Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why even let users set their own passwords?

devever.net

Post reply on HN
Print view View original

341–350 of 392 posts

Re: Why even let users set their own passwords?

#341

Post by technimad »

londons_explore wrote: post #36
lolinder wrote: post #19

> Often this will be combined with fallacious notions such as “remember this device”, the idea being you only have to go through all this the first time when logging in from a particular device. This idea is fallacious because the web has no notion of a “device”, and this is a very intentional design choice made for privacy purposes. We are literally living through the gradual phase-out of third-party cookies, amongs…

I kinda wish there was something like cookies, but even more persistent. Lets call them permacookies. I want to "remember my device", and have that keep me logged in forever with a permacookie. I don't even want to have a username and password. I want to create an account and be forever logged in. There would be mechanisms to backup my permacookies, or transfer them to other devices. I'd have control of which sites c…

Passkeys are what you describe here.

Re: Why even let users set their own passwords?

#343

Post by AmalgatedAmoeba »

kneebonian wrote: post #225
highwaylights wrote: post #114

Earlier quoted context omitted.

This is only true if you’re very selective about which threats you want to acknowledge. If someone breaks into my house I’d rather they just got my TV and some belongings rather than my life savings.

This reminds me of a quote from James Mickens regarding computer security. "Unfortunately, large swaths of the security community are fixated on avant garde horrors such as the fact that, during solar eclipses, pacemakers can be remotely controlled with a garage door opener and a Pringles can. It’s definitely unfor- tunate that Pringles cans are the gateway to an obscure set of Sith-like powers that can be used again…

This is potentially a false equivalency. If storing passwords in a notebook is a common enough pattern, they become something a thief might start looking for. I don’t have the statistics, but would imagine that since “junkies” skew younger as a demographic, a good portion of them is computer literate (or knows someone who would be interested in buying accounts).

Re: Why even let users set their own passwords?

#345

Post by dredmorbius »

KnobbleMcKnees wrote: post #150

The company I work for currently gave me my password, comprised of four space-separated words, on my first day. It has no expiry and can only be changed at request or if compromised. My only gripe with this approach is that my specific password is a bit awkward to type. I tend to pick passwords at least partly based on "keyboard feel" and it's annoying that there's one word that has a lot of repetition of colocated l…

NB, the EFF's "diceware" passphrase generator method recommends six words for effective security: https://www.eff.org/dice>

Note that if your attacker knows the dictionary used, the effective strength of a passphrase isn't based on its string length but on the number of individual words within the phrase.

Six words gives an effective key strength of 2^77 bits.

Re: Why even let users set their own passwords?

#346

Post by fullspectrumdev »

xp84 wrote: post #335
j1elo wrote: post #329

Earlier quoted context omitted.

That might be a very misleading statistic. What if more than 0.2% of people wanted to disable JavaScript, but in the end surrended to the fact that those pesky web devs never test their creations with JS disabled? I know I am one of those who would like to disable JS, but it's just not practical. So stats really are a dangerous tool, they sometimes can end up telling you just what you want to hear...

> people...who would like to disable JS, but it's just not practical As I tell my kid when he "wants" something, I want a pony, and a million dollars. I don't see why the fact that some people might like that matters. I mean, given the choice for free sure I'd "like" it too. But it will never remotely be worth it to build two entirely separate web applications for every website to make that dream a reality, nor do I…

> decades of advancements in FE technologies to go back to script-free HTML.

I don’t think modern webshit which requires downloading megabytes and megabytes of obfuscated code to view someone’s blog is an “advancement” for anyone except the adtech bastards.

Re: Why even let users set their own passwords?

#348

Post by JCharante »

jdthedisciple wrote: post #107
H8crilA wrote: post #76

Earlier quoted context omitted.

I don't understand your point. Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The population there is hardly uneducated, yet they still had quite a few break-ins. Some of the companies have also nearly removed passwords, changing the minimum length requirement to something like 5 lowercase characters. They still experience a near zero, or zero, ph…

Sure, you could even reduce phishing attack success rates to nearly 0% by having users authenticate with a sample of their DNA. Does that mean it's a great idea? What about losing the yubikey? In any case it's a different matter when it comes to high stake scenarios, in which case I don't mind something slightly more sophisticated. But not as the default for everything.

> What about losing the yubikey?

I have 5 yubikeys on multiple continents. If I lose one I can log in with the others and remove login access with the compromised yubikey.

Re: Why even let users set their own passwords?

#349

Post by eviks »

iambateman wrote: post #14

Login PIN by email is a much better pattern along the same lines. Forcing a specific, impossible to remember string on the user is weirdly hostile. If you want to avoid a password, just email the user a PIN every time they need to login. This works great for apps which don’t need high security.

It doesn't work great, with a password I have a single shortcut to autofill from the password manager

With a stupid email login I have to do many more steps (and email isn't 100% reliably immediate)

Re: Why even let users set their own passwords?

#350

Post by eviks »

haunter wrote: post #32

I play a japanese gacha game and there is no password there for your account. If you want to login they send you a code to your email and then you use that (valid for 30 seconds). I'm not a security expert but I always liked that for some reason

Besides other mentioned issues, you can't automate inserting passwords from emails like you can with a password manager
Post reply on HN