Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless: a different kind of hell?

jcarlosroldan.com

Post reply on HN
Print view View original

291–300 of 392 posts

Re: Passwordless: a different kind of hell?

#291

Post by groestl »

kube-system wrote: post #200
g-b-r wrote: post #96

Earlier quoted context omitted.

By the way, the last time I checked using 3ds means that it's "impossible that the transaction was fraudulent" and thus you can't cancel it

Yikes, what happens if you've had your devices/credentials stolen? Are you held liable for the transaction without recourse?

What actually happens is with 3DS: a merchant gets liability shift. Liability resides with the issuer then. Whether you as a customer can be held liable for damages depends on your jurisdiction and when you report your devices / credentials stolen.

Re: Passwordless: a different kind of hell?

#292

Post by tnbp »

ta1243 wrote: post #140
smallpipe wrote: post #139

Earlier quoted context omitted.

With a yubikey everything is stored on the key and the phone is just a terminal, so it travels between phones. Now if you lose the key that's another issue :)

Sure, so same problem. Less likely your yubikey will be stolen I guess, but less convenient too (something else to carry)

But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed.

Also, your Yubikey is probably less likely to be stolen or break, but I figure it's much easier to lose it, which is why you might want to have two, just in case. And that's where it gets really inconvenient.

Re: Passwordless: a different kind of hell?

#293

Post by Vinnl »

ta1243 wrote: post #125
whartung wrote: post #97

Earlier quoted context omitted.

Github 2FA is made extra fun because they only offer a single mechanic of replacing it (that I know of), and that's using the recovery codes. So, they forced me to use 2FA, and I dutifully printed out the recovery codes (don't write down your passwords, that's bad practice, but here's 20 recovery codes that stand between you and losing your account forever, so you know, manage that somehow). When I bought a new iPhon…

TOTP backups from phones is a major issue, from what I can tell you simply can't do it.

Oh huh, I switched from AndOTP to Aegis and was able to export from the former and import into the latter. Then on desktop I'm using Authenticator [0], which can import from both.

[0] https://flathub.org/apps/com.belmoussaoui.Authenticator

Re: Passwordless: a different kind of hell?

#294

Post by szundi »

wharvle wrote: post #124
EnragedParrot wrote: post #63

Earlier quoted context omitted.

Apple makes this experience as seamless as I think it possibly can be. (As long as you use Safari...). All my passwords synced across all devices all the time, instantly available with faceID or or my fingerprint. Apply pay makes checking out of most online retailers as fast as using my fingerprint or double-clicking the side button on my phone. Passkeys generally starting to replace passwords on many major sites, ma…

That whole process in the top level comment is much faster, in practice, on my phone. Everything auto-fills (unless a site manages to fuck up their forms). I don’t typically have to type or manually copy anything, including 2fa tokens. Wait for the notification to ping, “fill from message” option, done. I can often go through an entire sign-up, entering shipping, and payment, at a new site, without typing a single th…

This is slower than Apple Pay on the iPhone, I can assure you.

Re: Passwordless: a different kind of hell?

#295

Post by orthoxerox »

michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

> Clearly, the days when businesses thought online shopping ought to be low-friction are long gone.

I bought some lottery tickets online for a present to myself and the experience was smooooth. No cart, no checkout steps, no need to create an account, there was a QR code right next to the tickets that I had to scan with my banking app to buy them right here, right now.

Re: Passwordless: a different kind of hell?

#296

Post by mavhc »

happyopossum wrote: post #147
mavhc wrote: post #133

I can't login to a website from my desktop any more because I enabled passkeys, and my desktop doesn't have bluetooth to talk to my phone. Nor does anyone say what version of bluetooth is required

Why would you use a passkey manager that required a phone and BT? that's nuts.. 1password and Safari both handle syncing passkeys between all your devices - no device swapping needed.

It's the default.

Isn't putting your private keys on the internet the thing we're trying to avoid?

Re: Passwordless: a different kind of hell?

