Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why [Insert Thing Here] Is Not a Password Killer

troyhunt.com

Post reply on HN
Print view View original

41–50 of 277 posts

Re: Why [Insert Thing Here] Is Not a Password Killer

#41

Post by simias »

cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

I agree that it's a more salient point IMO. Smartphone based authenticator are not exactly difficult to understand, at least from a user's perspective. You enter your username, you get a prompt on your password, you're done.

Yubikeys are not difficult either. You enter your username, you focus the password field and you press the button. There, you're done. If anything it's easier and more convenient than a password.

Passwords are just the lowest common denominator. Everybody can memorize a character string, not everybody has a smartphone or yubikey with them at all times.

Re: Why [Insert Thing Here] Is Not a Password Killer

#42

Post by acdha »

bhaak wrote: post #32
cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

I see where you are coming from but sometimes you have to enforce some things. If you don't have 2FA, you can't login into this site is a completely rational consequence if for example this site is handling financial assets of yours. But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP co…

There’s also room for nuance even with financial sites: e.g. do MFA for everything which causes money to change hands but don’t require it every time someone checks their balance or confirms that their rent check went through, especially from a frequently-used client.

Similarly, if you’re not a financial site question whether you’re doing anything of value. The Netflix example is great: a huge password really doesn’t matter unless the site allows you to see stored credit card information since the worst thing someone can do is load your viewing history up with high ratings for Iron Fist. Continuing to cargo cult DoD policies from the 1970s has caused more problems than it’s stopped.

Re: Why [Insert Thing Here] Is Not a Password Killer

#43

Post by FooBarWidget »

amf12 wrote: post #28
jrockway wrote: post #17

> Despite it's [sic] many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. I think the problem is that people don't understand how to use passwords. They will reuse them among sites. They pick easily-guessable and low entropy ones. They will type them into any website that asks. The end result is that not much s…

> I think the problem is that people don't understand how to use passwords. They do understand it. They just trade security for laziness.

Agreed.

I've tried educating non-technical friends and family about insecure passwords and how random long strings are more secure. Their responses are:

1. "I can't remember that password! / I don't want to type that!"

2. "I'm a nobody, hackers wouldn't be interested in me. My account has no interesting data." [explanations about botnets doing damage to others go way over their heads]

3. "If someone REALLY wants to hack me then I can't stop them anyway."

They think that the inconveniences of secure password practices are not worth it.

I don't think a password manager will solve it for them. Especially older family members are "afraid of technology" - they are constantly worried that they will break something, and when something is written on the screen 9 out of 10 times they have no idea what it means. I have enough trouble explaining how copy-paste works — I don't think I can explain them what a password manager is, or how to keep in in sync across their devices, let alone convincing them to pay for such a thing.

I've tried the low-tech way. Advising them to use XKCD-style password and writing them down on paper. The result: they keep passwords over multiple pieces of paper/notebooks and they always lose them.

I've resorted to PMaaS — Password Management as a Service. In other words: I dictate what passwords they use, and I manage it for them in my password manager. Their login method is to call me to retrieve their login credentials.

Re: Why [Insert Thing Here] Is Not a Password Killer

#44

Post by reshie »

laumars wrote: post #20
dustinmoris wrote: post #10

> Despite their respective merits, every one of these solutions has a massive shortcoming that severely limits their viability and it's something they simply can't compete with: > Despite it's many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. This is (mostly) true, however, there is already evidence that new…

Biometrics are really more equivalent to a user name than they are a password. Sure, they get used in some applications as a "password" because it's "cool" but it's fair to say biometrics is public information so while many biometric services do their best to avoid being spoofed, they're really more akin to a user name. I'd also like to point out that fingerprint scanners don't work if you need to use then when you'v…

that is how it would be used in high/er security environments but not how it is used in the consumer arena.

Re: Why [Insert Thing Here] Is Not a Password Killer

#46

Post by lexs »

ilovetux wrote: post #34

I think that a lot of the problems that are inherent to passwords might be mitigated by not allowing the user to choose a password. A strong, randomly generated password being given to the user and changed periodically would almost force the user to use some sort of password manager. If this were adopted industry-wide (a big ask, I know) then users would be able to use the familiar "enter username and password" syste…

At that point why not just switch to PKI?

Re: Why [Insert Thing Here] Is Not a Password Killer

#48

Post by leetcrew »

ilovetux wrote: post #34

I think that a lot of the problems that are inherent to passwords might be mitigated by not allowing the user to choose a password. A strong, randomly generated password being given to the user and changed periodically would almost force the user to use some sort of password manager. If this were adopted industry-wide (a big ask, I know) then users would be able to use the familiar "enter username and password" syste…

> A strong, randomly generated password being given to the user and changed periodically would almost force the user to use some sort of password manager.

or it would force them to click "reset my password" every time they use your service. now your service is only as secure as their email account.

Re: Why [Insert Thing Here] Is Not a Password Killer

#49

Post by kiriakasis »

majewsky wrote: post #27
sslnx wrote: post #15

Earlier quoted context omitted.

Fingerprint scan and Facial recognition can not replace password authentication because both face and fingerprint are public information, while password is meant to be private. You cannot hide your face or fingerprint from others.

As a rule of thumb (pun not intended), biometric data is a username, not a password.

Disagree. It is not a password for sure, but not even a username. biometrics are an indentifier.

username/password split an unique/secure identifier in a unique part and a (supposedly) secure part. biometrics are that pair together.

Re: Why [Insert Thing Here] Is Not a Password Killer

#50

Post by kiriakasis »

M_Bakhtiari wrote: post #12

I can't help but think that browser vendors could have at least made an effort to make client certs and Kerberos authentication more user-friendly on the web. Perhaps not so useful for private consumers, but it would sure come in handy in enterprise.

the one feature I would like is an integrated "generate password" for one off registrations.
Post reply on HN