Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords Are Fine

herman.bearblog.dev

Post reply on HN
Print view View original

161–169 of 169 posts

Re: Passwords Are Fine

#161

Post by szasamasa »

UncleMeat wrote: post #111
wasmitnetzen wrote: post #11

Earlier quoted context omitted.

Passkeys are basically enforced password managers with random passwords. There's some more complexity below the surface, but for the user, that's it.

It's even better than that. They don't give any secret data to the service you are using.

I read this all the time, ist it true?

isnt public key a bad wording suggesting it should or can be public?

I would call it verification key and keep it secret on the server

only thing it need not to be hashed, it is already "hashed" meaning if it leaks it has 128 bit security or so

if I get it well, the private key can be guessed from the public key from huge alien resources so it is actualyl like an already computer intensive hashed 128 random password from a 2^128 domain?

I do not think the public key is to be posted on twitter or should not be guarded at all... it is just not the signing key and it is 128 bit strong away from it

Re: Passwords Are Fine

#162

Post by szasamasa »

wasmitnetzen wrote: post #11
hulitu wrote: post #9

Earlier quoted context omitted.

> so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?

Passkeys are basically enforced password managers with random passwords. There's some more complexity below the surface, but for the user, that's it.

good point

pass manager is needed and that is one of the key differences

it is good but also a challenge for some people, especially if the 3 bigs cannot sync because normal people without pass manager begin to use Apple, Google, Microsoft pass management... if they have all 3 devices, all of them...

what I do not understand, what the heck is the goal, one passkey per service and total sync or a domain (server) has to create and manage 4 passkeys for 4 operating system providers if user does not use a total syncing pass manager?

that is the problem since those who use pass managers are normally ok but those who dont, and wont register/trust/pay for one, begin to use A/G/M/L pass managers and 4 pass manager accounts must be secured?

and then you begin creating 4 passkeys for each website?

Re: Passwords Are Fine

#163

Post by szasamasa »

k8sToGo wrote: post #19
hulitu wrote: post #9

Earlier quoted context omitted.

> so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?

The button is authenticated through the phone biometrics for example.

no button is authenticated

you start a process by pressing the button and authenticate via having the device and using your os account biometrics/passcode

then your pass manager signs a challenge with the passkey proving that you come from a trusted device (you are logged in to your pass manager) where you are the os account owner

Re: Passwords Are Fine

#164

Post by UncleMeat »

szasamasa wrote: post #161
UncleMeat wrote: post #111

Earlier quoted context omitted.

It's even better than that. They don't give any secret data to the service you are using.

I read this all the time, ist it true? isnt public key a bad wording suggesting it should or can be public? I would call it verification key and keep it secret on the server only thing it need not to be hashed, it is already "hashed" meaning if it leaks it has 128 bit security or so if I get it well, the private key can be guessed from the public key from huge alien resources so it is actualyl like an already compute…

It is 100% fine to have adversaries know your public key. Asymmetric key crypto is not the same as "already hashed private keys." You can happily use a 4096 bit RSA key if 112 bits of effective security isn't enough for you.

Re: Passwords Are Fine

#165

Post by szasamasa »

a-dub wrote: post #49

passwords are not fine. my user agent should do otp on my behalf with clean, hassle free and reliable ux. my secrets should auto-rotate on a regular schedule and i should be able to force a rotation at any time in the event of a compromise. the existence of a relationship between myself and any party i wish to authenticate with, or knowledge of authentication events shall remain private between myself and that party…

so your concrete suggestion?

Re: Passwords Are Fine

#166

Post by szasamasa »

UncleMeat wrote: post #164
szasamasa wrote: post #161

Earlier quoted context omitted.

