61–70 of 81 posts
Earlier quoted context omitted.
The xkcd password requires the use of spaces as legal characters. For some reason, this is still an issue with the majority of orgs with complex password requirements.
correcthorsebatterystaple isn't much worse
the problem is the threat models for different sites and apps aren't the same, and so security protocols that cover the maximum bases for compliance, identity, security, privacy, recovery, and moderation don't have a lot of flexibility. the only thing that is going to change authentication is a new mode for working online and the death of the browser from AI rendering most of what we need. maybe this polarizes, where…
But you could break most of the apps I use into a handful of kinds, and apply rules accordingly. Like there’s no reason my bank, brokerage, and doctor shouldn’t use the same degree of paranoia. But who cares if someone cracks my hackernews password. I haven’t associated my account with any projects or my real identity so the worst you can do is make me look like an idiot or get dang to ban me.
Earlier quoted context omitted.
Losing a user password is a “bigger deal” when the password is re-used, I get this point. > Because the secrets have no intrinsic value This is too strong. In general, it’s not possible to know my database has not been compromised. TOTP invalidation isn’t a trivial thing either, particularly if it was used instead of passwords and not as a 2nd factor.
I don't agree, but can you point to a system that uses TOTP as a sole factor?
Fair enough.
> It is unclear why generating a one-time password for the user is bad but if we call the password a "recovery code" it is suddenly sufficient. The OTP is usually very long, highly randomized (you don’t get to choose Summer2024!), and designed to be stored offline somewhere as a break glass. Passwords typically follow none of those rules.
Controversial opinion: Username and password is perfectly fine. To provide an example that most people here are probably comfortable with: An SSH key is effectively a really long password with cryptographic properties. It's a single factor, one thing, that you use to complete a challenge for the server. We are fine to use SSH keys as our only authentication factor for servers, with IP whitelisting where security trum…
An SSH key isn’t exactly a long password since the service you use it for can’t leak your private key in a security breach
I am anxious about the fact that if you lose your phone in the modern world, you are in for so much work and inconvenience. I don't carry my personal laptop everywhere you know. So throughout the day, for many hours my phone is basically 1FA, not 2FA, and I think that goes for lots of people.
This person is wildly overthinking their problems. Early in the piece, they marvel that it's somehow OK to email magic login links to people, but not to SMS logins. Yes: among other reasons, that's because there's nobody an attacker can realistically call on the phone or bribe at a neighborhood cell phone store to rehome an email account. Nobody wants to do away with SMTP more than I do, but everybody has it, and mos…
Earlier quoted context omitted.
What's wrong with TOTP? Are you using that term in a technical sense to mean something specific or are you referring to any situation where someone needs to consult an app on a second device to receive a code to present to the first device?
It's clunky and it's not phishing resistant.