Why [Insert Thing Here] Is Not a Password Killer • Hacker News Board

Re: Why [Insert Thing Here] Is Not a Password Killer

#141

Post by zyx321 » Mon, Nov 05, 2018, 4:26 PM UTC

Passwords, if used correctly, are extremely secure. However 99% of my accounts are just not important enough to warrant that level of security. I don't worry about someone cutting off my finger in order to steal my Reddit account. My Github account doesn't have any projects that aren't forked elsewhere. Temporarily losing access to Steam for a day or two would not be the end of the world.

I have two-factor authentication for email, cloud storage, and banking. For everything else just give me convenience over security, please.

Re: Why [Insert Thing Here] Is Not a Password Killer

#142

Post by ikornaselur » Mon, Nov 05, 2018, 4:28 PM UTC

ukulele wrote: post #137

rocqua wrote: post #116

From the article: > I'm referring to passwordless solutions that involves things like QR codes, pictorial representations, 3rd party mobile apps, dedicated hardware devices or "magic" links sent via email. I'm not entirely sure the argument holds for the magic links sent via email. To me, those feel like lower friction that entering a password. Because all of a sudden, users don't have to remember their password. For…

We've had "magic" links as the primary sign in method for our site for about a year now. It works well but we very regularly get requests to allow password login. So much so that we'll introduce that eventually. Seems like both in combo could be a nice solution, but I'm sure we'll just start getting support requests from people whose password doesn't work because they never set one...

Interestingly, we replaced our login with magic links only over a year ago. We have roughly 1600-2000 active users, and as far as I know, we've never had anyone request a password login.

Not that I think about it.. it's kinda suspicious that no one has asked for it in all this time. Hmm..

Re: Why [Insert Thing Here] Is Not a Password Killer

#143

Post by ajford » Mon, Nov 05, 2018, 4:29 PM UTC

TremendousJudge wrote: post #128

bhauer wrote: post #114

Earlier quoted context omitted.

You can satisfy most entropy requirements without even trying by using a password manager's "create random password" feature. I feel the more important thing to attack is making password management more approachable to laypeople. To your point though: the most bothersome constraint put on passwords by applications and web sites are limits such as restricting certain special characters (To what end? You're going to ha…

my _bank_ requires passwords to be exactly 8 characters and is case insensitive. when I first realized I literally couldn't believe it, it's infuriating

Sounds like it might be time to switch banks....

Re: Why [Insert Thing Here] Is Not a Password Killer

#144

Post by sgustard » Mon, Nov 05, 2018, 4:29 PM UTC

This is an interesting argument, given that my phone over the past few years has moved from passcodes to Touch ID to Face ID. Most apps and sites on my phone that want to prompt me for a password are intercepted by the OS, which generates a one-time code and authenticates me via the same Touch/Face ID. The number of passwords I actually key in has been dropping steadily to near zero.

Re: Why [Insert Thing Here] Is Not a Password Killer

#145

Post by marcosdumay » Mon, Nov 05, 2018, 4:31 PM UTC

kevin_thibedeau wrote: post #120

marcosdumay wrote: post #78

Earlier quoted context omitted.

Keepass can use a key file too.

Turning "something you know" into "something you have"... or anyone else can have too.

It's turning "something you know" into "something you know and something you have".

For most people it's completely redundant because the passwords database is also "something you have". But it leads to some nice possibilities.

Re: Why [Insert Thing Here] Is Not a Password Killer

#146

Post by hirsin » Mon, Nov 05, 2018, 4:35 PM UTC

orblivion wrote: post #109

creeble wrote: post #94

Earlier quoted context omitted.

Where does 2fa replace passwords? It's two FA after all. And I'd assert that password managers haven't exactly taken off; I'd be curious about their numbers, but the dozen or so people I know who use one are all software engineers. Also, they don't really replace passwords - they're based on them!

2fa doesn't replace passwords but it is added friction that people willingly take on for added security. Password managers are a separate program that (some) people are willing to use as part of their login process. Perhaps whatever adoption it has is based on the fact that people understand passwords. But once they're used to using a program to log them in, I'd argue that's a potential hook into something more secur…

Only people on this site have willingly enabled 2fa (to a decent first order estimate). The remainder are forced to by tenant administrators or the occasional application owner who understands they gate important data (eg NuGet requires 2fa for some package owners).

