Why [Insert Thing Here] Is Not a Password Killer
troyhunt.com
Why [Insert Thing Here] Is Not a Password Killer
1–10 of 277 posts
Re: Why [Insert Thing Here] Is Not a Password Killer
#2A little boring and reactionary, I think. Unguessable capabilities (long unchoosable URLs mostly) have been used to replace passwords. Plenty of systems refuse to let users choose passwords, and many common password problems are totally mitigated by this design.
Re: Why [Insert Thing Here] Is Not a Password Killer
#3I always liked the idea of having a password entry system where a single observation doesn’t provide enough information to reveal the password [0].
However in addition to creating issues with the secure storage of the password... I don’t think people would be able to use it reliably.
Still, some banks still seem to use the “enter the Nth letter of your password” scheme” which seems almostly equally unworkable...
[0] https://41j.com/blog/2011/10/unobservable-pin-and-password-e...
Re: Why [Insert Thing Here] Is Not a Password Killer
#4A little boring and reactionary, I think. Unguessable capabilities (long unchoosable URLs mostly) have been used to replace passwords. Plenty of systems refuse to let users choose passwords, and many common password problems are totally mitigated by this design.
That depends on what you want to do. Do you want to authenticate the system of the user or the user him/herself?
If its the latter, then how do you protect the link from other uses of this system? Encryption? And how are you encrypting something? Password? If you do it via a keyfile then how do you protect the keyfile? If you do it via a hardware token, how do you prevent other people from stealing and using it?
Re: Why [Insert Thing Here] Is Not a Password Killer
#5It is not just that everyone knows how passwords work. It is also that you can always enter a password.
What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there?
I will pretty much always be able to enter a string of characters. To quote the unix phillosphy:
Text is the universal interface.
Re: Why [Insert Thing Here] Is Not a Password Killer
#6I always liked the idea of having a password entry system where a single observation doesn’t provide enough information to reveal the password [0]. However in addition to creating issues with the secure storage of the password... I don’t think people would be able to use it reliably. Still, some banks still seem to use the “enter the Nth letter of your password” scheme” which seems almostly equally unworkable... [0]…
The Nth letter of password thing sounds sketchy to me. Mostly because it sounds like they have my password in plaintext if they can check that.
Re: Why [Insert Thing Here] Is Not a Password Killer
#7I haven't heard of any system that replaces passwords all the way. Apart from usability most systems eighter rely on things that are hard to change (biometrics), things that can be copied (keyfiles, cookies, software) or things that can be stolen (hardware token). So they don't replace something that you have to remember (password).
Passwords are easy to change and while they can be copied, that would be the result of the user or the login software doing something stupid. Not something wrong with concept of the password login itself.
IMO those systems can be used to make the login more secure but replacing password all together not so much.
Re: Why [Insert Thing Here] Is Not a Password Killer
#8I always liked the idea of having a password entry system where a single observation doesn’t provide enough information to reveal the password [0]. However in addition to creating issues with the secure storage of the password... I don’t think people would be able to use it reliably. Still, some banks still seem to use the “enter the Nth letter of your password” scheme” which seems almostly equally unworkable... [0]…
The Nth letter of password thing sounds sketchy to me. Mostly because it sounds like they have my password in plaintext if they can check that.
It's usually in addition to a password.
Re: Why [Insert Thing Here] Is Not a Password Killer
#9I always liked the idea of having a password entry system where a single observation doesn’t provide enough information to reveal the password [0]. However in addition to creating issues with the secure storage of the password... I don’t think people would be able to use it reliably. Still, some banks still seem to use the “enter the Nth letter of your password” scheme” which seems almostly equally unworkable... [0]…
The Nth letter of password thing sounds sketchy to me. Mostly because it sounds like they have my password in plaintext if they can check that.
No they just store a checksum for every letter of your password.
/s
Re: Why [Insert Thing Here] Is Not a Password Killer
#10> Despite their respective merits, every one of these solutions has a massive shortcoming that severely limits their viability and it's something they simply can't compete with:
> Despite it's many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone.
This is (mostly) true, however, there is already evidence that new technology could kill the password indeed. What I am talking about is modern phones which all come with a fingerprint scan or facial recognition which, from my own limited experience and my own observations, has mostly killed of the "passcode" on the phone. Yes our phones still make us pick a passcode, but unless forced to use it nobody does anymore. Even my technology incompetent mother uses the fingerprint scan to log into her phone and I don't see why something similar couldn't replace the current experience of her having to type an insecure password into her hotmail all the time.