Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why [Insert Thing Here] Is Not a Password Killer

troyhunt.com

Post reply on HN
Print view View original

231–240 of 277 posts

Re: Why [Insert Thing Here] Is Not a Password Killer

#231

Post by Svoka »

In my humble opinion, very few know how to use a password. Most of the people still believe that their cat name starting with a capital letter and with 1 in the end is a good password. Or that once you have a good password it is enough to use it everywhere. Same passwords everywhere is not a security, it's a vision of security. It may surprise author that main reason to provide authentication is to give some security, and in case of every single non-it person I know their passwords are just an illusion.

So, I would argue, while anyone can type in some staff, how to make it secure is rare knowledge almost no one has. So, is it, really "everyone knows how it works"? Or just everyone repeating their not quite secure passwords to make machine happy without any understanding of consequences

Re: Why [Insert Thing Here] Is Not a Password Killer

#232

Post by dgzl »

Svoka wrote: post #231

In my humble opinion, very few know how to use a password. Most of the people still believe that their cat name starting with a capital letter and with 1 in the end is a good password. Or that once you have a good password it is enough to use it everywhere. Same passwords everywhere is not a security, it's a vision of security. It may surprise author that main reason to provide authentication is to give some security…

You could argue that few people use passwords in a properly secure manner, and you'd likely be right, but the real question is what will replace passwords?

The truth you describe doesn't mean that we should convince people to use passwords correctly, rather that passwords aren't the best security medium for humans. It's unreasonable for people to be expected to craft highly secure, brand new passwords each time they need one, and also expect it to be stored in long-term memory. That process is simply out of scope for most humans.

So then, how do we make this easier without compromising security?

Re: Why [Insert Thing Here] Is Not a Password Killer

#233

Post by tln »

meuk wrote: post #83
snarf21 wrote: post #75

Earlier quoted context omitted.

It is generally always a trade-off between security and convenience. You can demand that a site allow passwords but you also aren't memorizing a 24 character nonsense password for each site login. The holy grail is can you bend the line and have something that is super secure and mostly convenient.

I currently work in an environment where I don't have access to a password manager, yet I am expected to have unique passwords for each service, and rotate passwords every month, and am not allowed to store passwords somewhere. Of course, this method requires you to remember more passwords than practically possible. If all accounts would have sane restrictions on the password it would become trivial to have something…

> I currently work in an environment where I don't have access to a password manager

How is that reasonable? If you make a case that restricting password managers lowers security, could you possibly change it?

Re: Why [Insert Thing Here] Is Not a Password Killer

#234

Post by yepguy »

bad_user wrote: post #16
TeMPOraL wrote: post #14

Earlier quoted context omitted.

Biometrics is essentially putting a massively complex system in front of your password input, that lets the device read the password off your body, but the consequences are a) you now can't ever change your password, and b) there's this massively complex system in front of (now hidden) password form, and complexity means unreliability and exploitable holes. The reason it seems to be working in phones and in laptops i…

It’s also not the complexity that’s the problem. Even if it’s flawless, which is impossible, with biometrics you can easily be coerced into giving access without effort, whereas we haven’t invented a mind reader yet. In other words I can easily imagine kids gaining access to a credit card via fingerprints or facial recognition, while their parents are sleeping ;-) I wanted to write about law enforcement agencies, but…

That new HP laptop commercial featuring the fingerprint reader makes me facepalm every time. They advertise it as "reinventing passwords" WHILE ILLUSTRATING EXACTLY HOW INSECURE IT IS.

https://www.youtube.com/watch?v=KTn0r0HPXVg

Re: Why [Insert Thing Here] Is Not a Password Killer

#235

Post by jniedrauer »

ken wrote: post #134
cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

Sort of. You're selectively quoting "Write programs to handle text streams, because that is a universal interface" -- but that was from the days when "text" was basically synonymous with "ASCII". Passwords aren't streams, and in the Unicode world, they're not even (predictable) byte arrays. This isn't just hypothetical. There have been recent bugs in major systems where people with non-ASCII passwords couldn't type t…

> ASCII digits are universal. Bytes are universal. Text is ... complicated.

All text should be UTF-8. It really shouldn't be complicated in $current_year.

