Why even let users set their own passwords? • Hacker News Board

Re: Why even let users set their own passwords?

#121

Post by amadeuspagel » Sat, Jul 22, 2023, 3:42 PM UTC

londons_explore wrote: post #36

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

The max age of a cookie is a little more then a year, meaning that as long as you visit a site more then once per year, this is possible.

Re: Why even let users set their own passwords?

#122

Post by samwillis » Sat, Jul 22, 2023, 3:43 PM UTC

j5155 wrote: post #96

londons_explore wrote: post #86

Earlier quoted context omitted.

Apple will make sure PWA's aren't successful. They can't risk their control over the app ecosystem.

Are you aware that iOS supports PWAs, and recently implemented notifications for them?

Exactly, they are in recent years moving to address these previous issues, I applaud them.

I would like it if they were more discoverable, but not necessarily with the obnoxious pop ups. It would be awesome if they let you list a PWA in the App Store for a fee or the 30% cut.

Re: Why even let users set their own passwords?

#123

Post by fooker » Sat, Jul 22, 2023, 3:43 PM UTC

londons_explore wrote: post #36

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

>There would be mechanisms to backup my permacookies, or transfer them to other devices.

There would also be intentional and unintentional mechanisms for stealing these permacookies.

Re: Why even let users set their own passwords?

#124

Post by ballenf » Sat, Jul 22, 2023, 3:44 PM UTC

londons_explore wrote: post #36

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

Password managers could take over and manage cookie storage/retrieval.

Or browsers could treat cookies more like passwords and have a user-controllable flow on each new session: "Here's this site's cookies from your last session, do you want to place these back in the browser storage?"

The fundamental issue is that browser cookies and password managers have an overlap in their usage domain.

Re: Why even let users set their own passwords?

#125

Post by causality0 » Sat, Jul 22, 2023, 3:46 PM UTC

I'm not going to use your service if I can't set my own password and be the one to decide if it needs more than just a password. The services I spend most of my time on and have vulnerable data on use 2FA, but the majority of my accounts do not. My accounts for downloading Super Mario 64 romhacks or posting comments about barbecue recipes aren't going to get entries on my Authenticator app nor do they deserve one.

Re: Why even let users set their own passwords?

#126

Post by samwillis » Sat, Jul 22, 2023, 3:47 PM UTC

tomsmeding wrote: post #117

gcanyon wrote: post #88

Earlier quoted context omitted.

> Take my father, there is no way he could use a password manager...He has a notebook of passwords Your father does use a password manager: a slow, very inconvenient one. If you could teach him to reach for ctrl-c/ctrl-v instead of a pencil, it would be easier for him.

It would be easier for you, who (I suspect) has, like most of us here on HN, a good understanding of what happens on a computer, how to control that, how to manage their software, how to be aware of what is on the foreground when and taking input when. How to recognise various applications and seeing the difference between materially different ones that try to look the same. Your notebook will look markedly different…

> I think GP's father doesn't have that awareness, and never will, by choice.

This! I mention password managers, two factor or just try and get him to improve his passwords and his eyes glaze over and can see him beginning to nod off. Probably somewhat my fault for always bring them up after a meal when he's probably already half way to napping...

Re: Why even let users set their own passwords?

#127

Post by SoftTalker » Sat, Jul 22, 2023, 3:47 PM UTC

sublinear wrote: post #110

hkt wrote: post #91

Earlier quoted context omitted.

What you're looking for is client certificates. This has existed for years but webby people think users are too stupid to use them, so we get the menagerie of half baked trash we have now instead.

> What you're looking for is client certificates. I agree with this, but... > users are too stupid to use them they are. Key management is not trivial.

Yes, if you've ever managed a shared unix system that uses ssh keys for login, you know that a large fraction of users cannot manage them.

Among the steps of generating a key pair, getting the public key (not the private one) into their authorized_keys file (which is in a hidden directory, for pete's sake) without introducing any extra characters or line breaks or getting the wrong permissions on the file, getting their ssh client programs to use the proper private key for the host they are trying to log in to, or figuring out ssh-agent, there are just way too many opportunities to screw up or get confused.

Re: Why even let users set their own passwords?

#128

Post by anderspitman » Sat, Jul 22, 2023, 3:48 PM UTC

samwillis wrote: post #5

We probably will stop one day, but that day isn't yet for many services. There are people who would be unable to use those services if that can't set the password to either the same or a variant of one they always use. In the tech wold we often forget that there is a wide disparity in people's ability to use tech. Take my father, there is no way he could use a password manager, or two factor, it's just never going to…

Is the cost of getting phished really lower than the cost of learning a password manager for your dad?

Re: Why even let users set their own passwords?

#129

Post by NegativeK » Sat, Jul 22, 2023, 3:48 PM UTC

highwaylights wrote: post #114

ClumsyPilot wrote: post #108

Earlier quoted context omitted.

> He has a notebook of passwords, that's how he works and he won't change. A notebook in a locked safe is the most secure datastore for 90 - 98% of the population - depending of how deeply you distrust NSA.

This is only true if you’re very selective about which threats you want to acknowledge. If someone breaks into my house I’d rather they just got my TV and some belongings rather than my life savings.

Most people are more at risk from bad passwords and website breaches than from home burglary.

Re: Why even let users set their own passwords?

#130

Post by samwillis » Sat, Jul 22, 2023, 3:50 PM UTC

anderspitman wrote: post #128

samwillis wrote: post #5

We probably will stop one day, but that day isn't yet for many services. There are people who would be unable to use those services if that can't set the password to either the same or a variant of one they always use. In the tech wold we often forget that there is a wide disparity in people's ability to use tech. Take my father, there is no way he could use a password manager, or two factor, it's just never going to…

Is the cost of getting phished really lower than the cost of learning a password manager for your dad?

Is the cost of lung cancer lower than smoking?

Some people will just never change a behaviour.