Why passwords have never been weaker—and crackers have never been stronger
and crackers have never been stronger — In late 2010, Sean Brooks received three e-mails over a span of 30 hours warning that his accounts on LinkedIn, Battle.net, and other popular websites were at risk. He was tempted to dismiss them as hoaxes …
Context & Ripple Effects
This piece lands at the end of a three-year run of 'people are the weak link' reporting: Reuters flagged users as cybersecurity's weakest point back in July 2009, and the New York Times argued in September 2010 that even a strong password is no longer the strongest security. Ars Technica's August 2012 feature sharpens that thesis into an arms-race framing — cracking hardware and techniques have improved faster than the passwords users actually choose.
The story travels unusually far for a security explainer: Gizmodo, Forbes, Betabeat, The Tech Report and Errata Security all picked it up within days, signaling that credential compromise had crossed from specialist concern into mainstream consumer territory. Its opening case study — Sean Brooks, warned within 30 hours that his [[a:/entity/linkedin|LinkedIn]] and Battle.net accounts were at risk — puts named consumer platforms at the center of what had been framed as an abstract industry problem.
First-order effects
- Users who reuse passwords across sites — as Brooks' simultaneous LinkedIn and Battle.net warnings illustrate — face correlated breach risk, where one compromised credential exposes every account sharing it.
- Consumer platforms like LinkedIn and Battle.net absorb the immediate cost: mass warning e-mails, account-lock support load, and user distrust of legitimate alerts that look like phishing hoaxes.
Second-order effects
- Sites holding large credential databases face pressure to move beyond fast, unsalted hashes toward slower salting and per-user key stretching, because crackers' growing power makes weak storage the differentiator between an inconvenience and a full dump.
- Password managers and two-factor authentication vendors gain a marketing window: the article's premise — that human-chosen secrets can no longer outpace automated cracking — is their core sales pitch.
Third-order effects
- If the cracking-versus-password arms race continues on its current slope, authentication economics shift structurally: the marginal cost of defending a password database rises until site operators treat passwords as one factor among several rather than the gate itself.
- Regulators and standards bodies face mounting evidence that user behavior, not user effort, is the binding constraint — pushing policy debates from 'choose better passwords' toward system-level mandates on hashing, breach notification, and alternative credentials.
The trend: Authentication is drifting from trusting human-chosen secrets toward layered, system-enforced defenses, as each year of cheaper cracking hardware erodes what a password alone can protect.