Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why [Insert Thing Here] Is Not a Password Killer

troyhunt.com

Post reply on HN
Print view View original

201–210 of 277 posts

Re: Why [Insert Thing Here] Is Not a Password Killer

#201

Post by tialaramex »

beatgammit wrote: post #183
Sean1708 wrote: post #80

Earlier quoted context omitted.

> You enter your username, you focus the password field and you press the button. How much set up does it take to get to that point though? Usability at point of use is great but setting something up is usually far more difficult than actually using it.

They provide software that you install to configure your device. I haven't used it personally (my Neo 5 is being delivered), but they've done a pretty good job of making it easy. The biggest problems are: - limited selection of sites that support U2F - U2F is off by default in Firefox (it's a little buggy apparently) - somewhat expensive ($45 for Yubikey Neo) Those are getting better, and I think the Yubikey can be u…

U2F is a legacy feature. New sites should deploy WebAuthn and existing sites should migrate, the Firefox pref override is for those remaining legacy sites. It basically bodges their WebAuthn implementation to offer a passable imitation of U2F.

I don't know if a Neo can replace the secret key that makes FIDO (and thus U2F/WebAuthn) work but doing so seems pointless. If bad guys tampered with it, they presumably neutered this feature; whereas if not it's fine out of the box. Certainly Yubico's cheaper FIDO2-only product offers no way to regenerate the secret.

Nobody today deploys WebAuthn to replace passwords, only as a second factor so it doesn't really undermine Troy's point, though perhaps our other countermeasures (long complicated passwords for every site, changed frequently) are less necessary if you have a good second factor like this.

Re: Why [Insert Thing Here] Is Not a Password Killer

#202

Post by cyborgx7 »

krupan wrote: post #171
cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

"It is also that you can always enter a password." You are correct, as long as you throw out all the other password advice that, ironically, Troy Hunt has given us about not reusing passwords, making them long or full of hard-to-memorize characters, etc. Once you use secure passwords by making them long and/or hard to memorize, unique for each website, etc., you can't just rely on your brain, fingers, and an awkward…

It is also practically true.

I remember a couple of passwords for services I frequently have to log into without access to a password manager. I can make choices about the security requirements for different services, and the security of the passwords I use for them. I can make choices about how to store them. I use a command-line program that stores passwords in individual textfiles, encrypts them with gpg and manages them with git. I could also choose to write them into a notebook with a cypher I can do in my head.

These are all choices I get to make because passwords are text, and nothing else.

Re: Why [Insert Thing Here] Is Not a Password Killer

#203

Post by cyborgx7 »

ken wrote: post #134
cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

Sort of. You're selectively quoting "Write programs to handle text streams, because that is a universal interface" -- but that was from the days when "text" was basically synonymous with "ASCII". Passwords aren't streams, and in the Unicode world, they're not even (predictable) byte arrays. This isn't just hypothetical. There have been recent bugs in major systems where people with non-ASCII passwords couldn't type t…

The idea of "text is the universal interface" informed the design of unix and it resulted in text streams. But if I apply it to something entirely different, authentication, I come out at passwords.

And I wouldn't say that text meant ASCII. My understanding is that it meant text is the thing that could be understood and written by both people and computers.

Re: Why [Insert Thing Here] Is Not a Password Killer

#204

Post by creeble »

cyborgx7 wrote: post #202
krupan wrote: post #171

Earlier quoted context omitted.

"It is also that you can always enter a password." You are correct, as long as you throw out all the other password advice that, ironically, Troy Hunt has given us about not reusing passwords, making them long or full of hard-to-memorize characters, etc. Once you use secure passwords by making them long and/or hard to memorize, unique for each website, etc., you can't just rely on your brain, fingers, and an awkward…

It is also practically true. I remember a couple of passwords for services I frequently have to log into without access to a password manager. I can make choices about the security requirements for different services, and the security of the passwords I use for them. I can make choices about how to store them. I use a command-line program that stores passwords in individual textfiles, encrypts them with gpg and manag…

I was just about to type the same response.

I can also write down passwords (unencrypted) to sites that I use infrequently, and for which I have low security requirements. For many such sites, a password reset is reasonably implemented and fast, and so for a vast number of sites, email security (and thus, email password security) == arbitrary site password security anyway.

