Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords Are Fine

herman.bearblog.dev

Post reply on HN
Print view View original

121–130 of 169 posts

Re: Passwords Are Fine

#121

Post by threatofrain »

MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

Every company's customer base is going to look different. This requires research, and developer empathy and life experience cannot substitute for research.

Re: Passwords Are Fine

#122

Post by mixmastamyk »

kedean wrote: post #70
mixmastamyk wrote: post #33

Earlier quoted context omitted.

I recently got a pair of yubikeys… they have been around about ten years already and support industry standards. Guess how many services I use support them? A smaller fraction than I’d like.

My employer had a program where you could put in a request and get a free yubikey. Turns out they basically only work with Chrome (no Firefox, no terminal-based auth), so none of my team actually ever uses theirs because it's not really more convenient.

Only use mine with Firefox.

Re: Passwords Are Fine

#123

Post by gruez »

screamingninja wrote: post #115
Freeboots wrote: post #85

Earlier quoted context omitted.

I'm in a similar boat. Not so much service, but I move around internationally and change sims a lot. I dont even have a sim most of the time, I'm on wifi 99% of the time. Don't want to pay outrageous fees for Google FI or the like, as literally all I need it for is to get into online banking (who have decided sms 2fa is now compulsory, without offering any other options like an authenticator app). I'm currently locke…

> outrageous fees for Google FI Last I checked, they were asking for $20 / month for unlimited calling and texting. Do you consider that outrageous? As an alternative, Google Voice will host your phone number for free. It works with every WiFi connection and even while traveling internationally. Have you considered that?

>Last I checked, they were asking for $20 / month for unlimited calling and texting. Do you consider that outrageous?

It's pretty outrageous if you already have a local sim, so you're basically paying google $20/month to only receive SMS messages.

Re: Passwords Are Fine

#124

Post by gruez »

Freeboots wrote: post #85
MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

I'm in a similar boat. Not so much service, but I move around internationally and change sims a lot. I dont even have a sim most of the time, I'm on wifi 99% of the time. Don't want to pay outrageous fees for Google FI or the like, as literally all I need it for is to get into online banking (who have decided sms 2fa is now compulsory, without offering any other options like an authenticator app). I'm currently locke…

Can't you find a cheap prepaid provider that has roaming access? Since you're not going to be making calls, the balance drain should be minimial, although you still have to top up a certain amount (depends on the carrier) to keep the sim active.

Re: Passwords Are Fine

#125

Post by michaelt »

cassianoleal wrote: post #120
michaelt wrote: post #82

Earlier quoted context omitted.

From a certain perspective, passkeys are a lot like using "Sign in with Google/Apple/Microsoft account" Because if this passkey stuff takes off with normal people, 98% of passkeys will be stored in cloud accounts with those providers. The weakest link in the security chain is the procedure for when the user forgets their password / loses their phone / gets a rootkit / gets phished / has their e-mail compromised. You…

> 98% of passkeys will be stored in cloud accounts with those providers. They will also (and primarily) be stored in the individual devices, and don't need cloud access to the providers in order to be used. In this sense, it solves one of the main issues with third-party sign-in, i.e. that if the provider decides to lock your account, you get locked out of any linked services. > You can transfer that problem from you…

> If your service associates a certain account to a certain public key, there's nothing an external cloud provider can do to solve the issue you describe.

Without passkeys, if one of my users lost their "second factor" (e.g. lost phone) I had to provide a flow for them to get into their account despite that, while remaining secure.

With passkeys, users can restore their "second factor" from a cloud backup, so long as they can get access to that cloud backup. Hence, my lost-second-factor flow is outsourced to the user's cloud provider.

Re: Passwords Are Fine

#126

Post by denton-scratch »

cesarb wrote: post #80
luma wrote: post #59

Earlier quoted context omitted.

If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network, this isn’t exactly a surprise.

> If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network It might seem surprising these days, but the parent poster might have network access through means other than a phone.

The only reason I have a smartphone is because many services (especially government services, like tax and the NHS) require a mobile phone so you can receive SMS. It's like how the government used to produce documents as MS Office files; they were forcing the public to go along with their choice of software company.

Most government docs are now PDFs, happily. But forcing people to choose between Android and iPhone (or forgoing service) is pretty nasty - these devices are expensive.

Re: Passwords Are Fine

#127

Post by denton-scratch »

jlmb wrote: post #4

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method. I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

> so passkeys are a much better and easier method

Thing is, most people don't understand passkeys. If you want to be secure, then you want to understand why and how you're secure; a pinky-promise that you're secure doesn't cut the mustard.

I do have some understanding of this kind of technology, having written for myself an OAuth server back in the day. I gave up on the server, because the services I wanted it for (bank, tax, medical) didn't accept OAuth, and because it was much too hard to understand.

Passkeys involves more third parties, and is even harder to understand.

Re: Passwords Are Fine

#128

Post by [deleted] »

luma wrote: post #59
MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

If you don’t have a smartphone, or your phone cannot connect to a service, why is authentication a problem? If you don’t network access you lose access to the network, this isn’t exactly a surprise.

[deleted]

Re: Passwords Are Fine

#129

Post by Arch-TK »

chkaloon wrote: post #74
Arch-TK wrote: post #31

Earlier quoted context omitted.

Weird. I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android). I basically refuse to use any password manager with an implementation I can't see or audit. I can't imagine trusting any company to handle my passwords correctly. The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would ca…

Did you actually look at it and audit it? >99% of people aren't going to do that. They're just assuming somebody has.

Yes, pass is 800 lines of relatively straightforward bash and I am qualified to review bash. Now, granted, it uses GnuPG and git but in those cases I think the risk of problems is minimal.

I haven’t in all honesty read the Password Store android application (nor OpenKeychain) source code but I trust my phone sandbox capabilities enough for it not to do anything nefarious like send my passwords somewhere. Its also not so large that it would be hard to read it.

The point is, the operating principles behind how Pass works are simple enough that its relatively easy to verify the core of any implentation and relatively difficult to smuggle in nefarious behavior.

Re: Passwords Are Fine

#130

Post by Arch-TK »

ValleZ wrote: post #78
Arch-TK wrote: post #31

Earlier quoted context omitted.

Weird. I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android). I basically refuse to use any password manager with an implementation I can't see or audit. I can't imagine trusting any company to handle my passwords correctly. The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would ca…

How do you know that the product you use was built from the provided sources?

It's 800 lines of bash. I can read it.
Post reply on HN