--- title: New Wall Street Rule May End Username and Password description: A key Wall Street regulator is "very likely" to tighten rules on access to online information after hacks at Anthem and J.P. Morgan. canonical: https://time.com/3700203/anthem-identity-theft-hacking/ author: Massimo Calabresi article:opinion: false article:content_tier: free article:published_time: 2015-02-09T10:00:55.000Z article:modified_time: 2026-08-04T07:40:47.828Z article:section: Politics og:title: This Could Be the End of Username and Password og:description: Logging in may soon be more difficult. og:url: https://time.com/3700203/anthem-identity-theft-hacking/ og:site_name: TIME og:image: https://static.time.com/v3/assets/bltea6093859af6183b/bltb1b429cc8a2c81ea/69877e2acd68480b25099938/benjamin-lawsky.jpg?branch=production&width=3840&quality=75&auto=webp&crop=16:9 og:image:width: 1200 og:image:height: 675 og:image:alt: Superintendent of the New York State Department of Financial Services Benjamin Lawsky Interview og:type: article twitter:card: summary_large_image twitter:title: This Could Be the End of Username and Password twitter:description: Logging in may soon be more difficult. twitter:image: https://static.time.com/v3/assets/bltea6093859af6183b/bltb1b429cc8a2c81ea/69877e2acd68480b25099938/benjamin-lawsky.jpg?branch=production&width=3840&quality=75&auto=webp&crop=16:9 ---  # This Could Be the End of User Name and Password ## Video: How to Make a Strong Password (and Actually Remember It) [Watch (HLS stream): How to Make a Strong Password (and Actually Remember It)](https://cdn.jwplayer.com/manifests/A70BkJLi.m3u8) (0:53)  _Published 2014-03-07. Hi! I'm Doug, and I'm a 35-year-old. Do you want to dance?_  by [Massimo Calabresi](https://time.com/author/massimo-calabresi/)  ## Massimo Calabresi Calabresi is TIME’s Washington bureau chief. Feb 9, 2015 10:00 AM UTC  Benjamin Lawsky superintendent of the New York State Department of Financial Services, speaks during a Bloomberg Television interview in New York on Nov. 24, 2014. Benjamin Lawsky superintendent of the New York State Department of Financial Services, speaks during a Bloomberg Television interview in New York on Nov. 24, 2014.Scott Eels—Bloomberg/Getty Images  by [Massimo Calabresi](https://time.com/author/massimo-calabresi/)  ## Massimo Calabresi Calabresi is TIME’s Washington bureau chief. Feb 9, 2015 10:00 AM UTC A top New York State [regulator](http://www.dfs.ny.gov/index.htm) is “very likely” to impose new cyber-security rules on much of the banking and insurance industries after high profile cyber-intrusions at Anthem and JP Morgan Chase, law enforcement officials tell TIME. The move could spell the beginning of the end for a decade-long debate among state and federal regulators over whether to require companies to go beyond the simple user name and password identity checks required to access many computer networks at the heart of America’s financial system and could affect everyone from employees at those firms to the consumers they serve. Early investigations in the Anthem case suggest foreign hackers used the user name and password of a company executive to get inside Anthem’s system and make off with personal data for 80 million people, including names, addresses and Social Security numbers, the law enforcement officials tell TIME. Anthem had invested in extensive cyber defenses in recent years, but the officials say initial investigations suggest the theft could have been averted if the company had embraced tougher methods for verifying the identity of those trying to access its systems. That shortcoming reflects systemic weaknesses found throughout the industry in an upcoming study by the New York State Department of Financial Services, a version of which was reviewed by TIME. Among the most worrying findings was a marked level of over-confidence among insurance industry officials regarding the security of their systems. “Anthem is a wake-up call to the insurance sector really showing that there is a huge potential vulnerability here,” says Benjamin Lawsky, the department’s superintendent. While many big health, life and property insurers boast robust cyber-defenses, including encryption for data transfers, firewalls, and anti-virus software, many still rely on relatively weak verification methods for employees and consumers, and have lax controls over third-party vendors that have access to their systems and the personal data contained there, according to the report. The study follows a similar [review](http://www.americanbanker.com/news/bank-technology/new-york-cybersecurity-exams-will-be-tougher-than-ffiecs-1071603-1.html?zkPrintable=1&nopagination=1) by Lawsky’s office of the banking sector late last year that [led](http://www.wsj.com/articles/lawsky-targets-banks-cyberattack-vulnerability-1413941506) to [tighter cyber-examinations](http://www.americanbanker.com/news/bank-technology/new-york-cybersecurity-exams-will-be-tougher-than-ffiecs-1071603-1.html?zkPrintable=1&nopagination=1) for banks doing business in New York. ### These Vintage Computer Ads Show We've Come a Long, Long Way  1974  1976  1976  1977 Picasa 3.0  1977  1978  1978  1980  1980  1981  1983  1983  1983  1984 As the fourth-largest state and the home to many of the corporations in question, New York could affect consumers in other states with its decisions. For more than a decade, federal and state regulators have debated