Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless: a different kind of hell?

jcarlosroldan.com

Post reply on HN
Print view View original

301–310 of 392 posts

Re: Passwordless: a different kind of hell?

#301

Post by kevincox »

gregmac wrote: post #271
filleokus wrote: post #4

I think the industry, to some extent, already have reconsidered the session length, see [0] by Auth0 for example (even if it's obv. a PR piece). Nowadays my gut assumption when I use a service with really short sessions is that their security practices are probably questionable. I recently argued, as the cybersecurity guy™, with a vendor that we can't ask regular users to reauthenticate every 15 minutes. They insiste…

The thing that I find super frustrating about these short sessions is the lack of risk it's mitigating. If it's expiring in a few minutes, presumably you're trying to protect against two things: (1) Session hijacking and (2) Unlocked computer. Session hijacking is somewhat preventable via other means (eg: IP address tracking), but more importantly, in what case can a session be hijacked only 15 minutes later? Someone…

For very short sessions that is likely true. But I think there is a middle ground where devices are lost or stolen, or data is accidentally leaked. If it is a sophisticated targeted attack you have already lost. But maybe someone just threw out an old PC that they haven't used in years and the disk isn't encrypted.

For my service I ended up doing something in between. Sessions last for 14 days, but they are automatically renewed indefinitely. So as long as you access the service every 14 days your session will never expire. This way lost or leaked credentials aren't a risk forever. But in most cases users rarely if ever need to log in again. I may play with the exact timeframes, or maybe significantly extend the validity if the user is logged in via the same IP or similar heuristics. But I like that after some definite period old creds are no longer live.

Re: Passwordless: a different kind of hell?

#302

Post by qhwudbebd »

Al-Khwarizmi wrote: post #13

We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle.…

I spent a little time trying to decide whether GitHub's 2fa was genuinely an extra factor whose compromise (with an uncompromised password) wouldn't weaken security vs a situation where it hadn't been set up at all.

In that case, presumably I could embed the totp key in a bookmarklet in the conveniently-sized 'public bio' field on my profile so I can complete it on whatever device I happen to be using, and effectively opt out?

But I'm really not convinced they aren't fuckwits and wouldn't treat the 'second factor' as an authoritative single factor in some circumstances (e.g. password reset) which wouldn't be unauthenticated if 2fa wasn't set up.

I'm also not convinced one can even contact anyone at GitHub clueful enough to answer that question authoritatively nowadays rather than reading off a script.

Re: Passwordless: a different kind of hell?

#303

Post by pjkundert »

justanorherhack wrote: post #219
pjkundert wrote: post #16

I have 743 login credentials (1984-present). Trusting 743 “randos on the internet” to safeguard “my” data, and give me access to use it. Insanity. Agent-Centric systems where I retain signing keys to authorize access to (and transactions using my) data are the way forward. A Key Fob (like you have for your car) is not onerous, and methods for recovery using trusted community members is practical. Holochain (and the H…

Key fob and the recovery method works for vehicles because it also requires physical access and knowing where that specific car is. It’s very easy for somebody to steal a specific car, even high end luxury car without after market mods if they can get to it. This doesn’t work for the internet because anyone can access the target from anywhere. We already do this to a degree with trusted CA centralization and there ar…

In some of the Holochain prototypes I've built, certain state changes are more critical than others.

For some, you might allow "what you know" security (ie. the agent knows your private key).

For other, you might demand "what you know + what you have" security (ie. the agent knows your private key and has provable access to your device). I used various proof of knowledge constructs, such as the ability to read "Private" Holochain entry data (that only exist on-device, and not in the DHT), and demonstrate this by providing the hash or PKI signature of the private data (which is published to the DHT, in an entry provably before the private data being proven was written). There are other ways.

For yet others, you might want that, plus "who you know" security, in which case we do all of the above, and ask some previously defined Agents to also sign the transaction before it is allowed to be written to the Agent's source-chain.

So, the requirement for logical, physical or relational levels of security are available to Holochain / Holo hApps. This is higher security than is available for physical devices like cars, and is even better than provided by devices like Apple iPhone and Watch -- because you retain control over releasing the lock (if you forget your password and lose access to your email address, your Apple device is locked, forever).

Re: Passwordless: a different kind of hell?

#304

Post by Jiro »

anigbrowl wrote: post #267
Jiro wrote: post #177

Earlier quoted context omitted.

>if you're caught with drugs, we slap you with a felony that ensures you can't get a real job... pushing you right back to drugs. I could say the same thing for any sort of crime. If you're an accountant, and you get put in jail for embezzling, that conviction is going to prevent you from getting another job as an accountant. While there have been a few controversies about jobs that the law excludes felons from, in a…

What a weird comparison. Embezzling is abusing a position of trust to become a thief. Who was abused if someone privately consumed drugs?

If you believe that privately consuming drugs doesn't reflect negatively on someone, you can hire them. If you don't hire them and nobody else hires them either, the drug use is keeping them from being hired. It's misleading to claim that the conviction keeps them from being hired rather than the drug use.

