Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why even let users set their own passwords?

devever.net

Post reply on HN
Print view View original

251–260 of 392 posts

Re: Why even let users set their own passwords?

#251

Post by simfree »

guraf wrote: post #155
londons_explore wrote: post #147

Earlier quoted context omitted.

Only 8 years late: https://developer.chrome.com/blog/push-notifications-on-the-... Besides - there are plenty of other things Apple can do to ensure PWA's don't take off. For example, there is no ability for a web-app to have a "click here to install to desktop" button - the website must try to guide the user into clicking the share button and then creating a desktop icon - which most users don't associate with 'inst…

Fascinating how to keep moving the goalposts. Firefox refuses to implement pwa. Chrome has pwas but they're not isolated. Apple is the only one with sane pwa but somehow they're the worst and are totally sabotaging PWAs because something something walled garden?

Firefox Android certainly supports Progressive Web Apps with push notifications, I use them daily.

Re: Why even let users set their own passwords?

#252

Post by littlestymaar »

lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

The author is Hugo Landau, so of course it is a bad take, how else could it be. The real question at this point is why his terrible takes reach the front page every two weeks…

Re: Why even let users set their own passwords?

#253

Post by hkt »

xcxcx wrote: post #206
hkt wrote: post #119

Earlier quoted context omitted.

It is incredibly useful to powerful people to keep at this generational war narrative, as it keeps people who might otherwise work together from doing so with an aim of crushing the power of the wealthy. The fact is, anti-human attitudes to both housing and technology are harmful everywhere. Nobody has to "win" at the other side's expense here.

Some games are zero sum and some aren't. Everyone is more secure if a large bank replaces 2FA over unencrypted SMS, even though some may be inconvenienced. Leveling down on everyone's security in exchange for usability for a segment of the population is not a realistic long-term strategy.

As opposed to encrypted SMS? I'm genuinely intrigued at the idea that's a thing.

As for the rest, is there any actual evidence of widespread interception of SMS 2fa actually being a problem?

Re: Why even let users set their own passwords?

#254

Post by hkt »

SoftTalker wrote: post #127
sublinear wrote: post #110

Earlier quoted context omitted.

> What you're looking for is client certificates. I agree with this, but... > users are too stupid to use them they are. Key management is not trivial.

Yes, if you've ever managed a shared unix system that uses ssh keys for login, you know that a large fraction of users cannot manage them. Among the steps of generating a key pair, getting the public key (not the private one) into their authorized_keys file (which is in a hidden directory, for pete's sake) without introducing any extra characters or line breaks or getting the wrong permissions on the file, getting th…

It seems a little bit uncharitable to assume the UX on client certs has to be as bad as the UX on SSH keys, although I'll concede the point that historically it has been.

Re: Why even let users set their own passwords?

#255

Post by Groxx »

ClumsyPilot wrote: post #247
highwaylights wrote: post #114

Earlier quoted context omitted.

This is only true if you’re very selective about which threats you want to acknowledge. If someone breaks into my house I’d rather they just got my TV and some belongings rather than my life savings.

> If someone breaks into my house I’d rather they just got my TV and some belongings rather than my life savings I think this is very unlikely. For one, the notebook does not contain all the information - say "Bank1 Password" - which bank is that? What's the username? What about 2FA? Secondly, surely the whole point if a safe is that it's bolted down and hard to burgle / steal?

fwiw I haven't ever been in a house with a bolted-down safe, nor am I aware of anyone I know ever having one.

they exist but uh. most people just have portable fire-safe boxes as far as I've seen. or nothing.

Re: Why even let users set their own passwords?

#256

Post by mike_hock »

jdthedisciple wrote: post #63

I've said it before and I'll say it again (and yes let it rain downvotes): I don't understand this whole discussion and maligning of passwords. You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user onc…

Based.

It's trivially easy to generate passwords with 128 bits of entropy and have them managed by a password manager.

Until the password manager gets hacked. Well, tough shit. If your primary device gets hacked, the hacker just has to wait until the next time you log in with the bullshit gazillion factor authentication.

And it always collapses to 1FA for the lost password recovery process, which you're gonna have to provide if you want customers.

Re: Why even let users set their own passwords?

#258

Post by anderspitman »

tomjen3 wrote: post #186
anderspitman wrote: post #148

Earlier quoted context omitted.

Other than the chance the email is delayed, and the generally subpar UX, what are your concerns with emailed codes? This is an honest question, as this is the primary login method I settled on for all my services after spending a good chunk of time thinking about this.

For one thing, I now have to be logged in on my mail on the device I am using, and that means if the device is unsafe, I am exposing far more of a risk that way. It also forces me to look at my email inbox, which can be a pretty annoying thing if I am trying to relax and now see some email with bad news - requireing me to break the flow again. Most important however: it is simply wrong and not needed. The flow has be…

> For one thing, I now have to be logged in on my mail on the device I am using, and that means if the device is unsafe, I am exposing far more of a risk that way

What's preventing you from getting the email code from another device?

Re: Why even let users set their own passwords?

#259

Post by alistairSH »

simonw wrote: post #44
londons_explore wrote: post #36

Earlier quoted context omitted.

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

Honestly that feels like what apps are. One of the most compelling reasons to install an iOS app for something like an online bank is so that I won't have to worry about my cookies expiring and forcing me to login again.

You don’t force login on your banking apps? Eek. Or maybe you mean they do biometric auth instead of user/pwd? Leaving banking/finance apps unprotected sounds sketchy AF to me.

Re: Why even let users set their own passwords?

#260

Post by tagamma »

ghusto wrote: post #234
seabass-labrax wrote: post #85

Earlier quoted context omitted.

Indeed, but you still need a Personal Access Token to integrate pull requests and issues with your Git client. GitHub doesn't support SSH authentication in those cases.

By git client, do you mean something other than git? Something like a CI system? Even there you can use an SSH key?

I think they mean a desktop GUI application on top of git like GitKraken or SourceTree. These sometimes allow you to perform actions like creating a PR (which is not done via git itself, of course).
Post reply on HN