Shareholder Authentication (published 2015)

Reliance solely on the first traditional authentication factor, “what you know,” is often referred to as Single-Factor Authentication, and most commonly requires the user to provide a username and password. In and of itself, the username has limited value in authenticating a user; rather, it serves to identify which user is being presented to a company for authentication. The password is then used to authenticate that user’s identity. To enhance the effectiveness of the username/password combination, account lockout requirements (i.e., locking out a user from an account after a given number of failed login attempts) and/or password complexity requirements (e.g., minimum password lengths or the use of a combination of uppercase and lowercase letters, numbers, and special characters) are frequently employed and enforced. Such requirements seek to strike a balance between password strength and user convenience. In the absence of complexity requirements, users employing self-selected passwords may gravitate toward weak passwords (with “password” and “123456” being among the most common in 2014¹). In contrast to user-selected passwords, automatically generated passwords are likely to have significantly greater “entropy” (i.e., the password is more random) and therefore afford stronger protection.² Even so, requiring more complex passwords can sometimes be counterproductive—if passwords are too complex and/or are not self-selected by users, users tend to have difficulty remembering them, and, as a result, may resort to writing their passwords down and leaving them in plain sight.