Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords Are Fine

herman.bearblog.dev

Post reply on HN
Print view View original

101–110 of 169 posts

Re: Passwords Are Fine

#101

Post by khalladay »

gruez wrote: post #66
MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

>I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service. Have you tried enabling Wi-Fi calling or switching to a carrier that supports it? At least for my carrier and iOS, you can send/receive SMS messages (yes, the gree…

For some weird reason, when im travelling with wifi calling, receiving sms messages is a crap shoot. I basically dont get them if theyre sent by a gov agency, bank, etc.

I do still get them from android phones. Its weird, i have no idea why.

Re: Passwords Are Fine

#102

Post by nordsieck »

chkaloon wrote: post #74
Arch-TK wrote: post #31

Earlier quoted context omitted.

Weird. I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android). I basically refuse to use any password manager with an implementation I can't see or audit. I can't imagine trusting any company to handle my passwords correctly. The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would ca…

Did you actually look at it and audit it? >99% of people aren't going to do that. They're just assuming somebody has.

> Did you actually look at it and audit it? >99% of people aren't going to do that. They're just assuming somebody has.

That's a fair point. I certainly haven't.

But the great virtue of pass is that it runs locally, which means that it's much more difficult to attack than a SaS password manager.

Re: Passwords Are Fine

#103

Post by worksonmine »

chkaloon wrote: post #74
Arch-TK wrote: post #31

Earlier quoted context omitted.

Weird. I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android). I basically refuse to use any password manager with an implementation I can't see or audit. I can't imagine trusting any company to handle my passwords correctly. The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would ca…

Did you actually look at it and audit it? >99% of people aren't going to do that. They're just assuming somebody has.

I have, pass is just a bash script with <1000 loc.

Re: Passwords Are Fine

#104

Post by ajsnigrutin »

gruez wrote: post #96
ajsnigrutin wrote: post #90

Earlier quoted context omitted.

Don't sim cards have PIN authentication enabled by default?

Nearly every sim I've seen don't have one set by default, and I can't imagine the average smartphone user digging through their smartphone settings to add one.

Interesting... i usually buy prepaid sim cards outside of EU (due to "fuck-you" roaming prices), and every time I bought one, in multiple countries, I had to scratch off the silver "paint" to get to the random pin written on the sim card (the large plastic part, the one that you break of the mini/micro/nano sim from).

Re: Passwords Are Fine

#106

Post by bunga-bunga »

jlmb wrote: post #4

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method. I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

> passkeys are a much better and easier method

Disagree. This isn't possible with passkeys:

- logging into a service with email and brain-stored password from any device

With passkeys, your phone becomes your password, so don't break it, lose it, let it die, forget it in the car, become too old, let your kids use it, etc

> “tap this button to magically log in” method

That only works if the device you tap it on is the same device with the key, while that's not always the way for many people (sync may or may not be set up or active)

Re: Passwords Are Fine

#107

Post by MrVandemar »

cesarb wrote: post #80
luma wrote: post #59

Earlier quoted context omitted.

If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network, this isn’t exactly a surprise.

> If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network It might seem surprising these days, but the parent poster might have network access through means other than a phone.

I do :-)

Re: Passwords Are Fine

#108

Post by madeofpalk »

MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

Unfortunately this point is a bit of FUD about Passkeys (or just off topic). Passkeys themselves don't require internet access. Syncing them across devices might require internet access in the same way that password managers might require internet access to sync across devices.

Re: Passwords Are Fine

#110

Post by gruez »

khalladay wrote: post #101
gruez wrote: post #66

Earlier quoted context omitted.

>I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service. Have you tried enabling Wi-Fi calling or switching to a carrier that supports it? At least for my carrier and iOS, you can send/receive SMS messages (yes, the gree…

For some weird reason, when im travelling with wifi calling, receiving sms messages is a crap shoot. I basically dont get them if theyre sent by a gov agency, bank, etc. I do still get them from android phones. Its weird, i have no idea why.

>I do still get them from android phones. Its weird, i have no idea why.

If you have an android phone yourself, maybe it's not actually SMS and it's actually RCS[1]?

[1] https://en.wikipedia.org/wiki/Rich_Communication_Services

Post reply on HN