Password is like email, even slack would not be able to kill it.
Why [Insert Thing Here] Is Not a Password Killer
21–30 of 277 posts
Re: Why [Insert Thing Here] Is Not a Password Killer
#22> Despite their respective merits, every one of these solutions has a massive shortcoming that severely limits their viability and it's something they simply can't compete with: > Despite it's many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. This is (mostly) true, however, there is already evidence that new…
I've always been of the opinion that biometrics are much more closely related to a username rather than a password. There will always be ways to either fake or compel biometric scans, and having a second layer of proof required to authenticate and authorize seems like the only responsible thing to do.
Re: Why [Insert Thing Here] Is Not a Password Killer
#23If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all? What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? How could that _possibly_ be more friction? It would be strictly less. Hell, it could be done without even informing the user that this new feature was being…
I wouldn’t say 2FA or password managers have “taken off”. I don’t have numbers, but just from my small sample of friends/family, only people who are technically advanced or who I have forced (my wife ;) use password managers.
Re: Why [Insert Thing Here] Is Not a Password Killer
#24Earlier quoted context omitted.
Biometrics is essentially putting a massively complex system in front of your password input, that lets the device read the password off your body, but the consequences are a) you now can't ever change your password, and b) there's this massively complex system in front of (now hidden) password form, and complexity means unreliability and exploitable holes. The reason it seems to be working in phones and in laptops i…
It’s also not the complexity that’s the problem. Even if it’s flawless, which is impossible, with biometrics you can easily be coerced into giving access without effort, whereas we haven’t invented a mind reader yet. In other words I can easily imagine kids gaining access to a credit card via fingerprints or facial recognition, while their parents are sleeping ;-) I wanted to write about law enforcement agencies, but…
> In other words I can easily imagine kinds gaining access to a credit card via fingerprints or facial recognition, while their parents are sleeping ;-)
Kids, or partners. There even was this funny video making rounds around the Internet couple years back[0].
The point about coercion is good too.
--
Re: Why [Insert Thing Here] Is Not a Password Killer
#25Here's the "password" killer: generating random passwords on the server and never letting users input their own passwords.
All issues with reused passwords, password strength, hashing passwords with slow hashes, etc. instantly solved.
Also improves conversion rate since there's no risk the user gives up signing up because he can't be bothered to think about or generate a password.
Re: Why [Insert Thing Here] Is Not a Password Killer
#26I always liked the idea of having a password entry system where a single observation doesn’t provide enough information to reveal the password [0]. However in addition to creating issues with the secure storage of the password... I don’t think people would be able to use it reliably. Still, some banks still seem to use the “enter the Nth letter of your password” scheme” which seems almostly equally unworkable... [0]…
The Nth letter of password thing sounds sketchy to me. Mostly because it sounds like they have my password in plaintext if they can check that.
Yes, it almost certainly is quite sketchy... I can’t think of any way it could be securely implemented. In the case I’ve seen it’s the only password used...
I wonder if there is a hashing scheme that would work with some kind of ambiguous entry... I.e. “is the 3rd digit between 5 and 10”.
If you could confirm certain properties of a password/pin from its hash...
Re: Why [Insert Thing Here] Is Not a Password Killer
#27> Despite their respective merits, every one of these solutions has a massive shortcoming that severely limits their viability and it's something they simply can't compete with: > Despite it's many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. This is (mostly) true, however, there is already evidence that new…
Fingerprint scan and Facial recognition can not replace password authentication because both face and fingerprint are public information, while password is meant to be private. You cannot hide your face or fingerprint from others.
As a rule of thumb (pun not intended), biometric data is a username, not a password.
Re: Why [Insert Thing Here] Is Not a Password Killer
#28> Despite it's [sic] many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. I think the problem is that people don't understand how to use passwords. They will reuse them among sites. They pick easily-guessable and low entropy ones. They will type them into any website that asks. The end result is that not much s…
> I think the problem is that people don't understand how to use passwords.
They do understand it. They just trade security for laziness.
Re: Why [Insert Thing Here] Is Not a Password Killer
#29Password is like email, even slack would not be able to kill it.
Because I don't want to use some proprietary silo for communication just like I don't want to install some websites shitty app to be able to log in.
Re: Why [Insert Thing Here] Is Not a Password Killer
#30If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all? What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? How could that _possibly_ be more friction? It would be strictly less. Hell, it could be done without even informing the user that this new feature was being…
I wouldn’t say 2FA or password managers have “taken off”. I don’t have numbers, but just from my small sample of friends/family, only people who are technically advanced or who I have forced (my wife ;) use password managers.
Well hey, it's a start. They've got more adoption than Troy claims any of the niche experimental password replacers do.