Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless: a different kind of hell?

jcarlosroldan.com

Post reply on HN
Print view View original

321–330 of 392 posts

Re: Passwordless: a different kind of hell?

#321

Post by joquarky »

filleokus wrote: post #4

I think the industry, to some extent, already have reconsidered the session length, see [0] by Auth0 for example (even if it's obv. a PR piece). Nowadays my gut assumption when I use a service with really short sessions is that their security practices are probably questionable. I recently argued, as the cybersecurity guy™, with a vendor that we can't ask regular users to reauthenticate every 15 minutes. They insiste…

NIST recommends creating separate "Authenticator Assurance Levels" to balance security with UX:

https://pages.nist.gov/800-63-3-Implementation-Resources/63B...

Re: Passwordless: a different kind of hell?

#322

Post by walteweiss »

I have an iPhone that fell, and its fingerprint reader doesn’t work any longer. It simply cannot recognise my fingers, or it does recognise the finger once in like 50 attempts. I was unable to trace what I did and how much I pushed that sensor. I turned the biometrics off and use passwords instead. It’s less convenient, but I’m not planning to upgrade the phone for that very reason either. So I’m stuck with this for a while. I cannot imagine how passkeys are going to work in this scenario.

This, and also brand dependency, is what makes my worried about passkeys. If I got the idea correctly. It hashes my fingerprint data, but what if my fingerprint changes? I have that very often on my iPad that it stops seeing my thumbs as the correct thing. I assume that happens due to some manual work I may do. And my thumb becomes different to the sensor. I hack that with my pinky finger, for some reason it’s more reliable. But what if something happens to the sensor and it stops being reliable.

What are my options then? What are my options if I’m about to change my smartphone brand? What are my options if I’m on my PC that has no sensors for any biometrics?

Re: Passwordless: a different kind of hell?

#323

Post by appplication »

rootusrootus wrote: post #220
dgellow wrote: post #203

Earlier quoted context omitted.

How does that work if you want to get an android phone or Samsung tablet or windows laptop at some point?

If you go all-in on an ecosystem there's going to be pain if you decide to jump to another ecosystem. You can avoid some of that by using 1Password (I'm sure there are others as well). It integrates just fine with iOS.

I used to feel this way and used LastPass, which did not end well.

Re: Passwordless: a different kind of hell?

#324

Post by apitman »

I'm currently unable to log in to my Amazon account on new devices because I accidentally deleted the MFA for it. I've submitted my government ID to their recovery form multiple times. No response. Phone customer support said they couldn't do anything. Any ideas?

Re: Passwordless: a different kind of hell?

#325

Post by rurp »

Al-Khwarizmi wrote: post #13

We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle.…

2FA can also be a way to get more private data, like phone numbers, out of users; which will be used for things having nothing to do with security or helping the user. Facebook did exactly this and I'm sure other companies have as well.

2FA increases risk of the account owner losing access to their account. There are a huge amount of posts online from people livid about getting locked out of their account because of some mundane reason like their phone breaking. That risk rarely seems to be considered by the crowd pushing 2FA everywhere and anywhere, probably because it happens most often to non-techies.

Things that seem easy or obvious to folks working in tech are often a huge hurdle for regular users, who make up the majority of users for many products. Many tech companies could do a much better job of considering the needs of their users, rather than building what the devs and product managers personally think is cool.

Re: Passwordless: a different kind of hell?

#326

Post by senectus1 »

This is why I run passwordless on my most high value/important services and use my password manager to hold passwords for all the end point services like ebay and other low / risk low expectations sites.

for me its about lowering the price to use a service. (as in mental price not dollar value)

Re: Passwordless: a different kind of hell?

#327

Post by m3047 »

filleokus wrote: post #4

I think the industry, to some extent, already have reconsidered the session length, see [0] by Auth0 for example (even if it's obv. a PR piece). Nowadays my gut assumption when I use a service with really short sessions is that their security practices are probably questionable. I recently argued, as the cybersecurity guy™, with a vendor that we can't ask regular users to reauthenticate every 15 minutes. They insiste…

A problem which has made the news repeatedly is services where an e.g. password reset doesn't reset / invalidate the session key. How many cases of ridiculously short session expiry are masking cases where the service is unable to actually manage to invalidate a session key in conjunction with said password reset?

Re: Passwordless: a different kind of hell?

#328

Post by al_borland »

MDWolinski wrote: post #307
efitz wrote: post #275

Earlier quoted context omitted.

I love the Apple ecosystem, however I always have a low level of dread that someday I will somehow offend them and be permanently blacklisted. This is the main reason I've drawn the line at using their password manager or email - I use separate email and separate password manager so that in a worst case situation I don't get locked out of everything .

Not to be argumentative, just wondering, has there been a case related to iCloud access that Apple has ever blacklisted someone? Certainly, I've heard of Meta and other companies doing not, but don't recall Apple outside of security confirmation issues people are having.

If you have 2FA and lose all your 2FA methods, and didn’t preplan by making a recovery key and storing it in a safe place you can find again… you can be screwed. It’s not a blacklist, but the net result is the same.

I’m terrified of losing access to all my stuff because of forced 2FA I never signed up for. I get that it’s more secure, but it can be secure to the point of having unrecoverable data. All it would take is someone carelessly deciding to get a new phone number. I have a friend who recently talked about wanting to get a new number with his new phone. I asked about 2FA and he seemed to have no knowledge of it and said he didn’t have anything like that. He kept his number, but if he didn’t, I could see him easily getting locked out of his Apple account (which he has), and his bank.

Re: Passwordless: a different kind of hell?

#329

Post by al_borland »

a_imho wrote: post #152
michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

Order pizza, pay with virtual card. Payment provider needs 3FA+Captcha, one of the factors is email which is another 2FA challenge. Disclosing the card details once logged in prompts for another 2FA, finally VISA also challenges you with a recent payment question. Insanity.

This would be enough to have me drive to the pizza place myself and pay cash.

Re: Passwordless: a different kind of hell?

#330

Post by SketchySeaBeast »

smitty1e wrote: post #290
SketchySeaBeast wrote: post #64

Earlier quoted context omitted.

OK, so we're at that level of contribution, are we?

I'm just saying that the information staying on the device is aspirational. I see that this skepticism has offended.

Well because, to me at least, it's less skepticism and more cynicism.
Post reply on HN