Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords Are Fine

herman.bearblog.dev

Post reply on HN
Print view View original

81–90 of 169 posts

Re: Passwords Are Fine

#81

Post by madeofpalk »

rjzzleep wrote: post #38
creshal wrote: post #24

Earlier quoted context omitted.

> I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it. It's a hard problem. I don't think passkeys really are the solution long term, they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately.

Not really, to some extent some amount of collateral damage is necessary for a free and open society. I don't want to live in a nanny state that decides everything for me. But somehow the same people arguing for ultimate freedom and OSS are also arguing for centralization of passwords into corporate controlled infrastructure. I'm somewhat at a loss on how to argue on these issues. You want to hand over control over y…

What part of Passkeys is "centralization of passwords into corporate controlled infrastructure"?

"Big Tech" does not control Passkeys beyond the work on the underlying WebAuthn spec https://www.w3.org/TR/webauthn-2/, and that they develop implementations of that spec.

Re: Passwords Are Fine

#82

Post by michaelt »

cassianoleal wrote: post #45
creshal wrote: post #24

Earlier quoted context omitted.

> I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it. It's a hard problem. I don't think passkeys really are the solution long term, they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately.

> they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately. Can you expand on these 2 points? I'm still trying to wrap my head around passkeys and these are some of the arguments I see around but never quite explained.

From a certain perspective, passkeys are a lot like using "Sign in with Google/Apple/Microsoft account"

Because if this passkey stuff takes off with normal people, 98% of passkeys will be stored in cloud accounts with those providers.

The weakest link in the security chain is the procedure for when the user forgets their password / loses their phone / gets a rootkit / gets phished / has their e-mail compromised. You can transfer that problem from your site to a cloud provider and hope they do a good job - but the problem doesn't go away.

Re: Passwords Are Fine

#83

Post by 5e92cb50239222b »

rjzzleep wrote: post #38
creshal wrote: post #24

Earlier quoted context omitted.

> I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it. It's a hard problem. I don't think passkeys really are the solution long term, they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately.

Not really, to some extent some amount of collateral damage is necessary for a free and open society. I don't want to live in a nanny state that decides everything for me. But somehow the same people arguing for ultimate freedom and OSS are also arguing for centralization of passwords into corporate controlled infrastructure. I'm somewhat at a loss on how to argue on these issues. You want to hand over control over y…

You can always use a FIDO2.1 key as a passkey, they're not tied to the big tech. I don't even have a smartphone and have been using them on the couple of sites that support passkeys just fine.

We will also have at least one open software implementation when this gets merged:

https://github.com/keepassxreboot/keepassxc/pull/8825

There are braindead implementations like PayPal's:

https://www.paypal.com/us/cshelp/article/what-are-paypal-pas...

that force you to use Android or iOS, but it's nothing new, they manage to fuck up everything they touch (for example, U2F 2FA only supports registering one hardware key and it has been that way for years).

Re: Passwords Are Fine

#84

Post by hpb42 »

BjoernKW wrote: post #62

What I find increasingly annoying is third parties (i.e. those whose primary service isn't to provide authentication or MFA, specifically) trying to route me through their mobile apps for a second factor. For example, GitHub and Google (via their Gmail mobile app) are constantly nagging me to open their apps for certain actions such as modifying security settings on a GitHub repository or even just logging in to Goog…

I use 2FA for GitHub with KeePassXC, on my desktop. I don't have a GitHub app on my phone. You can setup a TOTP app for GitHub without their mobile app.

Re: Passwords Are Fine

#85

Post by Freeboots »

MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

I'm in a similar boat. Not so much service, but I move around internationally and change sims a lot. I dont even have a sim most of the time, I'm on wifi 99% of the time.

Don't want to pay outrageous fees for Google FI or the like, as literally all I need it for is to get into online banking (who have decided sms 2fa is now compulsory, without offering any other options like an authenticator app). I'm currently locked out of my bank, will have to fork out $50+ just to call them, then hope I can convince them I am who I say I am. Then do the dance again next year when they do it again.

Can we all just do authenticator apps?

Re: Passwords Are Fine

#86

Post by ValleZ »

hulitu wrote: post #9
jlmb wrote: post #4

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method. I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

> so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?

Password is something you know and pass key(or a physical key) is something that you own.

Re: Passwords Are Fine

#87

Post by jeroenhd »

blackhaz wrote: post #28
highwaylights wrote: post #15

Earlier quoted context omitted.

But MFA is not supposed to replace your password. It’s in addition to it, and if it’s implemented correctly, only on new devices. Once you’ve done the second factor dance on a new device once, and assuming the MFA setup has been done well, you shouldn’t need to reach for the MFA code again (at least, not often).

In reality, the vast majority of services ignore that principle and MFA is a never-ending daily nightmare. It feels like I can't even take a leak without the phone now.

There's absolutely no reason why you'd need a phone for most services. TOTP generators exist for every device and every platform. Some password managers even automatically copy a TOTP code after autofilling a password field.

Of course, you'd lose most security benefits of TOTP, but if all you want is to ignore security concerns and log in without a phone, there are tons of ways to accomplish this. Just set up authy or krypt.co and be on your way.

IMO the MFA codes aren't even the problem. The fact that you need to reauthenticate multiple times per week is the real issue. Session tokens valid for longer than four hours seem to be considered a sin in most big tech companies for some obscure reason.

Re: Passwords Are Fine

#88

Post by bombcar »

luma wrote: post #59
MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network, this isn’t exactly a surprise.

In rural areas you can be in an area where you have a gigabit fiber connection and no cell service at all. Wi-Fi calling being added to the main carriers has been a game changer for rural access.

Re: Passwords Are Fine

#89

Post by stevage »

NoZebra120vClip wrote: post #26
stevage wrote: post #22

Earlier quoted context omitted.

I don't despise all inconvenient things. I don't mind carrying house keys. It's just a question of whether you value the security enough to make it worthwhile.

> I don't mind carrying house keys. House keys are a minimal inconvenience because the lock on your front door also affords minimal security. Just ask the Lock Picking Lawyer how long it would take a determined intruder to get into your home, whether by picking, force, or finding a weakness such as open window. If your home had high security, I can guarantee that you'd feel the inconvenience.

Indeed. But hopefully that was the tradeoff I had chosen.

MFA irritates me because usually it isn't my choice.

Re: Passwords Are Fine

#90

Post by ajsnigrutin »

gruez wrote: post #71
throwkjsdhfkjds wrote: post #64

Earlier quoted context omitted.

I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. People can find my phone, match my phone number to my email address using leaked data, try these credentials on different services and wait until they get a reset password SMS. So by forcing me to add my phone number some services act…

>I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.

Don't sim cards have PIN authentication enabled by default?
Post reply on HN