The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords
1–10 of 38 posts
Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords
#2Why can't we use privatekeys as a way to log into websites? It's good enough for servers, and it's good enough for git access. I'd be way more comfortable about simply having my browser have access to a privatekey, and prompt me to use it to login when a webpage had a keyed login prompt. It seems like privatekey login would solve the problem of guessing & phishing passwords.
(Someone plz fork Chromium and build this in! And hit me up when you want me to make the Django/ExpressJS auth plugin for it.)
Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords
#3Submission from EFF -> FLAGGED
Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords
#4Why can't we use privatekeys as a way to log into websites? It's good enough for servers, and it's good enough for git access. I'd be way more comfortable about simply having my browser have access to a privatekey, and prompt me to use it to login when a webpage had a keyed login prompt. It seems like privatekey login would solve the problem of guessing & phishing passwords. (Someone plz fork Chromium and build this…
you mean something like this?:
https://blog.codesolvent.com/2015/07/why-not-signed-password...
Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords
#5Why can't we use privatekeys as a way to log into websites? It's good enough for servers, and it's good enough for git access. I'd be way more comfortable about simply having my browser have access to a privatekey, and prompt me to use it to login when a webpage had a keyed login prompt. It seems like privatekey login would solve the problem of guessing & phishing passwords. (Someone plz fork Chromium and build this…
WebAuthn does this, and chrome/FF/edge support this. They're also adding CTAP2 support allowing the use of biometric, BTLE, and NFC devices to provide authentication keys.
Soon you'll be able to use TouchID to log in to your website, provided you've associated the pubkey from your fingerprint authn with your website.
https://www.chromestatus.com/features#component%3A%20Blink%3... (TouchID on MacOS: TBD)
https://bugs.chromium.org/p/chromium/issues/detail?id=780078... (CTAP2: merged)
https://www.chromestatus.com/features/6288375388569600.
We're integrating webauthn for our medical clinics as a way to support easy, secure authentication without 2FA to reduce sharing of ipads with a session logged in.
More reading: https://duo.com/blog/developments-to-webauthn-and-the-fido2-...
Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords
#6Why can't we use privatekeys as a way to log into websites? It's good enough for servers, and it's good enough for git access. I'd be way more comfortable about simply having my browser have access to a privatekey, and prompt me to use it to login when a webpage had a keyed login prompt. It seems like privatekey login would solve the problem of guessing & phishing passwords. (Someone plz fork Chromium and build this…
Client certs have existed for a long time. Most sites won't implement them without great demand from the user-base or specific security needs. This would also mean that sites would have to track all of your client certs from each device.
The upside would be that you could tie a cert to a specific hardware device and serial number, which means someone getting your certs won't be useful to them. Microsoft does something like this for xbox "machine" accounts. Each device can have it's own password that is tied to that serial number. If leaked, the password (or cert in this case) is not useful anywhere else. This is similar in concept to tieing an ssh public key to a specific network or IP address, except it is a hardware identifier in this case.
Unpopular opinion disclaimer: Anything else pretty much requires tieing into some 3rd party auth service or hardware token which have their own issues, such as vendor lock-in, managing server side libraries, leaking usage data to 3rd party providers, creating weak-chain back-doors to 3rd party vendors, privacy violations, etc.. I know those are all the rage right now among technical folk, but the general public adoption is quite low. Passwords will be around for a very long time.
Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords
#7Why can't we use privatekeys as a way to log into websites? It's good enough for servers, and it's good enough for git access. I'd be way more comfortable about simply having my browser have access to a privatekey, and prompt me to use it to login when a webpage had a keyed login prompt. It seems like privatekey login would solve the problem of guessing & phishing passwords. (Someone plz fork Chromium and build this…
WebAuthn does this, and chrome/FF/edge support this. They're also adding CTAP2 support allowing the use of biometric, BTLE, and NFC devices to provide authentication keys. Soon you'll be able to use TouchID to log in to your website, provided you've associated the pubkey from your fingerprint authn with your website. https://www.chromestatus.com/features#component%3A%20Blink%3... (TouchID on MacOS: TBD) https://bugs.…
Awesome!!
Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords
#8There's simply no way I trust AT&T, Sprint, T-Mobile, and Verizon to secure my private information.
Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords
#9Why can't we use privatekeys as a way to log into websites? It's good enough for servers, and it's good enough for git access. I'd be way more comfortable about simply having my browser have access to a privatekey, and prompt me to use it to login when a webpage had a keyed login prompt. It seems like privatekey login would solve the problem of guessing & phishing passwords. (Someone plz fork Chromium and build this…
WebAuthn does this, and chrome/FF/edge support this. They're also adding CTAP2 support allowing the use of biometric, BTLE, and NFC devices to provide authentication keys. Soon you'll be able to use TouchID to log in to your website, provided you've associated the pubkey from your fingerprint authn with your website. https://www.chromestatus.com/features#component%3A%20Blink%3... (TouchID on MacOS: TBD) https://bugs.…
So instead of password managers we'll have private key managers?
Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords
#10Anytime someone say password are not good I reply: can you change fingerprint? Can you change retinal imprint? How accessible are such data? => biometrics it's no good.
n-th factor auth: how can we trust a token? I mean at a hardware level? => if we can really control it's a nice ADDITION to password protection, but no more.
Other options like "granted third parties" (SSO solution by any kind, from Google to mobile phone auth) IMVHO can be trusted LESS than passwords. So in the end we only need to teach XKcd password strength vignette and teach developer how to care about security.