11–20 of 145 posts
The truth is the password is just another failed security concept- because those that work, cant be remembered by the users. So ones security researches terrible, is a neurologists reasonable. The actually embarrassing part is that after years of research- we still do not have a alternative.
Or even better: Some kind of hardware token and a good standard that goes with it?
If you're responsible for running a website, how are you going to be resilient against attackers who come to your site with legitimate usernames and passwords of your members? One way is to email the user when they log in from a new device or computer. They then have to enter a 6 digit one time password from the email. Someone who grabs the users email and password from a breach would also need access to their email.
No, please don't. This is arduous for those of us who like a bit of privacy and regularly clear their cookies etc.
The truth is the password is just another failed security concept- because those that work, cant be remembered by the users. So ones security researches terrible, is a neurologists reasonable. The actually embarrassing part is that after years of research- we still do not have a alternative.
How about a password manager? Or even better: Some kind of hardware token and a good standard that goes with it?
The truth is the password is just another failed security concept- because those that work, cant be remembered by the users. So ones security researches terrible, is a neurologists reasonable. The actually embarrassing part is that after years of research- we still do not have a alternative.
> because those that work, cant be remembered by the users Remind me what's wrong with "correct horse battery staple" again?
How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.
Earlier quoted context omitted.
No, please don't. This is arduous for those of us who like a bit of privacy and regularly clear their cookies etc.
I guess this isn't typically based on cookies but device/browser fingerprinting.
If you're responsible for running a website, how are you going to be resilient against attackers who come to your site with legitimate usernames and passwords of your members? One way is to email the user when they log in from a new device or computer. They then have to enter a 6 digit one time password from the email. Someone who grabs the users email and password from a breach would also need access to their email.
I use auth0, and have it configured for passwordless use.
If you have a Google Account or Microsoft Account then you can simply use the OIDC / OAuth flow and have those third parties that you trust identify you and handle the authentication... we only ask for an email as it's necessary for our service. Because it's only auth0 talking to the identity provider, Google and Microsoft don't actually get to see which site you're signing into.
If you don't have those, then you can just use an email code. We email you a single-use expiring (15 minutes) code, you enter it and gain access.
In this scenario email becomes your identity.
I use private browsing for everything... this is a bit inconvenient as password managers cannot handle this email verification flow. But for me that's good... I want this level of security for myself, I want the service not to be storing passwords whilst also not permitting identity providers to know what I'm signing into.
86% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.
2. What kinds of websites that require a sign-in are actually low-consequence? I can't think of any from the top of my head, but that's probably because I'm pretty reluctant to sign up to new sites.
Earlier quoted context omitted.
How about a password manager? Or even better: Some kind of hardware token and a good standard that goes with it?
People should use password managers, but it's a crutch.
Earlier quoted context omitted.
> because those that work, cant be remembered by the users Remind me what's wrong with "correct horse battery staple" again?
Remembering a unique one for every site is hard.