Bruce Schneier of course does it better justice than I ever could, but there was a great paper released that looks at passwords through a modern lens: Do Strong Web Passwords Accomplish Anything? Today's attack vectors are different--phishing is preferred over brute-force attacks, etc. Much like how Mr. Schneier likes to remind us that if you put up a strong front door using strong cryptography, attackers will just find a way around the door. They seek the path of least resistance. I was very encouraged to read the linked paper, so I wanted to pass it along who might not have caught it on slashdot.org. I think the use of passwords needs serious re-examination as far as what is trying to be accomplished, and this paper fuels a much-needed discussion.