Why even let users set their own passwords? • Hacker News Board

Re: Why even let users set their own passwords?

#211

Post by ozim » Sat, Jul 22, 2023, 6:04 PM UTC

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

Author is wrong in many ways.

All post reads like Dunning-Kruger case, he seems to know quite some stuff but also misses 3rd party cookies. Overly focuses on weak passwords completely skipping password leaks or just mentioning password reuse.

Ignoring that TOTP is actually decent interface for getting non technical and not caring at all users use random high entropy secrets. Getting regular people to keep some generated random strings won’t work.

In the end ignoring all experience of industry which is:

leaked passwords and email lists can be used in password spraying attacks where specific user is not targeted it is just opportunistic low hanging fruit automated exploitation.

Then those easy exploitable accounts in services can be used to ask connected users for loans or financial help as a scam.

Re: Why even let users set their own passwords?

#212

Post by akira2501 » Sat, Jul 22, 2023, 6:05 PM UTC

seabass-labrax wrote: post #134

jdthedisciple wrote: post #63

I've said it before and I'll say it again (and yes let it rain downvotes): I don't understand this whole discussion and maligning of passwords. You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user onc…

You cannot save all people - too true. But remember that you, actually all of us, are indirectly the victim of other peoples' mistakes: - we lose contact with people because they get locked out of their email - we pay more in bank account fees to subsidise fraud compensation - we have our personal information stolen because others chose weak passwords Given how much we suffer from other peoples' poor choices, there i…

> - we lose contact with people because they get locked out of their email

This is a temporary condition, and they can create another email or communicate via other means. If some part of your life is highly dependent on a single email address remaining 100% available, you've made a mistake already.

> - we pay more in bank account fees to subsidise fraud compensation

I have a feeling that if you got rid of passwords, new forms of fraud would become prevalent, and the fees would remain. Humans are humans, taking away the password does not insulate them from their own basic nature.

> - we have our personal information stolen because others chose weak passwords

It's the same issue as above. Your information has value, so it will be sought out by people who wish to exploit it. Social engineering exists and won't go away just because we got rid of a single token based mechanism.

> Given how much we suffer from other peoples' poor choices,

It's a poor choice to be dependent on email or to give your personal information away to every single form that asks for it. You can balk at the external factors if you like, but you won't solve anything by it.

Re: Why even let users set their own passwords?

#213

Post by hinkley » Sat, Jul 22, 2023, 6:06 PM UTC

sublinear wrote: post #110

hkt wrote: post #91

Earlier quoted context omitted.

What you're looking for is client certificates. This has existed for years but webby people think users are too stupid to use them, so we get the menagerie of half baked trash we have now instead.

> What you're looking for is client certificates. I agree with this, but... > users are too stupid to use them they are. Key management is not trivial.

When I worked on a code signing app, I had front row seats to how magical everyone thinks certificates are. It took me several years to convince the group that they aren't that complicated.

I think the world would be a better place if LetsEncrypt had come into being about five years earlier.

Re: Why even let users set their own passwords?

#214

Post by jsunderland323 » Sat, Jul 22, 2023, 6:07 PM UTC

romwell wrote: post #167

seabass-labrax wrote: post #134

Earlier quoted context omitted.

You cannot save all people - too true. But remember that you, actually all of us, are indirectly the victim of other peoples' mistakes: - we lose contact with people because they get locked out of their email - we pay more in bank account fees to subsidise fraud compensation - we have our personal information stolen because others chose weak passwords Given how much we suffer from other peoples' poor choices, there i…

>- we lose contact with people because they get locked out of their email I've been locked out of my email because Google insists that "we don't recognize your device", and locked out of my other accounts because my phone was stolen , not because I didn't remember my password. People forgetting passwords isn't a problem that's solved with other schemes. It's a problem that's exacerbated by them. >- we pay more in ban…

Re: bank account fees. I think OC was just making the point that one institutions’ lack of security practices gets passed to the entire system as a way to offset fraud costs, we all universally eat this stupid cost.

An example of this is chargeback fraud on marketplaces. The way the fraud works is someone buys a bunch of credit card numbers off of the dark web due to some websites’ bad security practices and a data breach. The fraudster then ATOs a merchant account on some marketplace platform or makes a fake account, e.g. Doordash, Airbnb, Shopify, etc. The ATO is usually possible because some subset of the merchants of the platform use the same passwords on another website that has been compromised, again, some data set is sold on the deep web. The fraudster then either has to change the payout method of the marketplace merchant account, which they can usually do by ATOing an acquiring bank that they can access the funds in some way, again due to another external institution with tenuous security practices.

Finally the fraudster charges all the stolen credit cards and in most cases leaves the platform taking the liability. This results in the platform pushing up take rates against their merchant accounts, which almost always gets passed back to the consumers of the service (us) by increasing the prices of the service.

