Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless: a different kind of hell?

jcarlosroldan.com

Post reply on HN
Print view View original

121–130 of 392 posts

Re: Passwordless: a different kind of hell?

#121

Post by PurpleRamen »

Al-Khwarizmi wrote: post #13

We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle.…

> Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects?

Because your hobby-project can emerge to be the backbone of someone's multibillion dollar-business, or a small gear in a million other projects, and you will get targeted for a supply-chain-attack.

Re: Passwordless: a different kind of hell?

#122

Post by ComputerGuru »

selimthegrim wrote: post #59
Karellen wrote: post #40

> Gileadite soldiers used the word "shibboleth" to detect their enemies, the Ephraimites. The Ephraimites spoke in a different dialect so that they would say "sibboleth" instead. Experience : you just had to say a word. Security : there's a single word to authenticate multiple users and it can be cracked by learning how to spell it. Although that's roughly how the Wikipedia entry[0] summarises it, the actual wording…

Case in point - Hebrew lost “Ghayin” way back in history so the Hebrew for Gaza is “’Aza” (with ‘Ayin)

Hebrew also lost the voiceless pharyngeal fricative (Heth/ح) which iirc can only be pronounced by Mizrahi Jews (aka of Jewish Arab origin). It was merged into the voiceless uvular fricative כ khaf (خ in Arabic). Though as I understand it, interestingly the letters themselves are still found in Hebrew with distinct glyphs (ח vs כ) but one has just lost its unique pronunciation.

Re: Passwordless: a different kind of hell?

#123

Post by BeetleB »

My work just replaced our VPN app (which required a password) with something that they excitedly promised would provide us "passwordless login!"

Lo and behold, it uses 2FA. Periodically I have to go get my phone[1] just to do my work. Way more friction than typing in the password.

[1] No, I don't keep my phone on me all the time. It usually just sits in some random room at home.

Re: Passwordless: a different kind of hell?

#124

Post by wharvle »

EnragedParrot wrote: post #63
michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

Apple makes this experience as seamless as I think it possibly can be. (As long as you use Safari...). All my passwords synced across all devices all the time, instantly available with faceID or or my fingerprint. Apply pay makes checking out of most online retailers as fast as using my fingerprint or double-clicking the side button on my phone. Passkeys generally starting to replace passwords on many major sites, ma…

That whole process in the top level comment is much faster, in practice, on my phone. Everything auto-fills (unless a site manages to fuck up their forms). I don’t typically have to type or manually copy anything, including 2fa tokens. Wait for the notification to ping, “fill from message” option, done.

I can often go through an entire sign-up, entering shipping, and payment, at a new site, without typing a single thing.

Re: Passwordless: a different kind of hell?

#125

Post by ta1243 »

whartung wrote: post #97
Al-Khwarizmi wrote: post #13

We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle.…

Github 2FA is made extra fun because they only offer a single mechanic of replacing it (that I know of), and that's using the recovery codes. So, they forced me to use 2FA, and I dutifully printed out the recovery codes (don't write down your passwords, that's bad practice, but here's 20 recovery codes that stand between you and losing your account forever, so you know, manage that somehow). When I bought a new iPhon…

TOTP backups from phones is a major issue, from what I can tell you simply can't do it.

Re: Passwordless: a different kind of hell?

#127

Post by arwineap »

BeetleB wrote: post #123

My work just replaced our VPN app (which required a password) with something that they excitedly promised would provide us "passwordless login!" Lo and behold, it uses 2FA. Periodically I have to go get my phone[1] just to do my work. Way more friction than typing in the password. [1] No, I don't keep my phone on me all the time. It usually just sits in some random room at home.

They are managing their liabilities, as is standard industry practice. I'm surprised your workplace did not have 2fa until now

Re: Passwordless: a different kind of hell?

#128

Post by graemep »

michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

There are things you can do to make it easier. My phone sends all notifications to my desktop, and I have an app on the phone that creates a notification when it recognises a code in the SMS, so all I need do is double click on the notification (to select the entire "word" that is the code) then paste into the site I am verifying to.

There are also authenticator browser extensions so you do not have to use a phone app for those either.

The software I use for the SMS codes is KDE Connect and SMS code.

Re: Passwordless: a different kind of hell?

#129

Post by BeetleB »

arwineap wrote: post #127
BeetleB wrote: post #123

My work just replaced our VPN app (which required a password) with something that they excitedly promised would provide us "passwordless login!" Lo and behold, it uses 2FA. Periodically I have to go get my phone[1] just to do my work. Way more friction than typing in the password. [1] No, I don't keep my phone on me all the time. It usually just sits in some random room at home.

They are managing their liabilities, as is standard industry practice. I'm surprised your workplace did not have 2fa until now

Not arguing that 2FA isn't more secure. But don't promise a smoother driving experience by removing speed bumps and replacing them with stop signs.

Re: Passwordless: a different kind of hell?

#130

Post by Symbiote »

BeetleB wrote: post #118
michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

I pretty much never have to do a 2FA with Paypal. And it never redirects me to the bank (credit card). I also don't do this on my phone, but on a regular PC.

I believe the redirect to the bank's website is an EU and UK regulation, "Strong Customer Authentication":

https://www.theguardian.com/money/2022/mar/14/uk-shoppers-fa...

https://www.visa.co.uk/pay-with-visa/changes-in-payment-secu...

I don't know the details of when it is and isn't required. I am asked pretty much all the time for transactions using my Danish cards, and only some of the time for the British cards.

Post reply on HN