Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why [Insert Thing Here] Is Not a Password Killer

troyhunt.com

Post reply on HN
Print view View original

31–40 of 277 posts

Re: Why [Insert Thing Here] Is Not a Password Killer

#31

Post by lowercased »

jrockway wrote: post #17

> Despite it's [sic] many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. I think the problem is that people don't understand how to use passwords. They will reuse them among sites. They pick easily-guessable and low entropy ones. They will type them into any website that asks. The end result is that not much s…

i had a theory a few years back that human-chosen passwords would get simpler due to mobile keyboards. Not sure if anyone has compared leaked password dumps from before and after the great mobile-migration to see if that's happened or not.

Re: Why [Insert Thing Here] Is Not a Password Killer

#32

Post by bhaak »

cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

I see where you are coming from but sometimes you have to enforce some things. If you don't have 2FA, you can't login into this site is a completely rational consequence if for example this site is handling financial assets of yours.

But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself).

Re: Why [Insert Thing Here] Is Not a Password Killer

#33

Post by sametmax »

amf12 wrote: post #28
jrockway wrote: post #17

> Despite it's [sic] many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. I think the problem is that people don't understand how to use passwords. They will reuse them among sites. They pick easily-guessable and low entropy ones. They will type them into any website that asks. The end result is that not much s…

> I think the problem is that people don't understand how to use passwords. They do understand it. They just trade security for laziness.

Exactly. The thing is, they keep doing it because... it works.

The vast majority of the time, for the vast majority of people, it never results in any issue at all. And solve plenty of their problems.

Re: Why [Insert Thing Here] Is Not a Password Killer

#34

Post by ilovetux »

I think that a lot of the problems that are inherent to passwords might be mitigated by not allowing the user to choose a password. A strong, randomly generated password being given to the user and changed periodically would almost force the user to use some sort of password manager.

If this were adopted industry-wide (a big ask, I know) then users would be able to use the familiar "enter username and password" system while being protected from common mistakes/misjudgments.

Re: Why [Insert Thing Here] Is Not a Password Killer

#35

Post by TeMPOraL »

janlaureys wrote: post #18
TeMPOraL wrote: post #14

Earlier quoted context omitted.

Biometrics is essentially putting a massively complex system in front of your password input, that lets the device read the password off your body, but the consequences are a) you now can't ever change your password, and b) there's this massively complex system in front of (now hidden) password form, and complexity means unreliability and exploitable holes. The reason it seems to be working in phones and in laptops i…

My banking app uses the Iphone fingerprint sensor to fill in your password. From time to time the fingerprint fails a couple of times because my fingers are greasy or whatever and you can manually enter your password.

I fail in operating my Samsung phone's fingerprint scanner roughly once in 20 attemts, but sometimes those failed attempts are in a row and I end up having to type in the password. Since biometrics still require you to know the password as backup, they're not going to replace it.

Re: Why [Insert Thing Here] Is Not a Password Killer

#36

Post by kiriakasis »

jrockway wrote: post #17

> Despite it's [sic] many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. I think the problem is that people don't understand how to use passwords. They will reuse them among sites. They pick easily-guessable and low entropy ones. They will type them into any website that asks. The end result is that not much s…

> They will type them into any website that asks. maybe off-topic but on many linux distro the prompt to unlock your keyring does not mention what application is asking.

Re: Why [Insert Thing Here] Is Not a Password Killer

#37

Post by LeonM »

devit wrote: post #25

Here's the "password" killer: generating random passwords on the server and never letting users input their own passwords. All issues with reused passwords, password strength, hashing passwords with slow hashes, etc. instantly solved. Also improves conversion rate since there's no risk the user gives up signing up because he can't be bothered to think about or generate a password.

Except that people won't be able to remember them, so expect massive churn when it's time for them to enter the password the very first time.

Re: Why [Insert Thing Here] Is Not a Password Killer

#38

Post by acdha »

cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

Another aspect to this is that it’s single channel: no problem if your phone is out of data or at 1% battery, you need USB-A but have USB-C, etc. Nobody needs to regularly read a code to someone over the phone but the people who have are probably going to remember that when getting pitched on any new system.

This is terrible from the perspective of phishing but we really need to avoid that causing us to ignore the usability hassles to everything else.

I’m happy to see that conversation get more nuanced, too, rather than just being game-theoretical about perfect security: acknowledging the usability and security costs of password complexity requirements or expiration, having intermediate checks for more sensitive operations so you’re not training users to hammer their password out hundreds of times a day, etc.

Re: Why [Insert Thing Here] Is Not a Password Killer

#39

Post by kiriakasis »

devit wrote: post #25

Here's the "password" killer: generating random passwords on the server and never letting users input their own passwords. All issues with reused passwords, password strength, hashing passwords with slow hashes, etc. instantly solved. Also improves conversion rate since there's no risk the user gives up signing up because he can't be bothered to think about or generate a password.

Also there is a lot you can do with pronounceable passwords or easy to memorize ones. Hard to remember password and high entropy password can be very different.

Re: Why [Insert Thing Here] Is Not a Password Killer

#40

Post by kiriakasis »

orblivion wrote: post #19

If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all? What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? How could that _possibly_ be more friction? It would be strictly less. Hell, it could be done without even informing the user that this new feature was being…

For one 2FA is (often) an addition to password and almost always it is required only at registration time (e.g. email confirmation)
Post reply on HN