#297

Post by dustincoates »

lolinder wrote: post #185
Karellen wrote: post #40

> Gileadite soldiers used the word "shibboleth" to detect their enemies, the Ephraimites. The Ephraimites spoke in a different dialect so that they would say "sibboleth" instead. Experience : you just had to say a word. Security : there's a single word to authenticate multiple users and it can be cracked by learning how to spell it. Although that's roughly how the Wikipedia entry[0] summarises it, the actual wording…

> so an Ephraimites soldier was literally incapable of pronouncing the word "correctly". And, importantly, they would not even have realized that they were saying it wrong, because they would have been unable to hear the difference. As a modern example: I have an acquaintance from Tonga. At some point she got very frustrated with the people around her who didn't understand what she meant by the "rittel bin". She fina…

I learned French as an adult, and I cannot at all hear the difference between the words "rue" and "roue." People tell me there's a difference and they try to sound it out to me, but each time they do, I just have to trust that they aren't saying the same thing twice.

Re: Passwordless: a different kind of hell?

#298

Post by kevincox »

krupan wrote: post #262

We have all been using physical keys for our homes and cars our whole lives. Physical U2F keys for digital authentication are basically the same level of convenience and actually very very secure: no shared secrets, not copyable, not forgeable, not vulnerable to phishing, etc. I don’t know why we haven’t all jumped on this solution to digital authentication

I have like 2 or 3 physical keys. I have accounts on hundreds of websites. Sure, you can use the same key on every website but you better not lose it. So now you need to register multiple keys on every website. Also if you lose one you need to go back to every single site and add your replacement. (I hope you remember every site you have signed into.)

So "not copyable" is actually a huge downside for convenience. Such a downside that even though I have a collection of U2F keys I only use them in a handful of accounts. The maintenance cost is just far too high.

To resolve this you would probably need something like cross-signing. So I can say "I know that you only trust key A, but I lost it a few years ago. However I have an attestation from key A saying that key B is mine as well. Here is a signature from key B". However this is effectively equivalent to copying keys. So it basically defeats that point.

Re: Passwordless: a different kind of hell?

#299

Post by abdullahkhalids »

krupan wrote: post #262

We have all been using physical keys for our homes and cars our whole lives. Physical U2F keys for digital authentication are basically the same level of convenience and actually very very secure: no shared secrets, not copyable, not forgeable, not vulnerable to phishing, etc. I don’t know why we haven’t all jumped on this solution to digital authentication

Well for one, security keys have arbitrary limits. The latest yubikey can store up to 25 FIDO2 credentials for password-free logins, two OTP credentials, 32 OATH credentials for one-time passwords (when paired with the Yubico Authenticator), and an unlimited number of U2F credentials [1].

[1] https://support.yubico.com/hc/en-us/articles/360016649339-Yu...

Re: Passwordless: a different kind of hell?

#300

Post by pjkundert »

orthecreedence wrote: post #202
pjkundert wrote: post #16

I have 743 login credentials (1984-present). Trusting 743 “randos on the internet” to safeguard “my” data, and give me access to use it. Insanity. Agent-Centric systems where I retain signing keys to authorize access to (and transactions using my) data are the way forward. A Key Fob (like you have for your car) is not onerous, and methods for recovery using trusted community members is practical. Holochain (and the H…

My main issue with Holochain and agent-based systems is that I am the agent, but the system is built around my singular device being the agent. Now the work on linking my devices and convincing other "agents" in the system that these collections of keys represents "me" is forced back onto me. In other words, agent-device-based identity is a crappy experience for some mixture of end-users and/or devs. Either the user…

Yes, you'll have many machine Agents that are grouped under your personal agency.

In Holochain, a standard service named "DeepKey" (https://github.com/holochain/deepkey, still under development) is tasked with managing groups of "Agent" keys.

On creation of a new Holochain Agent (associated with some Holochain application or piece of hardware), you'll associate it with your Deepkey keyset. Later, you can discard (or recover agency over a lost private key for) an Agent ID.

But at no time should "randos on the internet" be responsible for the agency of your data. That's just crazy -- no matter how "easy" they make it, they simply don't care (evidence would suggest) as much as I do about my data.

Post reply on HN