I read this all the time, ist it true? isnt public key a bad wording suggesting it should or can be public? I would call it verification key and keep it secret on the server only thing it need not to be hashed, it is already "hashed" meaning if it leaks it has 128 bit security or so if I get it well, the private key can be guessed from the public key from huge alien resources so it is actualyl like an already compute…

It is 100% fine to have adversaries know your public key. Asymmetric key crypto is not the same as "already hashed private keys." You can happily use a 4096 bit RSA key if 112 bits of effective security isn't enough for you.

you dont quite get my point

i compare password hashing on server with passkeys where you store the public key on the server... we are told to hash computer intensive preparing for the worst that the server is breached and an attacker has the stored hashed (salted, peppered) password... then with brute force if you hashed computer intensive and the password was not weak, it can be i dont know 60,80,120 bit strong?

well you can actually get the password from the hash but if everything ok, infeasible... i guess it is the same with getting the private key from the public key, it is possible but with ecdsa256 i read 128 bit strong or so

i dont want more security i just find it interesting that nobody says the hashes are not a secret... ok it is more problematic since weak passwords remain much weaker hashed or not

i would still say if possible keep your verification key to yourself... and if it leaks, no problem

i would call them secret key (private) and verification key (public)

but i dont know much about this and i guess by digital signatures they are really public? but hey may be even stronger

Re: Passwords Are Fine

#167

Post by UncleMeat »

szasamasa wrote: post #166
UncleMeat wrote: post #164

Earlier quoted context omitted.

It is 100% fine to have adversaries know your public key. Asymmetric key crypto is not the same as "already hashed private keys." You can happily use a 4096 bit RSA key if 112 bits of effective security isn't enough for you.

you dont quite get my point i compare password hashing on server with passkeys where you store the public key on the server... we are told to hash computer intensive preparing for the worst that the server is breached and an attacker has the stored hashed (salted, peppered) password... then with brute force if you hashed computer intensive and the password was not weak, it can be i dont know 60,80,120 bit strong? wel…

There's more than one way to expose a password. You can have it phished, for example. Passkeys are immune to this.

You can use the terms you want. Other people will use normal terms.

Re: Passwords Are Fine

#168

Post by MrVandemar »

yunohn wrote: post #35
MrVandemar wrote: post #30

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…

> it seems like a dangerous crutch than a useful technology Not to sidetrack, but could you expound further? I struggle to reach the blanket conclusion of “not useful”. I don’t really see how it’s a crutch, more than any other assistance tool like Google, StackOverflow, code-completion or actual docs. Hallucination is a separate problem, which is solved by using fine-tuned models.

To quote Hofstadter:

I frankly am baffled by the allure ... of letting opaque computational systems perform intellectual tasks for them. ...when it comes to using language in a sensitive manner and talking about real-life situations where the distinction between truth and falsity and between genuineness and fakeness is absolutely crucial, to me it makes no sense whatsoever to let the artificial voice of a chatbot, chatting randomly away at dazzling speed, replace the far slower but authentic and reflective voice of a thinking, living human being.

https://www.theatlantic.com/ideas/archive/2023/07/godel-esch...

Re: Passwords Are Fine

#169

Post by szasamasa »

UncleMeat wrote: post #167
szasamasa wrote: post #166

Earlier quoted context omitted.

you dont quite get my point i compare password hashing on server with passkeys where you store the public key on the server... we are told to hash computer intensive preparing for the worst that the server is breached and an attacker has the stored hashed (salted, peppered) password... then with brute force if you hashed computer intensive and the password was not weak, it can be i dont know 60,80,120 bit strong? wel…

There's more than one way to expose a password. You can have it phished, for example. Passkeys are immune to this. You can use the terms you want. Other people will use normal terms.

fishing is another topic we did not talk about passwords vs. passkeys

we talked about whether a public key is actually a similar secret than a well managed (hashed) password

well it is not up to you to decide what terms are normal the language, concepts evolve

if you want to understan things better than you do know, sometimes you go 1-2 levels deeper and think for yourself

a public key has a security strength, lets say 128 bit a computer intensive hashed strong password can level this if you generate unique very strong passwords for each site with your pass manager and(!) they hash it well, it can be compared to giving a public key to the site

in this sense your argument which you just copy from other people is false

a good argument would be that a public key that we give the sites has 100% strong security and the password will not travel from the client to the server, whereas plenty of domain service provider implement security bad so you have to rely on them

in addition, computer intensive hashing on the server is more electricity and cpu|memory usage

please try to talk about the actual topic and dont try to derail the conversation like it was about whether passkeys are better or not... hiding behind something you declare normal is also bad practice...

just debate the only thing I said: actually, you do give a kind of well guarded secret to the server and it is not like a public key should be advertised

I do think it is a very intersting thought

and, of course, if a password comes from a weak domain, you can hash minutes, it will never be as strong as a public key

Post reply on HN