Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A future without passwords

blog.google

Post reply on HN
Print view View original

191–200 of 227 posts

Re: A future without passwords

#191

Post by will4274 »

Hamuko wrote: post #178
will4274 wrote: post #159

Earlier quoted context omitted.

What don't you like about the Win10 + Edge implementation?

If you have a Windows 10 computer with Windows Hello enabled, Windows 10 will ALWAYS assume you want to use a platform authenticator if the website doesn't specify whether to register a platform or a cross-platform authenticator. If you have both Windows Hello enabled and a Yubikey inserted into your computer and you start the registration, Windows 10 will always bring up the Windows Hello dialog, asking you to perfo…

The cancel issue you described is no longer present in the current version of win10.

The unfortunate fact is nobody except us geeks uses Yubikeys. 99% of users prefer platform keys. So it's not hard to understand why software defaults to it.

Re: A future without passwords

#192

Post by bawolff »

jjav wrote: post #175
bawolff wrote: post #133

Somewhat controversial opinion: The biggest problem with passwords is that users select them, and users are stupid. We would get 95% of the benefit of 2FA (For forms of 2FA that aren't yubikeys, as yubikeys have benefits related to phising, but nobody uses them so its moot) if websites chose passwords for users instead of the user choosing the password. In particular, the only two threats that 2FA as widely implement…

Not controversial at all, very true. Make the password unique and >128+ bits of entropy and that's all that is needed. At that point it is as strong as a shared AES key.

We probably don't even need 128 bits of entropy. TOTP 2FA is only 20 bits after all and people seem happy with that.

If we make them be pseudo sentences they will probably be easier to remember (the $adjective $noun $adverb $verb a $adjective2 $noun2)

Re: A future without passwords

#193

Post by bawolff »

RamblingCTO wrote: post #144
bawolff wrote: post #133

Somewhat controversial opinion: The biggest problem with passwords is that users select them, and users are stupid. We would get 95% of the benefit of 2FA (For forms of 2FA that aren't yubikeys, as yubikeys have benefits related to phising, but nobody uses them so its moot) if websites chose passwords for users instead of the user choosing the password. In particular, the only two threats that 2FA as widely implement…

> The biggest problem with passwords is that users select them, and users are stupid. I really hope you don't work with users or are doing anything that affects them. Users are not stupid, they maybe lack understand or are lazy and things are inconvenient. But the world is easier if you can just pass of your responsibility to the ominous "dumb user", isn't it?

I meant no disrespect to users as a group. Nonetheless its clear that we can't get >99.5% of ùsers to implement this security control properly, and that makes it a bad security control. And to be clear, its my belief that if someone implements a security control that constantly fails due to misuse, the party at fault is the implementor, not the user. Whether that's because users don't understand or just that their interests/incentives are disaligned, doesn't really matter.

Re: A future without passwords

#194

Post by bawolff »

timwis wrote: post #136
bawolff wrote: post #133

Somewhat controversial opinion: The biggest problem with passwords is that users select them, and users are stupid. We would get 95% of the benefit of 2FA (For forms of 2FA that aren't yubikeys, as yubikeys have benefits related to phising, but nobody uses them so its moot) if websites chose passwords for users instead of the user choosing the password. In particular, the only two threats that 2FA as widely implement…

2FA adds more value than that - it’s meant to be about “something you know and something you have” (in theory, physically). That way, even if your password is compromised three something like a data breach, you’re still protected.

If the server in question is data breached, than they'll steal the 2FA secret. If the user's cell phone is breached, they will steal both the 2fa token and the password (or just the session cookie). Well what you say is true in theory, its not true in practise of how 2FA is commonly implemented.

Re: A future without passwords

#196

Post by forgotpwd16 »

paranoidrobot wrote: post #91

I don't trust Google to fill this role of being arbiter of access to things. After it took me a week to recover access to a GSuite account that I knew the password for (long, unique, stored in a password manager), that I could confirm access via the recovery email, and that had my phone number attached - but Google were insisting that I was a hacker, and Support-robots refused to help me or assign a human until I fou…

Problems such as these (locked-out; no real support) are shared among all the big social logins providers (Facebook, Google, Twitter, ...). There was a related HN discussion[1] few months ago.

[0]: https://news.ycombinator.com/item?id=25091420

Re: A future without passwords

#197

Post by forgotpwd16 »

StavrosK wrote: post #65
RulerOf wrote: post #62

Earlier quoted context omitted.

>Am I the only person who loathes this form of 2FA? Not in the slightest. I tried to configure TOTP-only and Google effectively tells me to go fuck myself, because they apparently know how to secure my account better than I do.

I've found that if you move away from Gmail (and there are much better providers around), a Google account doesn't contain much. Turn off your history and someone compromising your account can do... what? Search for things you'd like? View your YouTube favorites? Meh.

The issue with moving away from Gmail is that some sites don't allow you to change your email address. I can only imagine the chaos that will be when Google decides to kill Gmail.

Re: A future without passwords

#198

Post by forgotpwd16 »

1vuio0pswjnm7 wrote: post #88
peteretep wrote: post #69

Earlier quoted context omitted.

> they apparently know how to secure my account better than I do This is definitely true for 99% of people though

And the company is taking full advantage of that. "Trust us." Yet no company wants more personal information from you than this one. They want everything. Even when they have so much, they are going to great lengths to get more. They are not in the security business, they are in the online ad sales business.

And you aren't even exaggerating. They now require ID verification to watch age-restricted videos on YouTube.

Re: A future without passwords

#199

Post by forgotpwd16 »

bawolff wrote: post #133

Somewhat controversial opinion: The biggest problem with passwords is that users select them, and users are stupid. We would get 95% of the benefit of 2FA (For forms of 2FA that aren't yubikeys, as yubikeys have benefits related to phising, but nobody uses them so its moot) if websites chose passwords for users instead of the user choosing the password. In particular, the only two threats that 2FA as widely implement…

Firefox has a very nice built-in password generation (e.g. S2AKGfsZ8i8t3PR) appearing on password fields in registration forms.
Post reply on HN