measures to require increased security at banks and insurance companies that handle the financial and personal details of hundreds of millions of Americans. In 2005, the [federal body](http://www.ffiec.gov/) charged with setting the examination standards for federal regulators [concluded](https://www.fdic.gov/news/news/financial/2005/fil10305.html) \[[pdf](http://time.com/wp-content/uploads/2015/02/authentication%5Fguidance.pdf)\] that simple user name and password systems were “inadequate” for “transactions involving access to customer information or the movement of funds to other parties,” but stopped short of requiring tighter measures. Updated guidance in 2011 \[[pdf](http://time.com/wp-content/uploads/2015/02/auth-its-final%5F6-22-11%5F%28ffiec%5Fformated%29.pdf)\] also stopped short of requiring them. **MORE** [Apple Might Make Computers You Control With Hand Gestures](http://time.com/3665721/apple-patent-gesture-control/) The primary federal regulator of big banks, the Office of the Comptroller of the Currency (OCC) says different banks need to assess their own risks in determining whether to use additional verification methods. Other regulators have worried that if one agency, like the New York State Department of Financial Services, tightens standards on its own, the result will be a patchwork of rules that make life difficult for banks doing business across the country. Still, most agree that username and password security alone is increasingly vulnerable to hackers. As American Banker [reports](http://www.americanbanker.com/news/bank-technology/growing-list-of-firms-works-to-solve-banks-digital-identity-crisis-1071578-1.html): --- > “” --- The additional measures New York State is likely to require are known as “multi-factor authentication” and include a range of approaches to verify the identity of those trying to sign on to a computer system. Options include sending a confirmation number to an individual’s cell phone, using a fingerprint or other biometric authentication, or using a separate identification source, like a swipe card. Lawsky has not decided whether his new rule would require institutions to use multi-factor authentication only for employees and third-party vendors, or whether consumers would be required to use them too. However, requiring major banks and insurers under his purview—such as Barclays, Goldman Sachs, Anthem and others—to adopt multi-factor authentication could change the industry standard. Lawsky says he is eager to see that change. “The password system should have been buried a long time ago, and its high time we buried it,” Lawsky tells TIME. “We really need everyone to go to a system of multi-factor verification. It is just too easy, whether through basic hacking or through phishing or stealing basic information, for hackers to get a password and a user name and then to get into a system,” he says. **MORE** [Why Your Passwords Are Easy To Hack](http://time.com/3643678/password-hack/) State and federal officials have argued that banking and insurance cyber vulnerabilities pose a threat not just to the accounts of individual consumers, but potentially to the stability of the entire financial system. The Obama administration’s recently released National Security Strategy says, “the danger of disruptive and even destructive cyber-attack is growing,” thanks to “malicious government, criminal, and individual actors,” targeting the networked infrastructure on which economy, safety, and health rely. The New York State Department of Financial Services study of the insurance industry shows most are largely convinced they are confronting and defeating hackers. 58% claimed they had experienced no security breaches during the three years preceding the 2013-14 study, while 35% said they had only between one and five such incidents. To some that suggests naiveté on the part of the industry. As FBI Director James Comey [said](http://www.cbsnews.com/news/fbi-director-james-comey-on-threat-of-isis-cybercrime/) last fall, “There are two kinds of big companies in the United States. There are those who’ve been hacked by the Chinese and those who don’t know they’ve been hacked by the Chinese.” In addition to the new rules on identity verification, Lawsky expects to impose new requirements on third-party vendors that have access to insurance company databases. Those vendors often have lower cyber-security standards and are not required to describe those standards to the companies even though they often have full access to personal data held by the company. ### See The 15 Best Video Game Graphics of 2014  Call of Duty: Advanced Warfare. Activision's futuristic first-person shooter in which players take on a rogue private military company uses a brand new engine built specifically for PCs and new-gen consoles to handle its cutting-edge lighting, animation and physics. Sledgehammer Games/Activision  Far Cry 4\. This pulled back shot of fictional Himalayan region Kyrat is in-game, believe it or not, rendered with an overhauled version of the engine Ubisoft used to design Far Cry 3. Ubisoft  The Last of Us: Remastered. Naughty Dog's meditation on the worst (and best) of humanity is built on technology that reaches back through the studio's pulp-adventure Uncharted series. The graphics are so impressive, TIME recently assigned a conflict photographer to photograph inside the game. Ashley Gilbertson for TIME  Alien: Isolation