Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords Are Fine

herman.bearblog.dev

Post reply on HN
Print view View original

31–40 of 169 posts

Re: Passwords Are Fine

#31

Post by Arch-TK »

cj wrote: post #6
foobarbecue wrote: post #3

Earlier quoted context omitted.

Why not chrome?

This isn't a great answer, but I've never liked Chrome password manager because I feel like a password manager is something I want to pay a company for, not a service I want to be given for free. Somehow, it being a free feature that's bundled with my browser makes me not trust it. (Again, not claiming this is a great reason not to use it)

Weird.

I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android).

I basically refuse to use any password manager with an implementation I can't see or audit.

I can't imagine trusting any company to handle my passwords correctly.

The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would cause me to lose control over my passwords unless I lose control over the yubikey itself.

Re: Passwords Are Fine

#32

Post by apetrovic »

> I guess the point I'm trying to make here is that the problem with passwords is password hygiene, not with the method itself.

I guess the point I'm trying to make here is that the problem with obesity is just amount of food consumed, not the food itself.

Re: Passwords Are Fine

#33

Post by mixmastamyk »

crooked-v wrote: post #8

What I find more annoying is the aggressive insistence of bigcorps to do everything possible with 2FA except actually just use the damn 2FA code I already have set up in my password manager. SMS, emails, pushing codes to random devices I'm logged in on, whatever.

I recently got a pair of yubikeys… they have been around about ten years already and support industry standards. Guess how many services I use support them? A smaller fraction than I’d like.

Re: Passwords Are Fine

#34

Post by ethanbond »

MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

If you use an authentication app instead of SMS 2FA (which you should anyway), you don’t need cell service.

You can even have the authentication app on your laptop so you don’t need to switch devices (1Password at least supports this).

Re: Passwords Are Fine

#35

Post by yunohn »

MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

> it seems like a dangerous crutch than a useful technology

Not to sidetrack, but could you expound further? I struggle to reach the blanket conclusion of “not useful”.

I don’t really see how it’s a crutch, more than any other assistance tool like Google, StackOverflow, code-completion or actual docs. Hallucination is a separate problem, which is solved by using fine-tuned models.

Re: Passwords Are Fine

#36

Post by krisoft »

hulitu wrote: post #9
jlmb wrote: post #4

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method. I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

> so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?

> I'm old. What's the difference between a pass word and a pass key ?

Password: You have to choose a good one using your brain or a password manager of your choice, and you have to remember it using your brain or a password manager of your choice.

Passkey: Your device generates it for you, whether or not it is sufficiently random, and long enough is not up to you. You don't even have to worry about it. Your device stores it for you. You don't have to remember it in your brain, you don't have a choice if you want to use a password manager or not. The passkey is stored in something which is functionally equivalent to a password manager.

> how exactly is "this button" authenticated ?

What are you asking? How is it authenticated between the server and the client? Or how is it authenticated that the person pressing the button is the right person on the client side?

Re: Passwords Are Fine

#37

Post by rationalist »

ethanbond wrote: post #34
MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

If you use an authentication app instead of SMS 2FA (which you should anyway), you don’t need cell service. You can even have the authentication app on your laptop so you don’t need to switch devices (1Password at least supports this).

Lots of services do not offer that ability, especially when signing up.

Re: Passwords Are Fine

#38

Post by rjzzleep »

creshal wrote: post #24
figbert wrote: post #20

The argument that passwords are acceptable as long as everyone practices good "hygiene" strikes me as having many parallels with the argument that C code is memory safe as long as it is written properly. I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it.

> I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it. It's a hard problem. I don't think passkeys really are the solution long term, they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately.

Not really, to some extent some amount of collateral damage is necessary for a free and open society. I don't want to live in a nanny state that decides everything for me.

But somehow the same people arguing for ultimate freedom and OSS are also arguing for centralization of passwords into corporate controlled infrastructure.

I'm somewhat at a loss on how to argue on these issues. You want to hand over control over your key infrastructure to big tech and you want the average population to do that as well? Go ahead. Most people on iPhones already use sign in with Apple with apples 2FA system anyway it won't matter to them.

But why encroach on me and force me to use it to protect me from myself?

Re: Passwords Are Fine

#39

Post by Mordisquitos »

k8sToGo wrote: post #10
stevage wrote: post #7

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

Of course you despise it. Security always comes at the cost of convenience.

Those who would give up essential Security, to purchase a little temporary Convenience, deserve neither Security nor Convenience.

    — Frankmin Benjalin

Re: Passwords Are Fine

#40

Post by api »

Mordisquitos wrote: post #39
k8sToGo wrote: post #10

Earlier quoted context omitted.

Of course you despise it. Security always comes at the cost of convenience.

Those who would give up essential Security, to purchase a little temporary Convenience, deserve neither Security nor Convenience. — Frankmin Benjalin

Lol. That’s 99.9% of all users especially if you consider privacy a subset of security.
Post reply on HN