Yahoo mail hacked

Given technical debt and other management issues, they're a somewhat appealing target (lots of payoff, possibly easier to hack than better-managed systems).

Not that other providers haven't been hacked as well.

Password seems broken for two reasons:

1. password requirement varies and is a pain in the ass. Some sites will ask for at least 8 characters, mix of uppercase and lowercase, one occurence of non-alphanumeric character and the password is at least certain length. Some even go as far as no repeating characters or max password length (8-15 characters).

While the intention is great, it makes password so hard to remember and people are less likely

2. every website runs its own password management. How the heck can I tell website X is actually hashing my password and doing it correctly? I can't.

Persona - single identity is probably the way to go. Adding multi-factor auth will be great. But again, I argue that password by itself is not entirely broken. If the attacker can access the database directly by ssh into the server, then there is also a possibility that the app server can be compromised and therefore alerting app code is just a finger tip away. This is the highest level of attack and the story is over at this stage.

I personally think password is not entirely broken. It has value. By itself it may not be as strong as having multi--step authentication. Authenticating yourself with key-only, or device-key only is the worst thing ever. It's like running EC2 instance. If I delete the instance's key off my computer, I will cry.

So keeping infrastructure secure is important. Multi-factor authentication on the server side is critical. Keeping database apart from app server is too critical.