Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why [Insert Thing Here] Is Not a Password Killer

troyhunt.com

Post reply on HN
Print view View original

51–60 of 277 posts

Re: Why [Insert Thing Here] Is Not a Password Killer

#51

Post by ilovetux »

lexs wrote: post #46
ilovetux wrote: post #34

I think that a lot of the problems that are inherent to passwords might be mitigated by not allowing the user to choose a password. A strong, randomly generated password being given to the user and changed periodically would almost force the user to use some sort of password manager. If this were adopted industry-wide (a big ask, I know) then users would be able to use the familiar "enter username and password" syste…

At that point why not just switch to PKI?

pki is a barrier to entry for most. the user would have to set their browser up to present a unique key pair for each site they use. I think mutual auth is better suited to automated administrative tasks.

Re: Why [Insert Thing Here] Is Not a Password Killer

#52

Post by devit »

LeonM wrote: post #37
devit wrote: post #25

Here's the "password" killer: generating random passwords on the server and never letting users input their own passwords. All issues with reused passwords, password strength, hashing passwords with slow hashes, etc. instantly solved. Also improves conversion rate since there's no risk the user gives up signing up because he can't be bothered to think about or generate a password.

Except that people won't be able to remember them, so expect massive churn when it's time for them to enter the password the very first time.

Just set a never-expiring authentication cookie in the browser, so they never need to enter the password in typical one-device use.

When they need to change devices, have the standard e-mail based password reset as well as "show password" in the account settings (make the password reset not reset login, unless the user explicitly elects to "log me out on all devices").

Re: Why [Insert Thing Here] Is Not a Password Killer

#53

Post by bspammer »

orblivion wrote: post #19

If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all? What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? How could that _possibly_ be more friction? It would be strictly less. Hell, it could be done without even informing the user that this new feature was being…

The claim wasn't that nobody understands anything other than passwords, it was that everyone understands passwords.

Re: Why [Insert Thing Here] Is Not a Password Killer

#54

Post by ilovetux »

leetcrew wrote: post #48
ilovetux wrote: post #34

I think that a lot of the problems that are inherent to passwords might be mitigated by not allowing the user to choose a password. A strong, randomly generated password being given to the user and changed periodically would almost force the user to use some sort of password manager. If this were adopted industry-wide (a big ask, I know) then users would be able to use the familiar "enter username and password" syste…

> A strong, randomly generated password being given to the user and changed periodically would almost force the user to use some sort of password manager. or it would force them to click "reset my password" every time they use your service. now your service is only as secure as their email account.

This would be a valid concern, so I suppose that it would take an industry-wide push (which I know is unlikely) to educate users about password managers, but I would argue that if we want to improve upon the password based authentication then it would be easier to educate users if we are using a familiar interface with just one single change.

Re: Why [Insert Thing Here] Is Not a Password Killer

#55

Post by AstralStorm »

simias wrote: post #41
cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

I agree that it's a more salient point IMO. Smartphone based authenticator are not exactly difficult to understand, at least from a user's perspective. You enter your username, you get a prompt on your password, you're done. Yubikeys are not difficult either. You enter your username, you focus the password field and you press the button. There, you're done. If anything it's easier and more convenient than a password.…

The second way is to use one time pads in addition to passwords.

Who needs a smartphone when you can use a piece of paper. Mind you this can be copied so has a similar vulnerability to passwords. But since it can be generated you can think of it as a salted password when combined with a classic one.

And then we use the final way of authentication, hard to forge personal documents, government issued... often in poor ways.

Computer systems cannot be truly fully trusted. Final security always depends on the human operators and equivalent human impersonators. A skilled social engineer can even convince your friends the account is dead. They can call the delivery company or even initiate the procedure to reissue documents or destroy keys. They can phish and scam you which is even easier.

Re: Why [Insert Thing Here] Is Not a Password Killer

#56

Post by AstralStorm »

FooBarWidget wrote: post #43
amf12 wrote: post #28

Earlier quoted context omitted.

> I think the problem is that people don't understand how to use passwords. They do understand it. They just trade security for laziness.

Agreed. I've tried educating non-technical friends and family about insecure passwords and how random long strings are more secure. Their responses are: 1. "I can't remember that password! / I don't want to type that!" 2. "I'm a nobody, hackers wouldn't be interested in me. My account has no interesting data." [explanations about botnets doing damage to others go way over their heads] 3. "If someone REALLY wants to h…

This does not work, you're a single point of failure. If you say, get sick, family members will override security.

Nice try though. I'd recommend an actual password manager instead. Authenticated with biometrics and a simpler local password.

Your service does the same, using voice and phone number as biometrics. (Perhaps with recovery question.) Feel free to replace it with sufficiently advanced AI.

Re: Why [Insert Thing Here] Is Not a Password Killer

#57

Post by screye »

jrockway wrote: post #17

> Despite it's [sic] many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. I think the problem is that people don't understand how to use passwords. They will reuse them among sites. They pick easily-guessable and low entropy ones. They will type them into any website that asks. The end result is that not much s…

> I think the problem is that people don't understand how to use passwords

From the looks of it, neither do the authenticators. The capital letter + symbol + number requirement had led to the current predicament. Just asking for really long passwords would have been a lot better.

As it stands, people either use a predictable string of num-symbol to satisfy requirements or remember that one strong password,.which qualifies for all of the above.

Software like Lastpass are great, but I don't always have access to them. They also make all of my.online security have a single point of failure.

I think it would be a lot better if companies just changed password requirements to a decently large length eg: min 20.

This eliminates the likely hood of password like abc123, qwerty and the oh so lovely "password".

Re: Why [Insert Thing Here] Is Not a Password Killer

#58

Post by screye »

orblivion wrote: post #19

If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all? What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? How could that _possibly_ be more friction? It would be strictly less. Hell, it could be done without even informing the user that this new feature was being…

> Asking people to deal with more and more and longer and longer passwords is a usability nightmare. It's a absurdity.

I fully agree with you, but an anecdote.

I find long password to be easy to remember if they are just long lower case strings instead of having wierd symbol-number combinations.

Re: Why [Insert Thing Here] Is Not a Password Killer

#59

Post by AstralStorm »

acdha wrote: post #42
bhaak wrote: post #32

Earlier quoted context omitted.

I see where you are coming from but sometimes you have to enforce some things. If you don't have 2FA, you can't login into this site is a completely rational consequence if for example this site is handling financial assets of yours. But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP co…

There’s also room for nuance even with financial sites: e.g. do MFA for everything which causes money to change hands but don’t require it every time someone checks their balance or confirms that their rent check went through, especially from a frequently-used client. Similarly, if you’re not a financial site question whether you’re doing anything of value. The Netflix example is great: a huge password really doesn’t…

Indeed, the best policy is to not store any data. Even easier to comply with GDPR this way. No account is best account.

This requires that the site supports automatic completion and pasting. Quite a few sites explicitly prevent it for stupid reasons like assuming user browser is compromised.

(If it is, you shouldn't be using the webpage for authentication.)

Re: Why [Insert Thing Here] Is Not a Password Killer

#60

Post by orblivion »

bspammer wrote: post #53
orblivion wrote: post #19

If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all? What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? How could that _possibly_ be more friction? It would be strictly less. Hell, it could be done without even informing the user that this new feature was being…

The claim wasn't that nobody understands anything other than passwords, it was that everyone understands passwords.

The claim was that nothing else will take off. 2FA and password maangers at least are used out there beyond a niche thing nobody ever heard of (which is how he described the viability of other schemes he didn't bother naming)
Post reply on HN