The problem with passwords is that we expose ourselves to everyone else’s negligence. You might handle passwords with all the best security practices to be known but you expose yourself and your users to every other system’s incompetence. It wasn’t until I saw this play out, that I understood passwords aren’t just a disservice to the negligent compromised user but really to the whole ecosystem of the internet that partakes in password authentication.

Yes, there is always a trade off in security and friction. This has always been true. But if we know passwords are faulty and essentially useless, why continue with such a bad practice? To reduce friction to a maximal extent? By that logic we might as well throw out the concept of security altogether. Why not just make it so a user only has to enter their email/username and nothing else? Let me know how that goes for you. I think webauthn is likely the sustainable, long term solution but we’ve got a ways to go before some of the inane thinking around password preservation dies out.

Re: Why even let users set their own passwords?

#215

Post by londons_explore » Sat, Jul 22, 2023, 6:08 PM UTC

andai wrote: post #188

londons_explore wrote: post #147

Earlier quoted context omitted.

Only 8 years late: https://developer.chrome.com/blog/push-notifications-on-the-... Besides - there are plenty of other things Apple can do to ensure PWA's don't take off. For example, there is no ability for a web-app to have a "click here to install to desktop" button - the website must try to guide the user into clicking the share button and then creating a desktop icon - which most users don't associate with 'inst…

>50 MB excludes most messaging apps The entirety of TempleOS (including dozens of programs and multimedia games) is 2MB.

This isn't just the limit for css/js... It's the limit for user data too. Ie. if you share some videos with a PWA app, then all the videos have to fit inside 50MB unless you want to fetch them from a server each time you play them.

Or consider a PWA music player - 50MB of music is all you can play offline.

Or a photo editor - 50MB is the limit for all your saved files unless you want to save them to a cloud server.

Re: Why even let users set their own passwords?

#216

Post by akira2501 » Sat, Jul 22, 2023, 6:08 PM UTC

H8crilA wrote: post #76

jdthedisciple wrote: post #63

I've said it before and I'll say it again (and yes let it rain downvotes): I don't understand this whole discussion and maligning of passwords. You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user onc…

I don't understand your point. Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The population there is hardly uneducated, yet they still had quite a few break-ins. Some of the companies have also nearly removed passwords, changing the minimum length requirement to something like 5 lowercase characters. They still experience a near zero, or zero, ph…

> Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys?

The actual question is: "Did they see an INCREASE in other types of attacks after using yubikeys?"

To presume that these actors who were willing to go to some illegal lengths to get this information in the first place just "gave up" because "yubikeys exist" is a dangerous way to process these facts.

Re: Why even let users set their own passwords?

#217

Post by waynesonfire » Sat, Jul 22, 2023, 6:08 PM UTC

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I dont agree with you that it's the user's fault. The issue isn't understanding of remember this device feature. The issue is it's a fundamentally broken design. One, because users have multiple devices and second, the feature is crippled when employing privacy preserving behavior.

I should be able to authenticate by proving access to a device such as a yubikey, as an example. Now, the site can properly remember the user. This missing feature is the fault of crummy UX, not the user.

Re: Why even let users set their own passwords?

#218

Post by cushpush » Sat, Jul 22, 2023, 6:09 PM UTC

Password replacements are like septic systems, everyone needs one and nobody wants to do the work.

Re: Why even let users set their own passwords?

#219

Post by novok » Sat, Jul 22, 2023, 6:11 PM UTC

jdthedisciple wrote: post #63

I've said it before and I'll say it again (and yes let it rain downvotes): I don't understand this whole discussion and maligning of passwords. You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user onc…

It costs the company in support costs to deal with lockouts, and the newbie does want their cake and to eat it to, thus the entire push to passkeys.

Re: Why even let users set their own passwords?

#220

Post by hinkley » Sat, Jul 22, 2023, 6:13 PM UTC

akira2501 wrote: post #212

seabass-labrax wrote: post #134

Earlier quoted context omitted.

You cannot save all people - too true. But remember that you, actually all of us, are indirectly the victim of other peoples' mistakes: - we lose contact with people because they get locked out of their email - we pay more in bank account fees to subsidise fraud compensation - we have our personal information stolen because others chose weak passwords Given how much we suffer from other peoples' poor choices, there i…

> - we lose contact with people because they get locked out of their email This is a temporary condition, and they can create another email or communicate via other means. If some part of your life is highly dependent on a single email address remaining 100% available, you've made a mistake already. > - we pay more in bank account fees to subsidise fraud compensation I have a feeling that if you got rid of passwords,…

I think they're talking about social interactions leading to exchange of personal information, and so a private person is still known by the ripples they leave in their social circles.

For instance if grandma wishes me happy birthday, and she gets hacked, now they know my birthday. Grandma also probably gave away my mother's maiden name as well.