Passwords Are Fine • Hacker News Board

Re: Passwords Are Fine

#11

Post by wasmitnetzen » Tue, Jul 04, 2023, 11:40 AM UTC

hulitu wrote: post #9

jlmb wrote: post #4

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method. I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

> so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?

Passkeys are basically enforced password managers with random passwords. There's some more complexity below the surface, but for the user, that's it.

Re: Passwords Are Fine

#12

Post by 4ad » Tue, Jul 04, 2023, 11:40 AM UTC

wheybags wrote: post #5

> My bank only supports SMS 2FA so while I'm travelling I'm effectively cut off from certain functionality EU citizen here. Do you... not have roaming?

International SMS delivery is unreliable. Unreliable is not strong enough word. It more often doesn't work that it does. Or it works with enough of a delay to cause a timeout on the site where you want to login.

Plus, you know, SMS hijacking and all that.

Re: Passwords Are Fine

#13

Post by mechhacker » Tue, Jul 04, 2023, 11:41 AM UTC

stevage wrote: post #7

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

It took over a year of mandatory 2fa w/ phone app before they stopped making us change our password every month.

At least my password isn't changing anymore but I never understood that policy if you made a strong password. It was overkill.

Some websites still require it though, and that's nonsensical and annoying. Just randomly generate one and keep it in a password manager.

Re: Passwords Are Fine

#14

Post by black3r » Tue, Jul 04, 2023, 11:41 AM UTC

stevage wrote: post #7

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

In my opinion 2FA is one of the best use cases for a smart watch, and at least Authy supports that use case, it's so much better than to look where I put my phone...

Re: Passwords Are Fine

#15

Post by highwaylights » Tue, Jul 04, 2023, 11:41 AM UTC

stevage wrote: post #7

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

But MFA is not supposed to replace your password. It’s in addition to it, and if it’s implemented correctly, only on new devices.

Once you’ve done the second factor dance on a new device once, and assuming the MFA setup has been done well, you shouldn’t need to reach for the MFA code again (at least, not often).

Re: Passwords Are Fine

#16

Post by [deleted] » Tue, Jul 04, 2023, 11:42 AM UTC

hulitu wrote: post #9

jlmb wrote: post #4

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method. I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

> so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?

[deleted]

Re: Passwords Are Fine

#17

Post by Cupprum » Tue, Jul 04, 2023, 11:42 AM UTC

k8sToGo wrote: post #10

stevage wrote: post #7

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

Of course you despise it. Security always comes at the cost of convenience.

Security is inconvenience, therefore the role of security is to find where is the limit. Because afterwards users will start to search for shortcuts, which usually makes the systems even less secure.

Re: Passwords Are Fine

#18

Post by stevage » Tue, Jul 04, 2023, 11:42 AM UTC

mechhacker wrote: post #13

stevage wrote: post #7

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

It took over a year of mandatory 2fa w/ phone app before they stopped making us change our password every month. At least my password isn't changing anymore but I never understood that policy if you made a strong password. It was overkill. Some websites still require it though, and that's nonsensical and annoying. Just randomly generate one and keep it in a password manager.

Maybe a fair choice would be you either have a super long password or you use MFA.

Re: Passwords Are Fine

#19

Post by k8sToGo » Tue, Jul 04, 2023, 11:43 AM UTC

hulitu wrote: post #9

jlmb wrote: post #4

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method. I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

> so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?

The button is authenticated through the phone biometrics for example.

Re: Passwords Are Fine

#20

Post by figbert » Tue, Jul 04, 2023, 11:43 AM UTC

The argument that passwords are acceptable as long as everyone practices good "hygiene" strikes me as having many parallels with the argument that C code is memory safe as long as it is written properly.

I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it.