Flagged. This ain't Reddit.

I agree the little chuckle is pretty dumb, but it points to an important discussion for technology people: how do we do AAA in a way that actually works? OpenID and Facebook Connect seem like good steps to me, but we're not there yet. So many web apps totally ignore AAA and just throw some pre-packaged solution with it's super-amazing-secure 256-bit salted hash and walk away. There's opportunity for innovation in this space. The bash.org quote is just to get the discussion started and highlight the pathetic state of things.

Then write a blog post about it and submit it?

For those of us that idle on IRC from time-to-time, this is one of those situations that puts a silly smile on our face and makes our day.

Except this isn't a problem restricted to passwords. How does an RSA private key help in social engineering situations? Biometrics?

With RSA private keys, users don't see or manipulate them directly (usually). With a private-key based security system, most users would go "Huh? what's a private key?" if you asked them to send it.

With biometrics, you can't send them over a phone or over the internet.

Social engineering will always be a problem, but passwords are far easier to obtain with social engineering. Biometrics and so on reduce the number of attack vectors.

But, then you've got to keep track of this "private key" thing that's completely intangible to users. What happens when they switch machines? What about when they accidentally format their hard drive? I think having a physical USB dongle would really be the way to go. Plug it in wherever you are, swipe your finger to unlock it. You've got two-factor right there in a simple, easy package. Now all we need is an operating system and environment that would support such a device...