Built from scratch, the Alien: Isolation engine's outstanding deep space visuals all but replicate the set design of Alien film concept artists H.R. Giger and Ron Cobb's work. The Creative Assembly  Assassin's Creed Unity. Ubisoft says it "basically remade the whole rendering engine" in its AnvilNext design tool to handle the studio's meticulous recreation of Paris during the French Revolution. Ubisoft  Child of Light Inspired by filmmakers like Hayao Miyazaki and artist Yoshitaka Amano, Child of Light's hand-drawn artwork puts the lie to presumptions that graphical richness depends on shader support or polygon counts. Ubisoft  Destiny Built from scratch by ex-Halo studio Bungie, Destiny's game engine was designed to scale across the next decade, says the studio. Bungie  Mario Kart 8 Nintendo's kart-racer for Wii U reminds us that raw horsepower is just a facet of crafting a beautiful game world. Nintendo  Infamous Second Son Sucker Punch's freeform Seattle-based superhero adventure models all sorts of minutia, from the intricate wrinkling of an aged character's face to the way eyelids stick, slightly, before separating when characters blink. Sucker Punch Productions  Monument Valley Escher-like at first glance, Ustwo's mind-bending puzzler was also inspired by posters, bonsai plants, arabic calligraphy and filmmaker Tarsem Singh's The Fall. Ustwo  Grand Theft Auto V Rockstar's remastered crime spree opus was crafted from an in-house engine first employed in a game that simulated table tennis. Rockstar  Titanfall Respawn Entertainment  Forza Horizon 2 Turn 10's Euro-racer actually models light refracted through drops of moisture, the render tech plausibly simulating something as intangible but essential as the earth’s atmosphere. Microsoft Studios/Turn 10 Studios  80 Days Inkle's anti-colonialist vamp on Jules Verne's famous novel uses crisp art deco imagery inspired by travel posters to unfurl 80 Days' tale of intrepid globetrotters Monsieur Fogg and his valet Passepartout. Inkle  Tomb Raider Crystal Dynamics' radical reboot of its popular series about an athletic archaeologist uses a modified version of the engine that powered Tomb Raider: Legend in 2006. Square Enix _Read next:_ [_The 7 Biggest Lies You’ve Been Told About Hacking_](http://time.com/3667853/lies-about-hacking/?xid=time%5Freadnext) [_Listen to the most important stories of the day._](http://time.com/newsletter/the-brief/?sl%5Fautoplay=true&xid=spl-fullbrief-article) ```json [{"@context":"https://schema.org","@type":"NewsArticle","@id":"https://time.com/3700203/anthem-identity-theft-hacking/","mainEntityOfPage":{"@type":"WebPage","@id":"https://time.com/3700203/anthem-identity-theft-hacking/"},"headline":"This Could Be the End of User Name and Password","datePublished":"2015-02-09T10:00:55.000Z","dateModified":"2026-08-04T07:40:47.828Z","description":"Anthem, J.P. Morgan hacks could lead to tougher online security.","url":"https://time.com/3700203/anthem-identity-theft-hacking/","keywords":["Cybercrime","Barack Obama","White House","Hacking","Insurance","Banking","James Comey","Anthem"],"thumbnailUrl":"https://static.time.com/v3/assets/bltea6093859af6183b/bltb1b429cc8a2c81ea/69877e2acd68480b25099938/benjamin-lawsky.jpg?branch=production&width=1200&quality=75&auto=webp&crop=1200:675&height=675","author":[{"@type":"Person","name":"Massimo Calabresi","jobTitle":"Calabresi is TIME’s Washington bureau chief.","url":"https://time.com/author/massimo-calabresi/"}],"articleSection":"Politics","image":[{"@type":"ImageObject","url":"https://static.time.com/v3/assets/bltea6093859af6183b/bltb1b429cc8a2c81ea/69877e2acd68480b25099938/benjamin-lawsky.jpg?branch=production&width=1200&quality=75&auto=webp&crop=1200:675&height=675","width":1200,"height":675,"headline":"Superintendent of the New York State Department of Financial Services Benjamin Lawsky Interview","caption":"Superintendent of the New York State Department of Financial Services Benjamin Lawsky Interview","creditText":"Scott Eels—Bloomberg/Getty Images","representativeOfPage":true}],"publisher":{"@type":"Organization","name":"Time","url":"https://time.com/","logo":{"@type":"ImageObject","url":"https://time.com/images/logo.png","width":528,"height":156},"foundingDate":"March 3, 1923","sameAs":["https://www.facebook.com/time","https://www.instagram.com/time/?hl=en","https://twitter.com/time","https://www.pinterest.com/timemagazine"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/section/politics/","name":"Politics"}},{"@type":"ListItem","position":2,"item":{"@id":"/tag/cybercrime/","name":"Cybercrime"}},{"@type":"ListItem","position":3,"item":{"@id":"https://time.com/3700203/anthem-identity-theft-hacking/","name":"This Could Be the End of User Name and Password"}}]},{"@context":"https://schema.org","@type":"VideoObject","name":"How to Make a Strong Password (and Actually Remember It)","description":"Hi! I'm Doug, and I'm a 35-year-old. Do you want to dance?","thumbnailUrl":"https://cdn.jwplayer.com/v2/media/A70BkJLi/poster.jpg?width=720","uploadDate":"2014-03-07T17:11:12.000Z","contentUrl":"https://cdn.jwplayer.com/manifests/A70BkJLi.m3u8","embedUrl":"https://time.com/3700203/anthem-identity-theft-hacking/","duration":"PT53S","potentialAction":{"@type":"SeekToAction","target":"https://time.com/3700203/anthem-identity-theft-hacking/?jw_start={seek_to_second_number}","startOffset-input":"required name=seek_to_second_number"}}] ```