Re: Passwordless: a different kind of hell?

#305

Post by I_complete_me »

anigbrowl wrote: post #261
Karellen wrote: post #40

> Gileadite soldiers used the word "shibboleth" to detect their enemies, the Ephraimites. The Ephraimites spoke in a different dialect so that they would say "sibboleth" instead. Experience : you just had to say a word. Security : there's a single word to authenticate multiple users and it can be cracked by learning how to spell it. Although that's roughly how the Wikipedia entry[0] summarises it, the actual wording…

Dutch people still jokingly invite newbies in the country to pronounce the name of the town 'Scheveningen'; this is kind of hard for native English speakers and very difficult for native German speakers, so it was used as a filter by the Dutch resistance during WW2.

Scheveningen - huh?

I recently read Robert Harris's book V2 based on this town. Good book.

Also, there is a chess opening variation named after this place. (see https://en.wikipedia.org/wiki/Sicilian_Defence,_Scheveningen... )

And it has held great chess tournaments in the past.

Plus the Scheveningen system is a method of organizing a chess match between two teams.

For a fairly obscure location, it certainly got on the map, so to speak.

Re: Passwordless: a different kind of hell?

#306

Post by perlgeek »

lolinder wrote: post #185
Karellen wrote: post #40

> Gileadite soldiers used the word "shibboleth" to detect their enemies, the Ephraimites. The Ephraimites spoke in a different dialect so that they would say "sibboleth" instead. Experience : you just had to say a word. Security : there's a single word to authenticate multiple users and it can be cracked by learning how to spell it. Although that's roughly how the Wikipedia entry[0] summarises it, the actual wording…

> so an Ephraimites soldier was literally incapable of pronouncing the word "correctly". And, importantly, they would not even have realized that they were saying it wrong, because they would have been unable to hear the difference. As a modern example: I have an acquaintance from Tonga. At some point she got very frustrated with the people around her who didn't understand what she meant by the "rittel bin". She fina…

Another famous example of l and r confusion is Japanese.

One I'm struggling with: Norwegian (bokmal at least) has the "y", which is between i and the German ü. I can kinda hear the difference, if I pay close attention and the speaker is deliberate about the pronounciation, but saying it is kinda hard, and I get it wrong most of the time.

Re: Passwordless: a different kind of hell?

#307

Post by MDWolinski »

efitz wrote: post #275
dgellow wrote: post #203

Earlier quoted context omitted.

How does that work if you want to get an android phone or Samsung tablet or windows laptop at some point?

I love the Apple ecosystem, however I always have a low level of dread that someday I will somehow offend them and be permanently blacklisted. This is the main reason I've drawn the line at using their password manager or email - I use separate email and separate password manager so that in a worst case situation I don't get locked out of everything .

Not to be argumentative, just wondering, has there been a case related to iCloud access that Apple has ever blacklisted someone? Certainly, I've heard of Meta and other companies doing not, but don't recall Apple outside of security confirmation issues people are having.

Re: Passwordless: a different kind of hell?

#308

Post by qhwudbebd »

samcat116 wrote: post #206
whartung wrote: post #97

Earlier quoted context omitted.

Github 2FA is made extra fun because they only offer a single mechanic of replacing it (that I know of), and that's using the recovery codes. So, they forced me to use 2FA, and I dutifully printed out the recovery codes (don't write down your passwords, that's bad practice, but here's 20 recovery codes that stand between you and losing your account forever, so you know, manage that somehow). When I bought a new iPhon…

there are other methods for 2fa recovery. The main one involves an SSH key you've previously added to your account.

Using said ssh key as one of the 2fa choices for standard login would be quite a nice feature too...

Re: Passwordless: a different kind of hell?

#309

Post by sage92 »

hcurtiss wrote: post #145
wharvle wrote: post #124

Earlier quoted context omitted.

That whole process in the top level comment is much faster, in practice, on my phone. Everything auto-fills (unless a site manages to fuck up their forms). I don’t typically have to type or manually copy anything, including 2fa tokens. Wait for the notification to ping, “fill from message” option, done. I can often go through an entire sign-up, entering shipping, and payment, at a new site, without typing a single th…

How are you populating non-SMS 2FA codes automatically?

If you use BitWarden paid version ($10/yr) then after an autofill of username/password, the totp is automatically added to the clipboard.

Re: Passwordless: a different kind of hell?

#310

Post by venatiodecorus »

nicholasjarnold wrote: post #112
wmsmith wrote: post #105

Earlier quoted context omitted.

Payment gateways (paypal, apple, google), in general, do NOT let you cancel individual services and are linked to your CC. Vendors (I'm looking at you, Audible!) constantly hide their account termination under layers of dark patterns. For awhile, I had several ghost subscriptions that I a.) didn't want and b.) couldn't cancel. My credit card card [1] has fundamentally changed my online purchasing experience as it bri…

I've been using Privacy.com for this "create single use credit card" for years now. They make money via the interchange fees, afaik, and not by selling your data stream.

Just seconding Privacy.com, I use them for all my online payments and it is a super easy workflow.
Post reply on HN