Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless: a different kind of hell?

jcarlosroldan.com

Post reply on HN
Print view View original

281–290 of 392 posts

Re: Passwordless: a different kind of hell?

#281

Post by zamadatix »

judge2020 wrote: post #272
zamadatix wrote: post #232

Earlier quoted context omitted.

Why should a multi-billion dollar business or a million other projects trust my code simply because GitHub made me 2FA to sign in? I may well decide the next push rewrites half the project in a breaking way on a whim or get an offer for $100k to give control of the project to the bad actor or just decide I don't like big corp anyway and be the bad actor myself. Turning providing source code into promising you'll foll…

I think it's more about GitHub's image and its self-imposed viewpoint that it needs to keep the software landscape secure. Requiring 2fa drastically reduces the number of ways a repo that is a building block for x% of a country's GDP gets compromised - now the only path is if the author intentionally hands over the repo/their account to a bad actor or e.g. posts their 2fa secrets on the internet for anyone to use.

There are also plenty more ways for it get compromised which don't involve the owner handing over anything - say simply accepting a merge which adds a cool feature while still compromising the other users of the project. Github still gets the same marginal image impact risk because ultimately the security of billions of dollars or X% of a country's GDP isn't protected by requiring a hobby developer to 2FA their afternoon code changes. You can't make them interested in protecting your billions via secure account login. Instead it's done by the billion dollar companies or countries themselves because they are the only ones with resources large enough to protect that much asset in a useful way. All this ignoring the same impact can be had by the author simply having a mistake and not fixing it over holiday vacation, no malicious actors required in the first place.

Re: Passwordless: a different kind of hell?

#282

Post by efitz »

a_imho wrote: post #152
michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

Order pizza, pay with virtual card. Payment provider needs 3FA+Captcha, one of the factors is email which is another 2FA challenge. Disclosing the card details once logged in prompts for another 2FA, finally VISA also challenges you with a recent payment question. Insanity.

Captcha IMO is way worse in terms of user experience than 2FA. And the only 2FA that I don't detest are app push and TOTP.

Re: Passwordless: a different kind of hell?

#283

Post by Macha »

felipeccastro wrote: post #66
BoppreH wrote: post #8

I understand the frustration with login systems, but why is the title "Passwordless: A Different Kind of Hell" if it doesn't talk about passwordless authentication, like passkeys, magic links, and biometrics?

I was curious about that as well. Since most services implement an email based Forgot Password feature, and 2FA tokens are also often email based, why isn't magic links the default approach now? Seems to be just as secure as password+2FA but easier to use (and probably to implement, as well). By the title, I thought the article would explore some of the downsides of this approach that I might be missing.

Magic links are not the default as it gives your login process the speed and reliability of email delivery and most login processes are aiming for better than a p95 of about 5 minutes.

Re: Passwordless: a different kind of hell?

#284

Post by at-fates-hands »

BeetleB wrote: post #118
michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

I pretty much never have to do a 2FA with Paypal. And it never redirects me to the bank (credit card). I also don't do this on my phone, but on a regular PC.

>> I also don't do this on my phone, but on a regular PC.

I do the same. Too many times I've had major issues trying to buy stuff on mobile so I just stopped doing it like 8 years ago. Literally the only thing I pay for with my phone is my hockey sessions via Venmo.

Re: Passwordless: a different kind of hell?

#285

Post by jetpks »

nobrains wrote: post #263
EnragedParrot wrote: post #63

Earlier quoted context omitted.

Apple makes this experience as seamless as I think it possibly can be. (As long as you use Safari...). All my passwords synced across all devices all the time, instantly available with faceID or or my fingerprint. Apply pay makes checking out of most online retailers as fast as using my fingerprint or double-clicking the side button on my phone. Passkeys generally starting to replace passwords on many major sites, ma…

Anyone else feels that the double clicking of the side button doesn't feel ergonomic? It doesn't feel right to me when doing it. I end up holding it like a gun, and then double clicking it, as in the default pose of holding a phone, my thumb is unable to double click.

agreed, but i almost feel like it's supposed to feel a little weird to avoid accidentally buying things. either way, if you want to make it easier, there's an option under settings > accessibility > side button. You can adjust the speed required to register a double or triple click.

