Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless: a different kind of hell?

jcarlosroldan.com

Post reply on HN
Print view View original

331–340 of 392 posts

Re: Passwordless: a different kind of hell?

#331

Post by ryandrake »

zeekaran wrote: post #251
a_imho wrote: post #152

Earlier quoted context omitted.

Order pizza, pay with virtual card. Payment provider needs 3FA+Captcha, one of the factors is email which is another 2FA challenge. Disclosing the card details once logged in prompts for another 2FA, finally VISA also challenges you with a recent payment question. Insanity.

Then they store your credit card info in a database and leak it some time next year.

It's pretty annoying that they load all this pain and suffering onto the user who's just trying to make a purchase, when the company's database is often the weakest link.

Re: Passwordless: a different kind of hell?

#332

Post by ryandrake »

InitialBP wrote: post #146
michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

Business don't want online shopping to be high-friction, but Thankfully consumer opinion is pushing more for security and less for making it as easy as possible to buy stuff online. I'll happily take this shit-show cacophony of various 2fa methods and authentication types if nobody is stealing money from my bank account or ordering stuff on ebay on my behalf. The flip side of this - is that if companies properly setu…

> I'll happily take this shit-show cacophony of various 2fa methods and authentication types if nobody is stealing money from my bank account or ordering stuff on ebay on my behalf.

Even better: I wouldn't care about people stealing money from my bank account if cleaning it up and making whole was my bank's responsibility and not mine or some hapless vendor. Neither I, nor store vendors should have to put up with the "shit-show cacophony." The bank's entire reason for existence is to secure access to my money--it should be entirely their problem.

Re: Passwordless: a different kind of hell?

#333

Post by jonathanlydall »

vladvasiliu wrote: post #242
rstupek wrote: post #235

Earlier quoted context omitted.

It's stored on your phone in the secure enclave.

That's what I was thinking, which means you're not actually giving Apple your CC number.

My experience is that you can start the process by entering your credit card details, or use your camera to try fill them in for you.

Apple then checks if your card issuer has ApplePay enabled and if so provisions a “virtual” card which is what is stored on the device’s Secure Enclave.

I also just checked my banking app quickly which can initiate the adding of the card to wallet, showing the wallet’s add card screen with the card holder name and the last 4 digits and asking if you want to proceed.

There is no way to see what the full virtual card number is, so there is no way to use this virtual card aside from tapping your phone on CC machines or using websites which have set up ApplePay as a payment method.

CC machines don’t actually have to support ApplePay specifically, as long as it supports tap to pay without insisting on a PIN, then ApplePay works with it. In essence your phone’s NFC exactly implements the same capabilities and protocols as NFC chips on normal credit cards.

Re: Passwordless: a different kind of hell?

#334

Post by kkfx »

michaelt wrote: post #7

I recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to sen…

They want mandatory macrobugs (aka smartphones, the bug not payed and carefully placed by those who want to spy, but the one payed and babysitted by the spy target) for anyone, so if you use a desktop you are a threat and you need to be not in comfort...

Re: Passwordless: a different kind of hell?

#335

Post by mekoka »

lolinder wrote: post #185
Karellen wrote: post #40

> Gileadite soldiers used the word "shibboleth" to detect their enemies, the Ephraimites. The Ephraimites spoke in a different dialect so that they would say "sibboleth" instead. Experience : you just had to say a word. Security : there's a single word to authenticate multiple users and it can be cracked by learning how to spell it. Although that's roughly how the Wikipedia entry[0] summarises it, the actual wording…

> so an Ephraimites soldier was literally incapable of pronouncing the word "correctly". And, importantly, they would not even have realized that they were saying it wrong, because they would have been unable to hear the difference. As a modern example: I have an acquaintance from Tonga. At some point she got very frustrated with the people around her who didn't understand what she meant by the "rittel bin". She fina…

It's not that you're unable to hear the difference, you have to pay closer attention to what you're really hearing. I'm a native french speaker and when first learning english, I was made to carefully notice the subtle difference in certain vowels, intonations, silent consonants, etc. Like in sit and seat. The former vowel doesn't exist in french, so most french speakers learning english would pronounce it like the latter, as in "seat down". English vowels are very different from french, but there are some similarities and if you don't care to notice, you'll use approximations. E.g. imagine a french person saying "book", with the "ooh" sound and a noticeable exhalation after the k. Small little things like that can be brought to attention and corrected.

It also doesn't help that we much rely on the written word to learn. Which reinforces the reliance on existing symbol-pronunciation associations, instead of creating new ones.

Re: Passwordless: a different kind of hell?

#336

Post by tzs »

ta1243 wrote: post #125
whartung wrote: post #97

Earlier quoted context omitted.