"2fa" as traditionally thought of is a bit of a detour though - what's more important is strong authentication, with passwords being worst and a UAF key being best for now. Authenticator apps satisfy 2FA with a single authentication, but that freaks out plenty of smart people (phone PIN lock + device bound cert = something you know/are + you have) - purely due to years of training that 2FA means 2 authentication.

Re: Why [Insert Thing Here] Is Not a Password Killer

#147

Post by turc1656 » Mon, Nov 05, 2018, 4:36 PM UTC

All valid points. But there two other main reasons I see as why (strong) passwords are essentially a superior choice to everything:

1) Using passwords properly is an exceptionally powerful way of protecting your account/data/etc. If you use strong, unique passwords and store in a password manager (with the PW database encrypted, of course), it's virtually impossible to break into anything on the user side of things. You might be able to gain access via the server/business side depending on the hack you are pulling off, but that's on the company rather than the user. For instance, I do personally have my passwords stored in a password manager with an encrypted database. They're all unique and strong, as is the password used to access the password database. That password exists only in my mind. It's not written down anywhere or stored in some file on any computer. It's not physically printed out on paper or anything like that. It literally only exists in my head. And given its complexity and length, there is effectively nothing that will be able to break it in any reasonable amount of time. The government also can't force it from me as they could with other methods like 2FA, QR codes, fingerprints, etc. due to 1st amendment issues. Basically, short of getting me to log in from a compromised (i.e. keylogged) device (highly unlikely) or torturing me for the info, there's no way of getting it. And if you're willing to torture me for it - ok, you win then.

2) From a technical point - basically every device we would use to log into anything has either a keyboard (whether physical or on-screen) or some sort of keypad (again, physical or on-screen). This makes for universal compatibility. If people need to have special QR-code scanning/creation software installed on a device, or fingerprint-reading hardware - that creates a non-trivial barrier to the device compatible with the login process.

Re: Why [Insert Thing Here] Is Not a Password Killer

#148

Post by criddell » Mon, Nov 05, 2018, 4:46 PM UTC

amf12 wrote: post #28

jrockway wrote: post #17

> Despite it's [sic] many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. I think the problem is that people don't understand how to use passwords. They will reuse them among sites. They pick easily-guessable and low entropy ones. They will type them into any website that asks. The end result is that not much s…

> I think the problem is that people don't understand how to use passwords. They do understand it. They just trade security for laziness.

I do this for sites that I don't particularly care about. My wife and I have something we call our default password and it's protecting our Hulu account, our newspaper login, our Pandora login, etc...

Re: Why [Insert Thing Here] Is Not a Password Killer

#149

Post by lexs » Mon, Nov 05, 2018, 4:49 PM UTC

ilovetux wrote: post #84

lexs wrote: post #74

Earlier quoted context omitted.

but isn't a password manager just as much of a barrier in this context?

I don't believe so, I remember learning about Public Key Infrastructure a while ago. It's one of those things (kind of like git) where there is a steep learning curve up front, but once you understand it seems simple. A password manager on the other hand is just a place to store credentials. Credentials is a concept that most people understand. A password manager in this context could be as simple as a text file on y…

Ok lets compare these approaches rationally, especially from a user perspective. If you let the service provider choose/generate the password it might as well generate your keys for you, there really isn't much of a difference. From a credential management perspective there really isn't a difference either between a long non-human readable password and a long non-human readable private key. They basically suffer from the same problem, neither can be used without access to the credential manager. The only "advantage" passwords in that scenario have is that you don't need to sign anything you can just send it to the relying party however when you rely on password managers to input your credentials anyway that manager can manage signing as well right. I'm not advocating to use PKI instead of passwords just that forcing the use of password managers through very complicated long forced passwords has in my opinion not much of an advantage over PKI when both are equally opaque for casual users.

Re: Why [Insert Thing Here] Is Not a Password Killer

#150

Post by salvar » Mon, Nov 05, 2018, 4:49 PM UTC

orblivion wrote: post #60

bspammer wrote: post #53

Earlier quoted context omitted.

The claim wasn't that nobody understands anything other than passwords, it was that everyone understands passwords.

The claim was that nothing else will take off. 2FA and password maangers at least are used out there beyond a niche thing nobody ever heard of (which is how he described the viability of other schemes he didn't bother naming)

The claim was that nothing else will take off to the point of becoming a password killer.

2FA doesn't try to replace passwords.