Re: Why [Insert Thing Here] Is Not a Password Killer

#205

Post by tialaramex »

krupan wrote: post #156
turc1656 wrote: post #147

All valid points. But there two other main reasons I see as why (strong) passwords are essentially a superior choice to everything: 1) Using passwords properly is an exceptionally powerful way of protecting your account/data/etc. If you use strong, unique passwords and store in a password manager (with the PW database encrypted, of course), it's virtually impossible to break into anything on the user side of things.…

"If you use strong, unique passwords and store in a password manager (with the PW database encrypted, of course)" You aren't talking about passwords the same way everyone else here, especially TFA, is talking about passwords. You might as well be talking about RSA keys at this point.

Perhaps more appropriately AES keys, as they are a shared secret (shared with the target site even if it's using a decent password hash) rather than a private key.

Re: Why [Insert Thing Here] Is Not a Password Killer

#206

Post by ryan-c »

guitarbill wrote: post #158
ryan-c wrote: post #140

Earlier quoted context omitted.

A 40 character password of real words is usually easier to crack than a random 12 character string, though.

Citation needed (that sounds wrong without seeing the maths). But also missing the point. It just has to be better than the usual 8 + some punctuation at the end that most people resort to when faced with these shitty, asinine password rules.

English words are ~1.5 bits per character, random ascii garbage is ~6.5 bits per character.

Re: Why [Insert Thing Here] Is Not a Password Killer

#207

Post by comma-ampersand »

ryan-c wrote: post #135
rocqua wrote: post #116

From the article: > I'm referring to passwordless solutions that involves things like QR codes, pictorial representations, 3rd party mobile apps, dedicated hardware devices or "magic" links sent via email. I'm not entirely sure the argument holds for the magic links sent via email. To me, those feel like lower friction that entering a password. Because all of a sudden, users don't have to remember their password. For…

There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link. So then you need to open the link in the same browser you want to use. But what if you want to log in on a desktop browser and only have your email on your phone? Maybe have the magic link show a couple letters you need to type into the browser?

You might as well email them the letters.

Re: Why [Insert Thing Here] Is Not a Password Killer

#209

Post by salvar »

ilovetux wrote: post #176
salvar wrote: post #151

Earlier quoted context omitted.

Your hotel example is pretty absurd, because there's no friction involved in carrying around a hotel room key. There is significant friction involved in memorizing a long password. So no, it's not "how most of the world already works".

I will admit that it's not quite equivalent, but there was a learning curve that happened when hotels switched from metallic keys to magnetic keycards. I don't think that it's absurd. I guess a more direct example would be an employer trusting you with the combination of a safe. You would need to remember the combination which presumably would be changed periodically. The point I think I'm trying to make is that it's…

If it's a company safe? Well of course that's the employer's decision.

A better example would be a safe deposit box or storage unit with a combination. Where you are accessing your account so to speak. There you can pick the combination yourself in most cases.

Re: Why [Insert Thing Here] Is Not a Password Killer

#210

Post by sinatra »

codyb wrote: post #173
krupan wrote: post #171

Earlier quoted context omitted.

"It is also that you can always enter a password." You are correct, as long as you throw out all the other password advice that, ironically, Troy Hunt has given us about not reusing passwords, making them long or full of hard-to-memorize characters, etc. Once you use secure passwords by making them long and/or hard to memorize, unique for each website, etc., you can't just rely on your brain, fingers, and an awkward…

I'm not sure it has to be so difficult. It took me about an hour to come up with a scheme for creating long, unique, and random looking passwords that are very easy to remember. Basically I have a prefix of length 7 which is two words, where some of the letters get converted to numbers, and then I use shift to make them into special characters. Then for each website I append a different word that has some meaning for…

I used to do something like this too before I moved to password managers. The reasons were:

- If a password on a website is stolen or if the website forces me to change password, then my "rules based password generation" becomes a problem. Now, it needs to handle variations. And, with hundreds of websites, I won't remember which variation a certain website password is on.

- If a website has password rules that don't let me use my "rules based password generation," then what do I do? I tried having an alternative generation rule, but different websites have different password rules. So, no one / two / three generation rules will be able to generate acceptable passwords.

- The "append a different word" requirement is tricky. How do you append a different word for each of the hundreds of domains while having a way to mentally recall them? I chose to use the domain name and shift all letters up by one. However, that failed with sites that use multiple domain names.

- Sharing passwords with my wife became a hassle because the rules and variations were becoming too much for her.

Post reply on HN