The stronger, the better

摘要

One way to look at the issue surrounding the strength of passwords is to see the account access process as having two paths. The first path asks the question: "what is your password? " and if the user supplies the correct answer they are let in. If the second path is taken ― usually if the user cannot remember the answer to the first question ― they get another question, the challenge question. Get the answer right and access is granted ― after supplying a new answer to the first question. Either path asks a question and the strength of the answer determines the strength of the authentication ― and the two strengths should be comparable.