Earlier quoted context omitted.
Not phising resistant compared to what? Bear in mind the saying: it's impossible to make anything foolproof because fools are so ingenious.
Compared to any phishing-resistant authentication protocol.
Such as?
Why Login Security Sucks
41–50 of 81 posts
Re: Why Login Security Sucks
#42Earlier quoted context omitted.
An SSH key isn’t exactly a long password since the service you use it for can’t leak your private key in a security breach
I still cannot understand why mutual TLS never took off anywhere besides Gov [1]. You know how much more convenient it is to just open a browser and go to a webpage and already be logged in? [1]: https://en.wikipedia.org/wiki/Common_Access_Card
Mutual TLS was necessary but a giant pain in the butt for an app I worked on that needed to do over the air updates over WiFi. Getting it working across all of the moving parts was a significant part of the overall effort for the OTA part of that project.
OCSP existed back then which helped but I don’t know if stapling had been widely implemented yet.
Re: Why Login Security Sucks
#43Controversial opinion: Username and password is perfectly fine. To provide an example that most people here are probably comfortable with: An SSH key is effectively a really long password with cryptographic properties. It's a single factor, one thing, that you use to complete a challenge for the server. We are fine to use SSH keys as our only authentication factor for servers, with IP whitelisting where security trum…
How much does the recipe of strict requirements limit entropy of the password or enhance its predictability (both are somewhat related)?
More of a problem is password reuse for multiple sites, which is impossible when using SSH keys.
Re: Why Login Security Sucks
#44Earlier quoted context omitted.
> highly randomized (you don’t get to choose Summer2024!) Sure. > designed to be stored offline somewhere as a break glass. That's fair. > The OTP is usually very long, No, 10 digits is not very long, that's just 10^10 (about 2^33). The xkcd password ( https://xkcd.com/936/ ) is better than that. It's better than Summer2024 perhaps, but not all that much better.
The xkcd password requires the use of spaces as legal characters. For some reason, this is still an issue with the majority of orgs with complex password requirements.
I practically see red when they tell me I can’t use spaces in my password. What kind of clown car are you idiots running over there?
Re: Why Login Security Sucks
#45I know that crypto/blockchain is not super popular here, but the experience of logging-in to various dapps is pretty nice. The ”login” is the dapp showing the user a message to sign to prove they own the key, then you can sign the message, and that’s the whole login. There’s various ways to implement it, but here’s a quick tutorial for doing login with MetaMask. https://docs.metamask.io/wallet/how-to/sign-data/siwe/
This looks like any other public key crypto authentication (U2F) but more complex and less universally adopted? How is this better than OIDC?
I guess it’s pretty similar, it’s just pub/priv key verification in the end.
Imo the benefit would be that on top of just proving you’re you (logging in), you can perform many other actions.
One example where could be used is micropayments, which is imo unsolved problem on the internet. Sometimes I’m browsing and end up on some newspaper paywall which asks me for credit card and yearly subscriptions. Not doing that. But if I were to click a button and get a message to sign saying “Spend 2 cents to view this article?”, and see the article 2 seconds later, I would go ahead and do it.
Re: Why Login Security Sucks
#46Earlier quoted context omitted.
Not phising resistant compared to what? Bear in mind the saying: it's impossible to make anything foolproof because fools are so ingenious.
WebAuthn and related variants
How does a server using WebAuthn know that the client it is talking to is the right one? For example, say my bank wants to use WebAuthn instead of a username and password to let me access my account. How does the bank's server know that the public key I give it (via my browser) corresponds to my account?
Also, what if my device gets stolen? How do I prevent someone else from accessing my account, since the secret needed to do so is on the device, not with me?
Re: Why Login Security Sucks
#47If I'm going to be forced into two-factor authentication, I would much rather use TOTP than be forced to use a phone number. Phones can break.
> I would much rather use TOTP than be forced to use a phone number. Phones can break. Phones / SMS is also less secure than TOTP. It’s odd that most orgs that require 2FA yet accept only phone calls or sms as the second factor are financial institutions.
[deleted]
Re: Why Login Security Sucks
#48the problem is the threat models for different sites and apps aren't the same, and so security protocols that cover the maximum bases for compliance, identity, security, privacy, recovery, and moderation don't have a lot of flexibility. the only thing that is going to change authentication is a new mode for working online and the death of the browser from AI rendering most of what we need. maybe this polarizes, where…
But you could break most of the apps I use into a handful of kinds, and apply rules accordingly.
Like there’s no reason my bank, brokerage, and doctor shouldn’t use the same degree of paranoia. But who cares if someone cracks my hackernews password. I haven’t associated my account with any projects or my real identity so the worst you can do is make me look like an idiot or get dang to ban me.
Re: Why Login Security Sucks
#49It could be a good thing to have a confirmed email in the database, in case a 3-letter-agency knocks on your door because of some highly illegal content on your site.
I have to unsubscribe from five things a week that are clearly other people using my email address to sign up for things.
Someone used my email address to sign up for a Mint account. And the only way you can delink Mint is to call Mint or log into someone else’s financial account. I’m no lawyer but that seems like a very, very bad idea to me.
Re: Why Login Security Sucks
#50Earlier quoted context omitted.
Because the secrets have no intrinsic value. If you believe your database has been compromised, you just invalidate them all. The problem with password compromise is that passwords are re-used: losing a user password is a big deal . There's a reason there's no "Has My TOTP Seed Been Pwned" site anywhere.
Losing a user password is a “bigger deal” when the password is re-used, I get this point. > Because the secrets have no intrinsic value This is too strong. In general, it’s not possible to know my database has not been compromised. TOTP invalidation isn’t a trivial thing either, particularly if it was used instead of passwords and not as a 2nd factor.
I don't agree, but can you point to a system that uses TOTP as a sole factor?