The Risks of Using Secrets for Security

Most people think that keeping secrets is the best way to ensure security. However, research has shown that this is not always the case. In fact, secrets can actually put your security at risk in a number of ways.

Secrets are information that is intended to be kept hidden from others or used only by a select few. This can include passwords, PINs, or other types of sensitive data. While secrets may seem like an effective way to protect your data and keep it secure, there are several risks associated with using them for security purposes. These risks include eavesdropping, replay attacks, and the potential for secrets to be discovered and shared.

Eavesdropping is a type of attack in which an attacker listens in on communications in order to gain information. This can be done by intercepting secret phrases or other sensitive data that is being transmitted over a network. Replay attacks are another type of attack that can be used to exploit secrets. In a replay attack, an attacker captures and then later replays a valid secret phrase or other secret in order to gain access to a system.

Another risk of using secrets for security is that they can be discovered and shared. This can happen if someone overhears a secret phrase being spoken or if a list of passwords is stolen. Once a secret is discovered or shared, it becomes much less effective at keeping your data secure.

Even though the use of secret phrases is clearly an exceptionally weak point in institutional security, they are still widely used from banking to government - we are often asked to provide our mother's maiden name, or the first street we lived on as a way of validating that we are the right person to speak with.

My biggest concern here is that these larger organisations know better but make no effort to drive awareness with their clients as to the risks involved with the use of a secret phrase.

It is time for us all to recognise that secrets are not an effective security measure, and stop relying on them to protect our data. Instead, we should be looking at more modern security solutions that are based on sound principles and advanced technology, rather than hoping that a few words or numbers will keep us safe.