Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why even let users set their own passwords?

devever.net

Post reply on HN
Print view View original

131–140 of 392 posts

Re: Why even let users set their own passwords?

#131

Post by Y-bar »

highwaylights wrote: post #114
ClumsyPilot wrote: post #108

Earlier quoted context omitted.

> He has a notebook of passwords, that's how he works and he won't change. A notebook in a locked safe is the most secure datastore for 90 - 98% of the population - depending of how deeply you distrust NSA.

This is only true if you’re very selective about which threats you want to acknowledge. If someone breaks into my house I’d rather they just got my TV and some belongings rather than my life savings.

I'd wager that >99% of all burglaries are looking for physical possessions which can be sold for a quick buck. Not looking for random notebooks of passwords. So locking it in a safe might not be optimal because it will be like putting a spotlight on it.

Re: Why even let users set their own passwords?

#132

Post by anderspitman »

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I read OP's mention of third party cookies as an example of browsers supposedly moving in a more privacy focused direction, not as being related to authentication.

Re: Why even let users set their own passwords?

#133

Post by hgsgm »

gcanyon wrote: post #88
samwillis wrote: post #5

We probably will stop one day, but that day isn't yet for many services. There are people who would be unable to use those services if that can't set the password to either the same or a variant of one they always use. In the tech wold we often forget that there is a wide disparity in people's ability to use tech. Take my father, there is no way he could use a password manager, or two factor, it's just never going to…

> Take my father, there is no way he could use a password manager...He has a notebook of passwords Your father does use a password manager: a slow, very inconvenient one. If you could teach him to reach for ctrl-c/ctrl-v instead of a pencil, it would be easier for him.

My password manager is built into my browser. I just push the button to login.

Re: Why even let users set their own passwords?

#134

Post by seabass-labrax »

jdthedisciple wrote: post #63

I've said it before and I'll say it again (and yes let it rain downvotes): I don't understand this whole discussion and maligning of passwords. You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user onc…

You cannot save all people - too true. But remember that you, actually all of us, are indirectly the victim of other peoples' mistakes:

- we lose contact with people because they get locked out of their email

- we pay more in bank account fees to subsidise fraud compensation

- we have our personal information stolen because others chose weak passwords

Given how much we suffer from other peoples' poor choices, there is a huge incentive to somehow stop people from making poor choices. By analogy, we all benefit from fences by cliffs because the family of the unlucky soul who wandered off it, the emergency services and their funders all suffer too. If it weren't for values like personal freedom, aesthetics, financial cost and an apathy towards accidents, there would be no clifftop in the world without a fence by it.

Re: Why even let users set their own passwords?

#135

Post by AndrewKemendo »

>The only discernible difference between TOTP and a site-generated password is in how knowledge of the secret is proven. With TOTP, knowledge of the secret is proven without sending it to the website. With a site-generated password, knowledge of the secret is proven by sending that secret to the website.

The whole point of a passphrase is that IT DOESNT CHANGE HANDS EVER.

The reality though is that computers subvert the system of passphrasing because the complexity required for passphrases within a computing systems is easy for computers to beat but hard for people to recall

So you have a perfect situation where the historical context is maintained (person will remember their self-generated passphrase) but the system also can probably guess any passphrase that a human could remember without any additional tools

So now, given that we REQUIRE more complexity than people can recall, we force people to use additional tools for creating/managing their passphrases which subvert the entire principle of a passphrase. Namely:

IT DOESNT CHANGE HANDS EVER

So the whole system is corrupted at it's root and there is no way to solve this problem with the current structure

Re: Why even let users set their own passwords?

#136

Post by anderspitman »

justsomeadvice0 wrote: post #92

A long time ago I wrote a variant of this - the signup page would generate a token, place it in a hidden password field, submit a hidden form, and instruct the user to click the "Save password" dialog in their browser. One advantage of this was e.g. Chrome would sync the password immediately across all your devices (in some ways this was a privacy violation, although one that the user had to explicitly opt themselves…

This is interesting. I'm not sure how I feel about it from the perspective of the user understanding what they're consenting to, but it's secure and the flow is simple.

I don't support passwords on any of my services. Emailed magic links and SSO are the encouraged methods, even with all the tradeoffs. I've considered allowing users to generate tokens similar to OP, but some percentage of them will be emailed around and pasted into phishing sites etc.

But something like this could work as an option, especially if it could integrate with a couple popular password managers as well. Not sure if that's even possible.

Re: Why even let users set their own passwords?

#137

Post by lolinder »

Pxtl wrote: post #59

Honestly, unless you're a major cloud/OS provider like Google/FB/MS/Apple, you shouldn't be managing passwords at all. Let the pros do that. You just use an authentication standard via a 3rd party. If you aren't big enough to maintain your own operating system and web browser, you shouldn't be storing passwords.

I do not want to log in with Google or GitHub or Apple or anything else. I want an account on your site, even if you're bad at security (though you should at least store hashes and not plaintext passwords). Keeping track of another login is as simple as adding a new password to my password manager, and that gives me much more control over my digital life than logging into everything with my Google account.

Re: Why even let users set their own passwords?

#138

Post by QhwyF3AxE »

notpushkin wrote: post #43
londons_explore wrote: post #36

Earlier quoted context omitted.

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

So, like Passkeys / WebAuthn?

passkeys is a common noun (like the word “password”) and therefore should always be lowercase unless it’s the first word in the sentence.

Re: Why even let users set their own passwords?

#139

Post by Brian_K_White »

londons_explore wrote: post #36
lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

I think SQRL does this. But since no one can own it or sell it, it will never be adopted by anything that matters.

Re: Why even let users set their own passwords?

#140

Post by CoastalCoder »

londons_explore wrote: post #36
lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

> I kinda wish there was something like cookies, but even more persistent.

Fruitcakes.

Post reply on HN