Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A future without passwords

blog.google

Post reply on HN
Print view View original

201–210 of 227 posts

Re: A future without passwords

#201

Post by parliament32 »

bo1024 wrote: post #113
graiz wrote: post #72

I want a future without passwords, but that future gives me the choice of third parties to host my passwords. I prefer 1Password, some people like iCloud, while others may prefer a Microsoft solution. Passwords suck and we need a per-site password policy that can act like an API. Kind of like a Robots.txt, to declare, "This site needs 8-20 characters, 1 symbol and the URL's for login, reset and forgot password are th…

Or ditch site passwords and use public key authentication, like ssh has used for decades...

This is already built into all browser and works great, as client-side SSL certificates. Nobody uses it though because you can't trust users to manage their private keys properly.

Re: A future without passwords

#202

Post by scambier »

mceachen wrote: post #122
scambier wrote: post #116

Earlier quoted context omitted.

Not OP. While I've personally not yet fully migrated out of Google, I found Synching and Resilio Sync quite useful to transparently backup photos to my own computer. And to prevent losses, I have a Backblaze subscription. While I do have a VPS, it only has like 20GB, so I've yet to find an affordable and easy photo sharing solution.

You can set up PhotoStructure to build smaller (4k, 1080p, whatever you want) previews on your home server, and rsync just the previews dir and DB periodically up to your VPS. A couple of my beta users do this. (I'm the author, btw). https://photostructure.com/faq/why-photostructure/

Hey thanks, I'll take a look!

Re: A future without passwords

#204

Post by kevincox »

smusamashah wrote: post #203

If someone got access to your chrome, they got access to all passwords. Just go to the website, let it fill the password and grab the filled password.

Yes but "got access to your chrome" is far far above the common threat level of most people. Physical access is a huge barrier. Sure, if you are being targeted than your phone or laptop being stolen while unlocked is a problem that you will need to address, however for 99% of the population this is a perfectly adequate level of security. Most importantly it is far better than the most common solution of using the same (maybe slightly modified) set of passwords everywhere.

Re: A future without passwords

#205

Post by kevincox »

tgsovlerkhgsel wrote: post #7

> Soon we’ll start automatically enrolling users in 2SV if their accounts are appropriately configured I get that this makes accounts more secure, but I'm more worried about accidentally getting locked out because my phone isn't charged/nearby/working than getting phished. I really hate it when sites take your ability to choose away, even though I understand why they do it. I wish the EU would regulate that sites mus…

This was my thought too. How many people are going to be auto-enrolled then get locked out because they dropped their phone in a lake. Either this is going to be a huge issue or they are going to provide ways to reset your second factor. In which case is it really 2FA?

Re: A future without passwords

#206

Post by Hamuko »

will4274 wrote: post #191
Hamuko wrote: post #178

Earlier quoted context omitted.

If you have a Windows 10 computer with Windows Hello enabled, Windows 10 will ALWAYS assume you want to use a platform authenticator if the website doesn't specify whether to register a platform or a cross-platform authenticator. If you have both Windows Hello enabled and a Yubikey inserted into your computer and you start the registration, Windows 10 will always bring up the Windows Hello dialog, asking you to perfo…

The cancel issue you described is no longer present in the current version of win10. The unfortunate fact is nobody except us geeks uses Yubikeys. 99% of users prefer platform keys. So it's not hard to understand why software defaults to it.

What's the current version of Windows 10? Because I'm getting it on 20H2.

Re: A future without passwords

#207

Post by timwis »

bawolff wrote: post #194
timwis wrote: post #136

Earlier quoted context omitted.

2FA adds more value than that - it’s meant to be about “something you know and something you have” (in theory, physically). That way, even if your password is compromised three something like a data breach, you’re still protected.

If the server in question is data breached, than they'll steal the 2FA secret. If the user's cell phone is breached, they will steal both the 2fa token and the password (or just the session cookie). Well what you say is true in theory, its not true in practise of how 2FA is commonly implemented.

Good point, but wouldn’t they also need the time based algorithm?

Here’s some more ammunition for your argument though: https://www.csoonline.com/article/3272425/11-ways-to-hack-2f...

Re: A future without passwords

#208

Post by D-Nice »

tialaramex wrote: post #134
D-Nice wrote: post #74

As someone whose main project surrounds passwords, I could appreciate a future without passwords, because I consider most existing solutions to be quite poor. However, this feels more like having your sheep be herded by a fox... Many here have already mentioned great points retorting this, so I won't beat a dead horse. I will take the selfish opportunity to mention what my solution is that I'm working on: https://app…

There already is a future without passwords, it's WebAuthn. The key element that didn't make your list is phishing. The next threat to Joe Average once he isn't reusing a crap password is phishing. Joe goes to a site which he thinks is the right place but it isn't, it's actually run by bad guys and then Joe gives them his credentials and helps them break into the real site Joe thought he was visiting. Better password…

It's a definite improvement, and good point indeed regarding phishing... just as your answer precludes, a whole different authentication mechanism is needed to avoid phishing, that is why unfortunately that couldn't make my list. However, it does protect your other accounts from getting breached if one is either phished or breached, which I considered to be good enough.

WebAuthn does have its own issues and complications, mainly with how to handle account recovery on a lost or corrupted device. Sure, you can have a replacement device, as likely me and you try and do for most things, however, this is too burdensome for many.

I think the biggest issue with any new spec like WebAuthn is vendor adoption. As is... many banks fail to have any 2FA, and those that do, give you the terrible choice of SMS 2FA. In addition, they have odd and archaic password requirements, such as only these symbols, and only up to 20 characters etc... If they have failed on rectifying these in the last 2 decades, I'm afraid how far in the future away something like WebAuthn is to being in realized use. Hence I made SrsPass as hopefully a solution to today's passwords problems, the ones I considered sanely resolvable.

Re: A future without passwords

#209

Post by bawolff »

timwis wrote: post #207
bawolff wrote: post #194

Earlier quoted context omitted.

If the server in question is data breached, than they'll steal the 2FA secret. If the user's cell phone is breached, they will steal both the 2fa token and the password (or just the session cookie). Well what you say is true in theory, its not true in practise of how 2FA is commonly implemented.

Good point, but wouldn’t they also need the time based algorithm? Here’s some more ammunition for your argument though: https://www.csoonline.com/article/3272425/11-ways-to-hack-2f...

The time based algorithm is standardized though in https://tools.ietf.org/html/rfc6238

Re: A future without passwords

#210

Post by timwis »

bawolff wrote: post #209
timwis wrote: post #207

Earlier quoted context omitted.

Good point, but wouldn’t they also need the time based algorithm? Here’s some more ammunition for your argument though: https://www.csoonline.com/article/3272425/11-ways-to-hack-2f...

The time based algorithm is standardized though in https://tools.ietf.org/html/rfc6238

Well shit.
Post reply on HN