Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

eff.org

Post reply on HN
Print view View original

31–38 of 38 posts

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#31

Post by ObsoleteNerd »

rustamm wrote: post #16

Phone numbers are awful for authentication. I stopped using my Russian phone number once I moved to the US and mobile carrier just reassigned that phone number to some other customer. I found out when I saw myself in my Telegram contact list having other person's avatar and I assume people who had my old phone number in contacts also saw a new account in their Telegram contact lists under my name.

In Australia it's outright common to have recycled numbers. I've had a few. My work phone had to be given a new number 3 times in the first 6 months until I had a useable one, because I kept getting random calls at all hours of the day/night looking for people who weren't me. It's mostly for work phones for some reason (I assume they have a higher rotation of useage as employees come and go, and nearly all companies use the same provider, Telstra), but my brother got a number that was someone else's before him too so it does happen privately.

The idea of phone numbers being the prime authenticator is laughable. I'll actively avoid any service who ever does this.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#32

Post by marcus_holmes »

I move country every month or so at the moment. Since telecom providers choose to charge vast sums of money for roaming, I have to get a new sim card in each country. So this whole system is just not going to work for me.

It also means that my phone number is meaningless. I never answer it, as I only use messaging (or messaging calls) to talk to people. But this isn't unique to my situation. A lot of non-roaming friends are the same - they never use phone or even SMS any more. The only people who phone using your number are spammers, scammers and marketroids.

I'm an edge case, but what of someone going on holiday for two weeks? At the moment, they still get a local SIM, because it's massively cheaper than roaming. This would prevent that.

Maybe that's the point - the telecoms companies need a way to keep us locked to our SIMs so we can't switch providers at the drop of a hat.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#33

Post by hirsin »

ams6110 wrote: post #28
hirsin wrote: post #12

Earlier quoted context omitted.

No one should ever be putting your biometrics in the cloud. Similar to a PIN, they are only used to secure a device locally once you've already authenticated. So eg you prove ownership of your email + phone number to authenticate, then save the token locally secured by a fingerprint. For good implementations, it's not a naive token saved to the hard drive but a key saved to the enclave that's initialized during first…

> No one should ever be putting your biometrics in the cloud. They are likely already there. Ever had to provide fingerprints for an employment background check or security clearance? They have likely been leaked, along with all your other personal history.

Fair - to be pedantic, no IDP should accept your biometrics as a credential on its own, addressable from anywhere on the internet.

The goal is that an attacker has to steal your physical device and get access to your biometrics, which is significantly more work than spraying aardvark to zebra against an ROPC endpoint.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#34

Post by LoSboccacc »

marcus_holmes wrote: post #32

I move country every month or so at the moment. Since telecom providers choose to charge vast sums of money for roaming, I have to get a new sim card in each country. So this whole system is just not going to work for me. It also means that my phone number is meaningless. I never answer it, as I only use messaging (or messaging calls) to talk to people. But this isn't unique to my situation. A lot of non-roaming frie…

Same here. Even if I am not a frequent roamer, I changed country every now and then.

Whatsapp already shows how painful is to use ephemeral phone numbers as identity: when you change your number, even with their migration procedure, you still have to notify all your contacts, because at most numbers are authentication, not identification. Doesn't strike me as unusual however that corporations with obsession on control and snooping are trying to conflate the two.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#35

Post by jsjohnst »

xte wrote: post #10

Anytime someone say password are not good I reply: can you change fingerprint? Can you change retinal imprint? How accessible are such data? => biometrics it's no good. n-th factor auth: how can we trust a token? I mean at a hardware level? => if we can really control it's a nice ADDITION to password protection, but no more. Other options like "granted third parties" (SSO solution by any kind, from Google to mobile p…

> So in the end we only need to teach XKcd password strength vignette

I hate seeing XKCD style passwords being advocated like this all the time. If I know your password is “four English words”, it’s pretty much game over. While there are well over 100,000+ English words, the average English speaking person would draw from a list of about 5,000. 5,000^4 is only 625 trillion combinations. With GPU based password cracking easily topping 150B/sec these days (depending on algo), you can see how this isn’t as secure as you’d otherwise think.

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#36

Post by LinuxBender »

rkeene2 wrote: post #20
LinuxBender wrote: post #18

Earlier quoted context omitted.

I would fully expect some government sites to require client certs. Some DNS registrars also required client certs in addition to 2FA. Some payment systems also require them in addition to IP restrictions.

HSPD-12 largely abolished passwords as authenticators throughout the executive branch.

Hopefully all of their authentication methods are hosted in-house, on-prem and not outsourced or outside of secure boundaries. Everything has a back-door these days and leaks like a waterfall. :-)

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#37

Post by tialaramex »

simongr3dal wrote: post #24
tialaramex wrote: post #19

Earlier quoted context omitted.

WebAuthn private keys don't exist at all outside of the physical token. So there's nothing to manage. If you rely on WebAuthn as an essential authentication step you'd have two or more tokens registered and treat those the same way you would house keys.

When you lose a house key it's pretty manageable to get a few locks changed, but it can be rather overwhelming to remember all the dozens of websites that have your auth details, and update them.

Good news. Like a house key, the FIDO keys are basically anonymous. So, as long as you didn't e.g. leave it with your wallet on a bus, or write on it with non-erasable marker "simongr3dal@example.com" losing the key is not that scary.

In fact, unlike a house key, the Security Key works fine for its new owner, they can register it to sign into their Facebook, or whatever, that will work fine. Facebook will have no idea it's your key, now it's their key.

If they know you're simongr3dal@example.com on Facebook then that's a problem, yes, as obviously they can sign in as you, but if it's so hard for you to remember what you signed up to, seems like it'll be pretty hard for a hypothetical finder to figure out too... "Hmm, I wonder if this random stranger was into Diaper Porn and Antique furniture?"

Re: The Devil Is in the Details of Project Verify’s Goal to Eliminate Passwords

#38

Post by rkeene2 »

LinuxBender wrote: post #36
rkeene2 wrote: post #20

Earlier quoted context omitted.

HSPD-12 largely abolished passwords as authenticators throughout the executive branch.

Hopefully all of their authentication methods are hosted in-house, on-prem and not outsourced or outside of secure boundaries. Everything has a back-door these days and leaks like a waterfall. :-)

A lot of the authentication is TLS client certificate authentication, SAML hosted by internal SAML IdP systems (such as ADFS) for web stuff.

For most other things Kerberos (via PKINIT) is used.

SSH authentication X.509 using PKIXSSH is rarely used since it is not a standard part of any operating systems used. For SSH, typically either Kerberos or SSH keys based on the RSA keys used by the certificates.

Post reply on HN