Github 2FA is made extra fun because they only offer a single mechanic of replacing it (that I know of), and that's using the recovery codes. So, they forced me to use 2FA, and I dutifully printed out the recovery codes (don't write down your passwords, that's bad practice, but here's 20 recovery codes that stand between you and losing your account forever, so you know, manage that somehow). When I bought a new iPhon…

TOTP backups from phones is a major issue, from what I can tell you simply can't do it.

What I do is when I receive a QR code to set up TOTP while creating a new account is to take a screenshot of that code and save an encrypted copy of that screenshot. Then it is just part of my ordinary data backed up as part of my normal backups.

If I ever want to set up a TOTP app on a new device it is not hard to decrypt all my saved QR codes, open them all at the same time in Preview on my Mac, select the option to show one page at a time, and then get into a nice rhythm using one hand to scan on the new device and the other to hit "page down" on the Mac keyboard.

If the site also gives a text form of the shared secret from the QR code I save that too. Having the text form around is handy in case I need to login but for some reason don't have the devices where I have the TOTP apps. Given the text form of the code, this command, from the oathtool package, will give the current login code:

  $ oathtool --totp -b "secret"
That's if the secret is encoded in base32, which they commonly are. If it is in hex leave off the -b.

If the site doesn't give a text form of the shared secret I read the QR code to get it. If you do that be careful. Some QR code reader apps do the processing server side which you probably don't want...and they don't necessarily make that clear in the description. I had to try a couple of apps from the Mac app store before finding one that did it client side. (Then I found out that Mathematica's BarcodeRecognize function can do it, and deleted the QR code reader app. Now I just open Mathematica, type BarcodeRecognize[], drag and drop an image file that has the QR code between the brackets, and hit shift-return).

Re: Passwordless: a different kind of hell?

#337

Post by Al-Khwarizmi »

qhwudbebd wrote: post #302
Al-Khwarizmi wrote: post #13

We are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle.…

I spent a little time trying to decide whether GitHub's 2fa was genuinely an extra factor whose compromise (with an uncompromised password) wouldn't weaken security vs a situation where it hadn't been set up at all. In that case, presumably I could embed the totp key in a bookmarklet in the conveniently-sized 'public bio' field on my profile so I can complete it on whatever device I happen to be using, and effectivel…

That's another pet peeve of mine with 2FA, which I didn't mention to avoid posting a wall of text: in many cases (no idea if GitHub in particular is one of them), the second factor totally dominates (allowing you to recover the first factor or logging in without it) so it effectively is 1FA, where the factor is almost always your phone. Lose your phone, and you're screwed.

Re: Passwordless: a different kind of hell?

#338

Post by interroboink »

lolinder wrote: post #185
Karellen wrote: post #40

> Gileadite soldiers used the word "shibboleth" to detect their enemies, the Ephraimites. The Ephraimites spoke in a different dialect so that they would say "sibboleth" instead. Experience : you just had to say a word. Security : there's a single word to authenticate multiple users and it can be cracked by learning how to spell it. Although that's roughly how the Wikipedia entry[0] summarises it, the actual wording…

> so an Ephraimites soldier was literally incapable of pronouncing the word "correctly". And, importantly, they would not even have realized that they were saying it wrong, because they would have been unable to hear the difference. As a modern example: I have an acquaintance from Tonga. At some point she got very frustrated with the people around her who didn't understand what she meant by the "rittel bin". She fina…

Somewhat similar to how English (and other) speakers can have trouble distinguishing between the intonations in tonal languages like Chinese — "mā, má, mǎ, mà", and all that.

Re: Passwordless: a different kind of hell?

#339

Post by hot_gril »

tzs wrote: post #336
ta1243 wrote: post #125

Earlier quoted context omitted.

TOTP backups from phones is a major issue, from what I can tell you simply can't do it.

What I do is when I receive a QR code to set up TOTP while creating a new account is to take a screenshot of that code and save an encrypted copy of that screenshot. Then it is just part of my ordinary data backed up as part of my normal backups. If I ever want to set up a TOTP app on a new device it is not hard to decrypt all my saved QR codes, open them all at the same time in Preview on my Mac, select the option t…

Why use a QR code reader app instead of the built in camera app?

Personally, I email the backup codes to myself. Yes it's less secure in theory, but the only time I'm using totp is against my will.

Re: Passwordless: a different kind of hell?

#340

Post by hot_gril »

tnbp wrote: post #292
ta1243 wrote: post #140

Earlier quoted context omitted.

Sure, so same problem. Less likely your yubikey will be stolen I guess, but less convenient too (something else to carry)

But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed. Also, your Yubikey is probably less likely to be stolen or break, but I figure it's much easier to lose it, which is why you might want to have two, just in case. And that's where it gets really inconvenient.

Two yubikeys sounds ok, but I don't 100% trust that the second one works forever. Anyway, my keychain got ran over by a bus, and luckily the yubikey survived.
Post reply on HN