Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords Are Fine

herman.bearblog.dev

Post reply on HN
Print view View original

91–100 of 169 posts

Re: Passwords Are Fine

#91

Post by lapcat »

luma wrote: post #59
MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network, this isn’t exactly a surprise.

This really shouldn't have to be said, but wired internet and cellular internet are two different things.

Re: Passwords Are Fine

#92

Post by stevage »

pclmulqdq wrote: post #47
NoZebra120vClip wrote: post #26

Earlier quoted context omitted.

> I don't mind carrying house keys. House keys are a minimal inconvenience because the lock on your front door also affords minimal security. Just ask the Lock Picking Lawyer how long it would take a determined intruder to get into your home, whether by picking, force, or finding a weakness such as open window. If your home had high security, I can guarantee that you'd feel the inconvenience.

You can have a very secure facility that only uses a "house key"-style entry flow for the user. The key will look really weird (see Medeco and Evva for examples) and the building will have some design compromises - few entry points, no openable windows, etc. A password, in theory, could work the same way. Except that the normal password UX involves people remembering the password, which entails a huge security compro…

Personally I'd be fine with password restrictions like 16 characters minimum etc etc. Still better than MFA.

Re: Passwords Are Fine

#93

Post by NoZebra120vClip »

stevage wrote: post #89
NoZebra120vClip wrote: post #26

Earlier quoted context omitted.

> I don't mind carrying house keys. House keys are a minimal inconvenience because the lock on your front door also affords minimal security. Just ask the Lock Picking Lawyer how long it would take a determined intruder to get into your home, whether by picking, force, or finding a weakness such as open window. If your home had high security, I can guarantee that you'd feel the inconvenience.

Indeed. But hopefully that was the tradeoff I had chosen. MFA irritates me because usually it isn't my choice.

MFA has some sort of calculated irritation built into it.

Part of it consists in the incredibly varied ways it can manifest. I could receive an SMS code, an email code, I could generate a TOTP code (choice of two Yubikeys), I could use U2F/FIDO (choice of 3 Yubikeys), I could get a Magic Link, I could use Sign in with Google, I could punt and use a code on my emergency backup paper. Don't forget to pass a CAPTCHA, and your password probably expired while you were away, as well.

Of course this all transpires after I've unlocked my password manager's vault, which has its own style of 2FA security, its own timeouts, and its own UI/UX quirks.

So you can see the sheer dizzying possible mutations of the MFA flow. Sometimes you don't even know what they'll hit you with until you try to log in!

What amuses me is "We sent a code to your email. This message will self-destruct in 10 minutes." when email used to arrive on the scale of 5-7 days if the server was overloaded or busy. Oftentimes I find myself racing multiple timeouts to run the gauntlet of MFA in whatever way has been mandated.

Re: Passwords Are Fine

#94

Post by connordoner »

redog wrote: post #72
Joker_vD wrote: post #52

Earlier quoted context omitted.

I always find it funny that a thing can be an "industry standard" even if nobody supports it.

The industry of dreams. Build it and they will ComeAsAService

> ComeAsAService

I’m sure there’s a joke in here to be made about dating apps.

Re: Passwords Are Fine

#95

Post by a_imho »

Why not just let everyone use their preferred method for authentication and not forcing a particular doing-it-the-right-way on people?

Also, how many accounts and passwords people tend to have which are pets rather than cattle? Bank and email can cause major headaches and probably everyone has 1-2 more accounts which they value and would cause significant setbacks if compromised. Passwords are plenty fine.

Re: Passwords Are Fine

#96

Post by gruez »

ajsnigrutin wrote: post #90
gruez wrote: post #71

Earlier quoted context omitted.

>I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.

Don't sim cards have PIN authentication enabled by default?

Nearly every sim I've seen don't have one set by default, and I can't imagine the average smartphone user digging through their smartphone settings to add one.

Re: Passwords Are Fine

#97

Post by andrewl-hn »

ajsnigrutin wrote: post #90
gruez wrote: post #71

Earlier quoted context omitted.

>I have a dumbphone. Until recently I could not care less about losing it. But I realised that since it's not PIN protected (I could but don't want to do it), losing is a security issue. This really isn't a dumb phone specific issue. Even for smartphones if someone stole it they could pop out the sim and if it isn't password protected (most aren't IME), they'll have full access to your phone number.

Don't sim cards have PIN authentication enabled by default?

Yes, but as I moved between countries and bought SIM cards from many carriers all carrier employees offered me to disable the pin "for convenience". Let's say your phone died, and you put it on a charger. A phone would eventually turn itself back on, but if your sim is locked you. wouldn't be able to accept incoming calls until you unlock the phone and unlock the phone. Without a sim pin once your phone turns on you become available again. People like that.

Also, even if you want to keep the pin on many people would set it to something convenient like 1111 or 9999. In fact, one of the carriers I used had 1111 s a default pin code for all their SIM cards.

So, while security is there in theory, in practice it's rarely in place.

Re: Passwords Are Fine

#98

Post by LilBytes »

rationalist wrote: post #37
ethanbond wrote: post #34

Earlier quoted context omitted.

If you use an authentication app instead of SMS 2FA (which you should anyway), you don’t need cell service. You can even have the authentication app on your laptop so you don’t need to switch devices (1Password at least supports this).

Lots of services do not offer that ability, especially when signing up.

Yep, banks are notorious for this.

E.g., ING in Australia.

Re: Passwords Are Fine

#99

Post by nordsieck »

ValleZ wrote: post #78
Arch-TK wrote: post #31

Earlier quoted context omitted.

Weird. I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android). I basically refuse to use any password manager with an implementation I can't see or audit. I can't imagine trusting any company to handle my passwords correctly. The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would ca…

How do you know that the product you use was built from the provided sources?

> How do you know that the product you use was built from the provided sources?

Maybe you haven't heard of pass[1], but it's an open source project, and it's easy to build from source[2].

---

1. https://www.passwordstore.org/

2. https://git.zx2c4.com/password-store/

Re: Passwords Are Fine

#100

Post by [deleted] »

Traubenfuchs wrote: post #61
luma wrote: post #59

Earlier quoted context omitted.

If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network, this isn’t exactly a surprise.

I assume he is talking about SMS. Maybe a virtual SMS inbox is the solution.

[deleted]
Post reply on HN