Assuming that a classified data be protected by an encryption key of 256-bit entropy and the program to manage the system be protected by a manager’s password such as P@$$WoRd1234, the chances may well be that the system will have been taken over by the criminals who broke the password rather than those who tried to attack the 256-bit encryption key. As such no security frameworks can be securer than the passwords of the managers and users. It could be emphasized that sufficiently strong passwords are the key for the safe deployment of cryptography..

Many people shout that the password is dead or should be killed dead. The password could be killed only when there is an alternative to the password. Something belonging to the password （PIN, passphrase, etc） and something dependent on the password (ID federations, 2/multi-factor, etc) cannot be the alternative to the password. Neither can be something that has to be used together with the password (biometrics, auto-login, etc).

At the root of the password headache is the cognitive phenomena called “interference
of memory”, by which we cannot firmly remember more than 5 text passwords on average. What worries us is not the password, but the textual password. The
textual memory is only a small part of what we remember. We could think of making use of the larger part of our memory that is less subject to interference of memory. More attention could be paid to the efforts of expanding the password system to include images, particularly KNOWN images, as well as conventional texts.