fair. After all, it provides an incentive for creating new works, and enables the author to make a living. However, there are some consequences of copyright law which have nothing to do with such lofty goals. These affect both the ownership and duration of copyright.

It is common to transfer ownership from the original author to some other entity, usually a publishing company. For example, many scientists have to transfer copyright of a final manuscript version of a publication to the publishing entity, like ACM or Springer. As scientific articles are usually paywalled, this leads to the odd construction that an author may have to pay to be able to view his original work in the final published form, although commonly, and commonsensically, such access is provided free of charge. Open source projects are another example: some require the author to sign over copyright to the project itself. One reason to do this is to prevent the situation where all copyright holders have to agree to a future license change, an other is a better legal position. These examples show that copyright does not necessarily remain with the original creators, but rather is transferred based on either direct monetary gain or legal convenience.

I think the legal convenience argument is somewhat weak: indeed, it can be better to have a slew of copyright holders involved. When a license change is proposed they can all democratically vote for it. With respect to monetary gain, science is the odd one out. Scientist produce their articles, and then publish them for free at conferences or in journals. Yet, the publishers are the only ones profiting in this system. Indeed, through scientific grands, the taxpayer indirectly funds those large publishing companies when scientists publish their works. However, this is just one route through which the public sponsors those companies: universities pay licensing costs for access to repositories of publications and printed journals, which is also public money. While the publishing companies do add value, by editorial means, providing infrastructure and promotion as well as actual printed works, it is doubtful whether such a cozy money-sandwich is justified for this rather limited contribution. Contrast this with the early days of printing, where the publishers were also responsible for the actual printing and brought to the table considerable knowledge and craftsmanship concerning typesetting and replication. These tasks have quietly shifted to dedicated printing companies and the authors themselves, weakening the role of traditional publishers.

The situation is different outside of science. Most artists get some form of compensation when they sign over their copyright. This can either be some fixed amount or a share of the profit. However, the lion’s share still goes to the publishers and distributors themselves. This also raises the interesting question: why should copyright last longer than the author’s lifetime? Who owns the rights, and the profits, after the author has died? In some cases these may be the heirs of the author, for example the Tolkien Estate holds the rights to The Lord of the Rings, which makes some sense. However, this is not always the case. For example, who owns the music of the Beatles (two of whom are still alive)? That would be Sony Music. So, they can profit from the Beatles’s catalog, consisting of over 250 songs, until probably the end of this century. Wait a minute, I thought the point of copyright was to fairly compensate the authors, so that they could make a living of what they had created? In fairness, the Beatles and their estates still receive some royalties (though most profits now go to Sony Music). However, the effort it took to create those original works has already been compensated many times over by this point, and even more so by the turn of the century.

This clip illustrates some of the points made thus far:

So far, we have learned about the origin of copyright and seen the deviation between the original goal of copyright: protecting the individual authors, and the present-day situation: publishers and large corporations owning vast amounts of intellectual property. However, computers and the Internet are changing the game. In a follow-up article, to appear soon, we will look at copyright in the digital age.