Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A future without passwords

blog.google

Post reply on HN
Print view View original

141–150 of 227 posts

Re: A future without passwords

#141

Post by yosito »

StavrosK wrote: post #65
RulerOf wrote: post #62

Earlier quoted context omitted.

>Am I the only person who loathes this form of 2FA? Not in the slightest. I tried to configure TOTP-only and Google effectively tells me to go fuck myself, because they apparently know how to secure my account better than I do.

I've found that if you move away from Gmail (and there are much better providers around), a Google account doesn't contain much. Turn off your history and someone compromising your account can do... what? Search for things you'd like? View your YouTube favorites? Meh.

The hardest thing for me to replace so far has been Google Maps. I use a handful of OSM map apps, but none of them come close to the local business lookups of Google, which I need quite often.

Re: A future without passwords

#142

Post by remus »

matt_f wrote: post #123
riffraff wrote: post #104

Earlier quoted context omitted.

Google also has a TOTP fallback, which solves the "I want my second factor to be my laptop" perfectly.

Really? How is this activated or enabled?

Go to some google service > profile menu dropdown in the top right > manage your google account > security > signing in to google > security > 2 step verification.

You can then 'add more second steps to verify it's you' including an option for an authenticator app (i.e. totp). Also worth generating some backup codes while you're at it.

Re: A future without passwords

#143

Post by countmora »

I use 1Password and it offers dedicated 2FA fields where it generates the tokens for you. It might go against the second factor in 2FA, since the password and token comes from the same source, but it protects me against potential data leaks where my password might be included. But for me, the biggest benefit is having to remember just one password to unlock 1Password which then lets you copy or autofill your passwords. This is why I even don’t know my actual password for such sites since they are auto generated arbitrarily characters.

Re: A future without passwords

#144

Post by RamblingCTO »

bawolff wrote: post #133

Somewhat controversial opinion: The biggest problem with passwords is that users select them, and users are stupid. We would get 95% of the benefit of 2FA (For forms of 2FA that aren't yubikeys, as yubikeys have benefits related to phising, but nobody uses them so its moot) if websites chose passwords for users instead of the user choosing the password. In particular, the only two threats that 2FA as widely implement…

> The biggest problem with passwords is that users select them, and users are stupid.

I really hope you don't work with users or are doing anything that affects them. Users are not stupid, they maybe lack understand or are lazy and things are inconvenient. But the world is easier if you can just pass of your responsibility to the ominous "dumb user", isn't it?

Re: A future without passwords

#145

Post by dusted »

Won't this make my telephone service provider + phone a single point of failure? Good thing it's not SUPER EASY to steal someone elses phone number, and also a good thing that modern smartphones basically NEVER break.

I think I'll just stick with my FinalKey which I can build extras of and which can store the encrypted database and backups offline.

Re: A future without passwords

#147

Post by ec109685 »

rolobio wrote: post #4

Am I the only person who loathes this form of 2FA? I have this on my eBay account and it never works. I click the "Approve" button, and it fails to send so I can't login. I would prefer to just use my 2FA TOTP app, which has yet to fail me! My work has the same sort of setup, they expect you to install the "Microsoft Authenticator" app (no TOTP supported) and click approve in that. But how have we increased safety wh…

Yes, this is a good point. With the Authenticator app on the phone and unguessable passwords (stored in a password manager on the phone), security all comes down to your Phone’s passcode. Know that, and you have complete access to all accounts.

Apple and Google should just short circuit this and directly be an Authenticator as well as manage the long lived token (the password) behind the scenes, which will eliminate the alt-tab dance.

Re: A future without passwords

#148

Post by ec109685 »

jsnell wrote: post #28
rolobio wrote: post #4

Am I the only person who loathes this form of 2FA? I have this on my eBay account and it never works. I click the "Approve" button, and it fails to send so I can't login. I would prefer to just use my 2FA TOTP app, which has yet to fail me! My work has the same sort of setup, they expect you to install the "Microsoft Authenticator" app (no TOTP supported) and click approve in that. But how have we increased safety wh…

> But how have we increased safety when my Team/Outlook phone app requests that I click "approve" on a different app? By ensuring that whoever signs into the account has at least two distinct factors: the password and the trusted phone with the authenticator app. One thing you know, one thing you have. Perfect. (Depending on your phone's settings around biometric unlock, it might be even the trifecta: one thing you k…

The something you know these days is just stored in your password manager, protected by your phone’s passcode most likely, so it all ends up being “something you have”.

Re: A future without passwords

#149

Post by ec109685 »

mindslight wrote: post #110
rolobio wrote: post #4

Am I the only person who loathes this form of 2FA? I have this on my eBay account and it never works. I click the "Approve" button, and it fails to send so I can't login. I would prefer to just use my 2FA TOTP app, which has yet to fail me! My work has the same sort of setup, they expect you to install the "Microsoft Authenticator" app (no TOTP supported) and click approve in that. But how have we increased safety wh…

Every time I log in, ebay bugs me to confirm my phone number "for security purposes". I say no, because I know the next step is harassing me with text messages every time I want to log in (like Google, etc). Passwords work for many of us. I generate them with pwgen(1), store them in a text file on encfs, and cache them in browsers. If my actual desktop computer ever got pwnt, I would have much bigger problems than a…

eBay would not flip on two factor without you knowing. Likely it is to alert you of a new device accessing your account and possibly part of a password reset flow.

It’s a good point though — how munch more secure is two factor if you have an unguessable password locked away in a password manager. Your single point of failure is security of your computer.

Post reply on HN