Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why even let users set their own passwords?

devever.net

Post reply on HN
Print view View original

191–200 of 392 posts

Re: Why even let users set their own passwords?

#191

Post by jefftk »

guraf wrote: post #155
londons_explore wrote: post #147

Earlier quoted context omitted.

Only 8 years late: https://developer.chrome.com/blog/push-notifications-on-the-... Besides - there are plenty of other things Apple can do to ensure PWA's don't take off. For example, there is no ability for a web-app to have a "click here to install to desktop" button - the website must try to guide the user into clicking the share button and then creating a desktop icon - which most users don't associate with 'inst…

Fascinating how to keep moving the goalposts. Firefox refuses to implement pwa. Chrome has pwas but they're not isolated. Apple is the only one with sane pwa but somehow they're the worst and are totally sabotaging PWAs because something something walled garden?

If you want to use a PWA on an iPhone, you are fully dependent on Safari support. Firefox's decisions here aren't blocking anyone.

Re: Why even let users set their own passwords?

#192

Post by kwhitefoot »

simias wrote: post #162
CrampusDestrus wrote: post #39

Earlier quoted context omitted.

in my locale's keyboard, curly brackets and the dollar sign are not obvious to input. they require an additional combo of keys that most people have no idea about.

Yeah that's a good point, I definitely that automatically generated passwords should be limited to alnum, using symbols is asking for trouble.

In what character set?

Re: Why even let users set their own passwords?

#193

Post by jefftk »

andai wrote: post #188
londons_explore wrote: post #147

Earlier quoted context omitted.

Only 8 years late: https://developer.chrome.com/blog/push-notifications-on-the-... Besides - there are plenty of other things Apple can do to ensure PWA's don't take off. For example, there is no ability for a web-app to have a "click here to install to desktop" button - the website must try to guide the user into clicking the share button and then creating a desktop icon - which most users don't associate with 'inst…

>50 MB excludes most messaging apps The entirety of TempleOS (including dozens of programs and multimedia games) is 2MB.

At 640x480 (for the whole screen) and 16-bit color

Re: Why even let users set their own passwords?

#194

Post by jefftk »

SoftTalker wrote: post #176
kelnos wrote: post #168

Earlier quoted context omitted.

> There is no online payment method I've seen that seems easier to me than just writing a check. Autopay. I only pay one bill manually, twice a year, because they don't allow autopay (property taxes). Otherwise I just don't think about it. Sure, you may not like autopay for whatever reason, but that's a choice. The option is there.

Yeah and I do use autopay for some very predictable things like utilities. I'm not totally comfortable with giving someone access to draw from my checking account whatever amount they claim I owe, but realistically these days a paper check becomes an ACH payment so I figure there are non-zero chances for error that just cannot be easily avoided.

> I'm not totally comfortable with giving someone access to draw from my checking account whatever amount they claim I owe

It's not comfortable, but every time you write a check you're doing exactly this.

Re: Why even let users set their own passwords?

#195

Post by ozim »

londons_explore wrote: post #36
lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

Webauthn should allow use of private key authentication stored on external hardware key or in device.

You really want support for key authentication just like ssh.

You shouldn’t move private keys between devices, you should have easy way to add new public keys to a service when you setu new device.

Problem is permacookies or private keys don’t really allow ad-hoc access but maybe nowadays people don’t need to login to their accounts from cyber cafes :)

Re: Why even let users set their own passwords?

#196

Post by axelthegerman »

londons_explore wrote: post #36
lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

How about local storage? Only downside is that this data isn't sent automatically on ever request (unlike cookies). It would be possible though to send this secret from local storage via a separate request and receive a session cookie that then let's you be logged in automatically

Re: Why even let users set their own passwords?

#197

Post by kmeisthax »

londons_explore wrote: post #36
lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

This is what HTTP auth headers are for, but the UX for using header authentication on modern browsers is utter garbage. There's no way to present a themed login form, no way to log the user out at all, and all sorts of weird papercut bugs[0] in between.

[0] My favorite: opening DevTools triggers a second credential prompt because the DevTools session wants to download some mapfiles or something. No infrastructure exists to make that HTTP request in the context of the current tab, apparently.

Re: Why even let users set their own passwords?

#198

Post by ec109685 »

londons_explore wrote: post #36
lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

That’s what Passkeys are supposed to do. You have an identity tied to that website, shared across all your devices.

Re: Why even let users set their own passwords?

#199

Post by croes »

justsomeadvice0 wrote: post #105
croes wrote: post #84

Earlier quoted context omitted.

A password can be stored offline without any electronic device or even be memorized only. Passkey depends on your device.

While you can't memorize it (memorizing a fair amount of entropy would take an intelligent human quite some time), you can of course store them offline (it's just a key). Today's initial implementation on macOS restricts exporting, but that is supposed to be added according to reliable Apple devs: https://hachyderm.io/@rmondello/110329118270492669

>you can of course store them offline

>Today's initial implementation on macOS restricts exporting,

So you can't. Will be able. How long can Tesla owner earn money with their self driving Tesla?

If you can export and import them, isn't that a security risk?

Re: Why even let users set their own passwords?

#200

Post by hinkley »

londons_explore wrote: post #36
lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

Pulling on this thread a bit, when I get a new set top box, most of the apps have a url or a QR code you can use to copy your session to a new machine. You could just do that for all machines and have no cookies at all. iOS even has some ways to make that a bit easier.

For some apps this would suffice. But for apps we use to live our lives, what do you do when someone has no access to their devices and they need to log in to a fresh device? Some apps will need passwords, or some other mechanism to prove you are who you say you are. But then you can leverage those apps to get back into your other apps in the case of, say, a fire.

Post reply on HN