31–40 of 81 posts
> It is unclear why generating a one-time password for the user is bad but if we call the password a "recovery code" it is suddenly sufficient. The OTP is usually very long, highly randomized (you don’t get to choose Summer2024!), and designed to be stored offline somewhere as a break glass. Passwords typically follow none of those rules.
wait, how do you know my pw?
Controversial opinion: Username and password is perfectly fine. To provide an example that most people here are probably comfortable with: An SSH key is effectively a really long password with cryptographic properties. It's a single factor, one thing, that you use to complete a challenge for the server. We are fine to use SSH keys as our only authentication factor for servers, with IP whitelisting where security trum…
> It is unclear why generating a one-time password for the user is bad but if we call the password a "recovery code" it is suddenly sufficient. The OTP is usually very long, highly randomized (you don’t get to choose Summer2024!), and designed to be stored offline somewhere as a break glass. Passwords typically follow none of those rules.
> highly randomized (you don’t get to choose Summer2024!) Sure. > designed to be stored offline somewhere as a break glass. That's fair. > The OTP is usually very long, No, 10 digits is not very long, that's just 10^10 (about 2^33). The xkcd password ( https://xkcd.com/936/ ) is better than that. It's better than Summer2024 perhaps, but not all that much better.
Earlier quoted context omitted.
What's wrong with TOTP? Are you using that term in a technical sense to mean something specific or are you referring to any situation where someone needs to consult an app on a second device to receive a code to present to the first device?
It's clunky and it's not phishing resistant.
Passkeys sound interesting, but I have a (perhaps incorrect) user-hostile big-tech lock-in feeling from them. I really could be wrong, but it feels like the intention is for us all to have to use accounts from Google, Microsoft, Facebook or Apple (maybe Mozilla, maybe), using browsers from Google, Microsoft or Apple (maybe Firefox), on OSes from Google, Microsoft or Apple.
Controversial opinion: Username and password is perfectly fine. To provide an example that most people here are probably comfortable with: An SSH key is effectively a really long password with cryptographic properties. It's a single factor, one thing, that you use to complete a challenge for the server. We are fine to use SSH keys as our only authentication factor for servers, with IP whitelisting where security trum…
Ah, so the problem is the HUMANS! This is great, because all we need to do is switch out the humans.
Controversial opinion: Username and password is perfectly fine. To provide an example that most people here are probably comfortable with: An SSH key is effectively a really long password with cryptographic properties. It's a single factor, one thing, that you use to complete a challenge for the server. We are fine to use SSH keys as our only authentication factor for servers, with IP whitelisting where security trum…
An SSH key isn’t exactly a long password since the service you use it for can’t leak your private key in a security breach
You know how much more convenient it is to just open a browser and go to a webpage and already be logged in?
Earlier quoted context omitted.
> highly randomized (you don’t get to choose Summer2024!) Sure. > designed to be stored offline somewhere as a break glass. That's fair. > The OTP is usually very long, No, 10 digits is not very long, that's just 10^10 (about 2^33). The xkcd password ( https://xkcd.com/936/ ) is better than that. It's better than Summer2024 perhaps, but not all that much better.
The xkcd password requires the use of spaces as legal characters. For some reason, this is still an issue with the majority of orgs with complex password requirements.
Controversial opinion: Username and password is perfectly fine. To provide an example that most people here are probably comfortable with: An SSH key is effectively a really long password with cryptographic properties. It's a single factor, one thing, that you use to complete a challenge for the server. We are fine to use SSH keys as our only authentication factor for servers, with IP whitelisting where security trum…
An SSH key isn’t exactly a long password since the service you use it for can’t leak your private key in a security breach
In any case, if the service handles passwords properly and the user generates one password per service (both wild far-out concepts unfortunately), leaking the salted hash would not matter.
Earlier quoted context omitted.
An SSH key isn’t exactly a long password since the service you use it for can’t leak your private key in a security breach
I still cannot understand why mutual TLS never took off anywhere besides Gov [1]. You know how much more convenient it is to just open a browser and go to a webpage and already be logged in? [1]: https://en.wikipedia.org/wiki/Common_Access_Card