I didn’t get but three paragraphs into Bruce Schneier’s latest wired.com article about secure passwords, and I came across, “Your encryption program’s key-escrow system is almost certainly more vulnerable than your password, as is any “secret question” you’ve set up in case you forget your password.”

How often do botnet herders need to break into a system by gaining access to the password? And once they get in, how often do they actually ever care about the password? Not often, I suspect. Why care about the password if the user runs your program as their already-auth’ed credential? Why worry about laptop encryption when the user is already logged on? How often have I seen someone walk away from their laptop at Panera or Starbucks and not lock it? Point taken, though, that passwords, while targeted and popular, are maybe not the weakest link any more, just like network-borne attacks are quiet compared to fashionable web app attacks lately.