Re: Passwordless: a different kind of hell?

#286

Post by sigwinch28 »

krupan wrote: post #262

We have all been using physical keys for our homes and cars our whole lives. Physical U2F keys for digital authentication are basically the same level of convenience and actually very very secure: no shared secrets, not copyable, not forgeable, not vulnerable to phishing, etc. I don’t know why we haven’t all jumped on this solution to digital authentication

I can get any proficient locksmith to open my front door with valid photo ID. In a pinch I can get in using a brick, a window, and a good throw. The police might turn up or they might not.

With 2FA, a lot of times I’m going to go through endless technical support, or I will be told it’s simply “not possible” for me to regain access to my accounts.

There’s a third tier here, which is 2FA at work. If I lose a 2FA token I can usually get the IT or security team to let me back into the system because they’re physically present and know who I am.

Re: Passwordless: a different kind of hell?

#287

Post by pc86 »

upon_drumhead wrote: post #270
pc86 wrote: post #80

Earlier quoted context omitted.

And tied to a direct back account, requiring you to use cash and lose any CC benefits. I use Privacy for things I know I only want to charge once (e.g. $1 trials or things of that nature) but not being able to charge a CC with Privacy is a bit blocker most of the time.

Sure, but I don’t get rewards with PayPal, so it’s a non issue? Or you are saying it’s not worth reducing your usage of PayPal unless you get rewards?

I'm saying I get rewards when I use PayPal (because everything ends up on a credit card anyway with added privacy/control benefits compared to using the card directly), so a solution where I don't get those rewards ends up being second-class. I also haven't had issues with PayPal that [many] others have, so there could certainly be a scenario where that changes.

Re: Passwordless: a different kind of hell?

#288

Post by 0xbadcafebee »

fragmede wrote: post #71
0xbadcafebee wrote: post #30

Note that all uses of the password before the computer were not for personal security, but organizational security. If the enemy infiltrated without the use of the password, it could mean the downfall of an empire. Today we use passwords largely for personal security. Yet when companies choose what methods of authentication/authorization they offer, they don't care what the user wants. They pick methods that will mak…

The "standard" is to have someone else deal with it. Login with Auth0/Apple/Facebook/Google/GitHub/Microsoft/GitHub/Twitter/etc is that.

OAuth2/OIDC isn't enough. There's many cases where they're not an option at all; outside of (internet-connected) browser flows, you need more solutions. They add a ton of complexity and are difficult to implement correctly. They don't support other protocols. The implementation of each is specific to the provider ("scopes" is application-specific, etc). You aren't guaranteed to get all the functionality (grant types), assuming all parties have implemented them. And it doesn't provide a standard for MFA, challenges, recovery, secret storage, secure login to the IdP, etc. It really only covers a single use-case. When people do implement that use-case, they often do so improperly, leading to gaping security holes.

So we need more standards. But those standards need to come in three varieties: 1) new standards, 2) simpler designs, 3) guidelines for implementations. There are solutions that exist today, that have no standard. There are "standard" designs today, but they're overcomplicated. And we need better guides on how to implement standards so that users (and developers) have an easier time using the solutions.

Re: Passwordless: a different kind of hell?

#289

Post by sjfjsjdjwvwvc »

wharvle wrote: post #197
sjfjsjdjwvwvc wrote: post #120

Earlier quoted context omitted.

Dominos has the best checkout experience I ever experienced online. Nothing can beat it IMO, at least nothing I came across. Now they only sell (arguable mid) pizza, but when I order there it’s delightful (to use an overused 2023 marketing buzzword)

They do a lot of interrupting the buyer with up-sell attempts. I'd have singled them out as notably bad , among fast food pizza chains, actually.

Interesting, which ones would be notably good in your opinion?

To be fair we don’t have many fast food pizza chains in my country, it’s mostly dominos and a few small ones (with abysmal online order experience)

Re: Passwordless: a different kind of hell?

#290

Post by smitty1e »

SketchySeaBeast wrote: post #64
smitty1e wrote: post #42

Earlier quoted context omitted.

> stays on my device Heh.

OK, so we're at that level of contribution, are we?

I'm just saying that the information staying on the device is aspirational.

I see that this skepticism has offended.

Post reply on HN