Re: Why [Insert Thing Here] Is Not a Password Killer

#236

Post by Lukas_Skywalker »

BillinghamJ wrote: post #222
ryan-c wrote: post #135

Earlier quoted context omitted.

There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link. So then you need to open the link in the same browser you want to use. But what if you want to log in on a desktop browser and only have your email on your phone? Maybe have the magic link show a couple letters you need to type into the browser?

They are trivially solvable problems. PKCE and just displaying a QR code if you open it on the wrong device makes it pretty much foolproof. e.g.: https://magic.cuvva.com/auth-callback?code=authzcode_000000B... We're oriented around mobile use cases. Admittedly less ideal if you don't have your email on your desktop. But ultimately, if all else fails, you can always log into your webmail. For me the key thing is that…

> They reuse them, they forget them, they write them down on text files on their computer.

Writing them down in a textfile on the computer might not even be that bad _if_ they, as a consequence, are not or less reused.

Re: Why [Insert Thing Here] Is Not a Password Killer

#237

Post by codedokode »

I don't agree with the author. Passwords are difficult to remember and easy to steal. Example I saw: old people write their card's PIN code on it because they cannot remember it. Everyone knows how to use it, you say?

I think that for an average, not computer-loving type of person, a hardware key is the best solution. You don't need to remember anything: just insert the key and press the button.

Why aren't they popular? I think because they are not a standard and are not built in. You don't get a free key when buying a laptop or a smartphone and that's the main reason why nobody is using them.

But there already are applications that don't use passwords. For example, Telegram (IM application): when you install it you only have to enter your phone number, it sends the code in SMS, the app reads the code without user's interaction, and authenticates the device. No passwords, no need to remember anything. I don't like this (it is not convenient for those who use a burner phone number for registration), but for a more typical user it is convenient and doesn't require them to remember anything.

I think we will see more passwordsless authentication in the future.

Re: Why [Insert Thing Here] Is Not a Password Killer

#238

Post by codedokode »

cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

> It is also that you can always enter a password.

If you remember it. You either have to use weaker passwords (for example, same password on several sites) or you won't be able to remember them. Or you can write them down which is pretty secure, but is not it easier just to carry a hardware key instead of a notepad with passwords?

Also, once I accidentaly deleted Latin keyboard layout in Linux (yes, it is easy). And having only Russian layout I was unable to enter the password to log in (and even if I could I wouln't be able to use the console). I tried to use on-screen keyboard, but in Debian it cannot input characters not present in keyboard layout.

Re: Why [Insert Thing Here] Is Not a Password Killer

#239

Post by tim333 »

codedokode wrote: post #238
cyborgx7 wrote: post #5

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always b…

> It is also that you can always enter a password. If you remember it. You either have to use weaker passwords (for example, same password on several sites) or you won't be able to remember them. Or you can write them down which is pretty secure, but is not it easier just to carry a hardware key instead of a notepad with passwords? Also, once I accidentaly deleted Latin keyboard layout in Linux (yes, it is easy). And…

A bit of a bodge I find works is to make my passwords of the form word+site+number, say Mangohn4234 for HN. Then they are all different, pass the has it been pawned thing and its quite easy to remember Mango 4234 or similar if you use that for them all.

Re: Why [Insert Thing Here] Is Not a Password Killer

#240

Post by hyperpape »

acdha wrote: post #230
hyperpape wrote: post #195

Earlier quoted context omitted.

Song lyrics are not safe https://arstechnica.com/information-technology/2013/08/there... I don’t know exactly where the breakeven point is, but there is some point where a song lyric or other phrase provides less entropy than a relatively short password. Bottom line: use a lot of random ascii characters(at least 14 or 16, or 4 random words) and you’re probably set. Use less, or a found phrase and it’s not good.

You can't talk about safe without a threat-model, especially distinguishing between whether you're trying to prevent offline attacks against stored data or brute-forcing a running login system. If you can rate-limit many things are fine, especially if you have some confirmations at key points (“Your account was just accessed from …”) with restrictions which make it hard for an attacker to permanently wrest control of…

That's definitely true, though you can simplify matters by saying "I'm always going to try to have passwords that are safe against offline attacks".
Post reply on HN