Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

eff.org

Post reply on HN
Print view View original

21–30 of 38 posts

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#21

Post by ubercow13 »

xte wrote: post #14
hirsin wrote: post #12

Earlier quoted context omitted.

No one should ever be putting your biometrics in the cloud. Similar to a PIN, they are only used to secure a device locally once you've already authenticated. So eg you prove ownership of your email + phone number to authenticate, then save the token locally secured by a fingerprint. For good implementations, it's not a naive token saved to the hard drive but a key saved to the enclave that's initialized during first…

In the end what you say is really "I trust more my device and vendor then myself". Not really a concept I accept... Of course too many lusers use IT devices even for serious work but consider their "luser" characteristic as a natural fact and instead of education prefer trusting a vendor for me is like preferring a dictatorship hoping that "it will be a good one" because people are not adult enough to be in a democra…

So write down the secret OTP key, do the crypto yourself with a pen and paper, or failing that with any device (laptop, hardware TOTP device) you own, using open source software, or build your own using the standard. It's nothing to do with your phone or carrier.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#23

Post by hirsin »

xte wrote: post #14
hirsin wrote: post #12

Earlier quoted context omitted.

No one should ever be putting your biometrics in the cloud. Similar to a PIN, they are only used to secure a device locally once you've already authenticated. So eg you prove ownership of your email + phone number to authenticate, then save the token locally secured by a fingerprint. For good implementations, it's not a naive token saved to the hard drive but a key saved to the enclave that's initialized during first…

In the end what you say is really "I trust more my device and vendor then myself". Not really a concept I accept... Of course too many lusers use IT devices even for serious work but consider their "luser" characteristic as a natural fact and instead of education prefer trusting a vendor for me is like preferring a dictatorship hoping that "it will be a good one" because people are not adult enough to be in a democra…

So don't do SMS OTP and use an authenticator app instead, which is more secure.

And inflammatory comments aside, yes, any good IT org should believe that it's more likely for a user to be phished and give away their super secure xkcd based password than it is for a nation-state attacker to target their phone OS with a 0day.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#24

Post by simongr3dal »

tialaramex wrote: post #19
plopz wrote: post #9

Earlier quoted context omitted.

So instead of password managers we'll have private key managers?

WebAuthn private keys don't exist at all outside of the physical token. So there's nothing to manage. If you rely on WebAuthn as an essential authentication step you'd have two or more tokens registered and treat those the same way you would house keys.

When you lose a house key it's pretty manageable to get a few locks changed, but it can be rather overwhelming to remember all the dozens of websites that have your auth details, and update them.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#25

Post by xte »

ubercow13 wrote: post #21
xte wrote: post #14

Earlier quoted context omitted.

In the end what you say is really "I trust more my device and vendor then myself". Not really a concept I accept... Of course too many lusers use IT devices even for serious work but consider their "luser" characteristic as a natural fact and instead of education prefer trusting a vendor for me is like preferring a dictatorship hoping that "it will be a good one" because people are not adult enough to be in a democra…

So write down the secret OTP key, do the crypto yourself with a pen and paper, or failing that with any device (laptop, hardware TOTP device) you own, using open source software, or build your own using the standard. It's nothing to do with your phone or carrier.

I simply do not need such kind of authentication for myself, at least I do the best to avoid such need.

Try to think of a Plan9-like world, which means user-centered not "modern mainframe centered". We still need services, but there is no need to have them like today.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#26

Post by xte »

hirsin wrote: post #23
xte wrote: post #14

Earlier quoted context omitted.

In the end what you say is really "I trust more my device and vendor then myself". Not really a concept I accept... Of course too many lusers use IT devices even for serious work but consider their "luser" characteristic as a natural fact and instead of education prefer trusting a vendor for me is like preferring a dictatorship hoping that "it will be a good one" because people are not adult enough to be in a democra…

So don't do SMS OTP and use an authenticator app instead, which is more secure. And inflammatory comments aside, yes, any good IT org should believe that it's more likely for a user to be phished and give away their super secure xkcd based password than it is for a nation-state attacker to target their phone OS with a 0day.

Try to think about different scenarios: first not a nation vs nation attack but a simple dictatorship attack against some opponent, something like "hey see! This bad guy have done many criminal thing". Also think about what kind of situation we have today with anything based on few proprietary hardware and software commonly used anywhere.

After think about ancient Plan9 model which put your personal workstation at the center of the world and "services" only as "addition" to it. In this scenario need of auth, risk of phishing etc substantially vanish.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#27

Post by FilterSweep »

I find it very troubling how small/nonexistent the outcry is over such an invasive concept.

The PR teams are already hard at work making Facebookian claims of user privacy control that were found to be grossly untrue.

I personally will need to be diligent in avoiding the firms that adopt this service at all costs.

Furthermore, you have to wonder why seemingly “competitive” entities(as far as an oligopoly goes) would collude to provide such as service. Their motives have already been demonstrated to be bad in the past.

Further reading (if you haven’t already): https://krebsonsecurity.com/2018/09/u-s-mobile-giants-want-t...

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#28

Post by ams6110 »

hirsin wrote: post #12
xte wrote: post #10

Anytime someone say password are not good I reply: can you change fingerprint? Can you change retinal imprint? How accessible are such data? => biometrics it's no good. n-th factor auth: how can we trust a token? I mean at a hardware level? => if we can really control it's a nice ADDITION to password protection, but no more. Other options like "granted third parties" (SSO solution by any kind, from Google to mobile p…

No one should ever be putting your biometrics in the cloud. Similar to a PIN, they are only used to secure a device locally once you've already authenticated. So eg you prove ownership of your email + phone number to authenticate, then save the token locally secured by a fingerprint. For good implementations, it's not a naive token saved to the hard drive but a key saved to the enclave that's initialized during first…

> No one should ever be putting your biometrics in the cloud.

They are likely already there. Ever had to provide fingerprints for an employment background check or security clearance? They have likely been leaked, along with all your other personal history.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#29

Post by dboreham »

civilian wrote: post #2

Why can't we use privatekeys as a way to log into websites? It's good enough for servers, and it's good enough for git access. I'd be way more comfortable about simply having my browser have access to a privatekey, and prompt me to use it to login when a webpage had a keyed login prompt. It seems like privatekey login would solve the problem of guessing & phishing passwords. (Someone plz fork Chromium and build this…

This is what you're doing when you use U2F, right?

Also see: https://w3c-ccg.github.io/did-spec/

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#30

Post by dboreham »

plopz wrote: post #9
tonyhb wrote: post #5

Earlier quoted context omitted.

WebAuthn does this, and chrome/FF/edge support this. They're also adding CTAP2 support allowing the use of biometric, BTLE, and NFC devices to provide authentication keys. Soon you'll be able to use TouchID to log in to your website, provided you've associated the pubkey from your fingerprint authn with your website. https://www.chromestatus.com/features#component%3A%20Blink%3... (TouchID on MacOS: TBD) https://bugs.…

So instead of password managers we'll have private key managers?

AKA "wallet"
Post reply on HN