Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords Are Fine

herman.bearblog.dev

Post reply on HN
Print view View original

71–80 of 169 posts

Re: Passwords Are Fine

#71

Post by gruez »

throwkjsdhfkjds wrote: post #64
MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. People can find my phone, match my phone number to my email address using leaked data, try these credentials on different services and wait until they get a reset password SMS. So by forcing me to add my phone number some services act…

>I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue.

This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.

Re: Passwords Are Fine

#72

Post by redog »

Joker_vD wrote: post #52
mixmastamyk wrote: post #33

Earlier quoted context omitted.

I recently got a pair of yubikeys… they have been around about ten years already and support industry standards. Guess how many services I use support them? A smaller fraction than I’d like.

I always find it funny that a thing can be an "industry standard" even if nobody supports it.

The industry of dreams. Build it and they will ComeAsAService

Re: Passwords Are Fine

#73

Post by hipokampa »

With a password manager you're putting all the eggs in the same basked. Why I'm I the only one who see this?

More analyticalally: the probability_of_an_account_getting_hacked times damage is constant. More unrelated accounts you have, hack more probable, less damage on a single hack. With one password manager account, everything you have is at stake.

There is no way around it. You can't manage this risk.

Re: Passwords Are Fine

#74

Post by chkaloon »

Arch-TK wrote: post #31
cj wrote: post #6

Earlier quoted context omitted.

This isn't a great answer, but I've never liked Chrome password manager because I feel like a password manager is something I want to pay a company for, not a service I want to be given for free. Somehow, it being a free feature that's bundled with my browser makes me not trust it. (Again, not claiming this is a great reason not to use it)

Weird. I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android). I basically refuse to use any password manager with an implementation I can't see or audit. I can't imagine trusting any company to handle my passwords correctly. The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would ca…

Did you actually look at it and audit it? >99% of people aren't going to do that. They're just assuming somebody has.

Re: Passwords Are Fine

#75

Post by ValleZ »

rjzzleep wrote: post #38
creshal wrote: post #24

Earlier quoted context omitted.

> I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it. It's a hard problem. I don't think passkeys really are the solution long term, they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately.

Not really, to some extent some amount of collateral damage is necessary for a free and open society. I don't want to live in a nanny state that decides everything for me. But somehow the same people arguing for ultimate freedom and OSS are also arguing for centralization of passwords into corporate controlled infrastructure. I'm somewhat at a loss on how to argue on these issues. You want to hand over control over y…

Because users who lost account because of lack of 2FA usually require attention and support resources. It’s easier to require more security than to figure out if this is a legitimate user who is trying to get access.

Re: Passwords Are Fine

#76

Post by madeofpalk »

I think this article misses the mark in a pretty big way.

It starts off by saying the problem with WebAuthn is lack of widespread support, which is fair now, but not a fundamental unsolvable problem. WebAuthn/Passkeys are pretty new - essentially less than 12 months old (since iOS 16 GA). Google.com added support this year, and Apple.com is adding support this year. iOS 17 adds support to the system frameworks to let third party apps (like 1Password) store and sync Passkeys.

But my biggest objection is with saying all problems of passwords are "solved by fairly simple password hygiene". Apart from the "if everyone just did the correct thing we wouldn't have any problems" declaration, IMHO the main advantage of Passkeys is that they eliminate phishing as a possibility due to the public/private key cryptography.

Passkeys just entirely eliminate classes of problems with passwords by shifting the burden of security from the user to the tech itself.

I remain skeptical that Passkeys will end up with widespread support, and I think it's too early to tell how it'll go, but all signs are pretty promising. I hope Passkeys work out.

Re: Passwords Are Fine

#77

Post by sufehmi »

"I guess the point I'm trying to make here is that the problem with passwords is password hygiene, not with the method itself"

Clearly this guy has never got his password sniffed before, or even heard about it.

It's always painful to see someone who doesn't understand something talking about it, and worse, badmouthing it.

And,

"Notice that all of these problems are solved by fairly simple password hygiene"

Clearly this guy has never heard about various fiascos of various password manager software.

=====

Passkey doesn't need you connected to the internet.

Google Auth too.

Actually weak password is fine, when you have 2FA. I have some accounts which has weak password, some even already in haveibeenpwned; but no problem for years because it got 2FA as well.

Password alone without 2FA is okay, as long you can ensure no malware/keylogger enter your system. Which is a risk.

Forcing your users to change their password routinely is bad policy, it motivates your users to use weak password and/or store it insecurely, and other unexpected behaviours.

SMS 2FS sucks because it can be intercepted and/or snooped - no, this is not just a theory, this happens rather routinely in my country.

Etc etc

Re: Passwords Are Fine

#78

Post by ValleZ »

Arch-TK wrote: post #31
cj wrote: post #6

Earlier quoted context omitted.

This isn't a great answer, but I've never liked Chrome password manager because I feel like a password manager is something I want to pay a company for, not a service I want to be given for free. Somehow, it being a free feature that's bundled with my browser makes me not trust it. (Again, not claiming this is a great reason not to use it)

Weird. I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android). I basically refuse to use any password manager with an implementation I can't see or audit. I can't imagine trusting any company to handle my passwords correctly. The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would ca…

How do you know that the product you use was built from the provided sources?

Re: Passwords Are Fine

#79

Post by 5e92cb50239222b »

kedean wrote: post #70
mixmastamyk wrote: post #33

Earlier quoted context omitted.

I recently got a pair of yubikeys… they have been around about ten years already and support industry standards. Guess how many services I use support them? A smaller fraction than I’d like.

My employer had a program where you could put in a request and get a free yubikey. Turns out they basically only work with Chrome (no Firefox, no terminal-based auth), so none of my team actually ever uses theirs because it's not really more convenient.

When was that? I use a pair of cheap FIDO2 keys with both Firefox and the Linux PAM module. It's hell of a lot more convenient than typing in passwords to unlock LUKS volumes or sign in to web services, that's for sure. I use mini keys though, they barely stick out of USB ports.

Re: Passwords Are Fine

#80

Post by cesarb »

luma wrote: post #59
MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network, this isn’t exactly a surprise.

> If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network

It might seem surprising these days, but the parent poster might have network access through means other than a phone.

Post reply on HN