Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Login Security Sucks

matduggan.com

Post reply on HN
Print view View original

71–80 of 81 posts

Re: Why Login Security Sucks

#71

Post by vdelitz »

eadmund wrote: post #34
tptacek wrote: post #22

Earlier quoted context omitted.

It's clunky and it's not phishing resistant.

The way I think of it is: my browser’s password manager is the phishing-resistant portion of the system, and TOTP ensures that I am the one sitting at my browser. Passkeys sound interesting, but I have a (perhaps incorrect) user-hostile big-tech lock-in feeling from them. I really could be wrong, but it feels like the intention is for us all to have to use accounts from Google, Microsoft, Facebook or Apple (maybe Moz…

Yes, that might be a strategic thinking of big tech. Still you can use third-party password managers like Bitwarden, KeePassXC or 1Password to take care of your passkeys. I think, for most non-technical users, they will go for the Apple/Google/Microsoft credential manager option but if you're more tech-savyy, there are ways to stay independent of big tech.

Re: Why Login Security Sucks

#72

Post by vdelitz »

pdonis wrote: post #46
jf wrote: post #37

Earlier quoted context omitted.

WebAuthn and related variants

How does a server using WebAuthn know that the client it is talking to is the right one? For example, say my bank wants to use WebAuthn instead of a username and password to let me access my account. How does the bank's server know that the public key I give it (via my browser) corresponds to my account? Also, what if my device gets stolen? How do I prevent someone else from accessing my account, since the secret nee…

1) They link the public key to your user account in their database.

2) Passkeys are 2FA by default. Someone needs to steal your phone where the private key is stored (first factor) and they would need your Face ID / Touch ID / PIN Code (second factor). Just loosing your phone doesn't give someone else the chance to use your passkey for authentication.

Re: Why Login Security Sucks

#73

Post by vdelitz »

radicality wrote: post #30
tptacek wrote: post #8

Earlier quoted context omitted.

There is no less attractive use of blockchain tech than login. The biggest problem with login security isn't attesting to an identity, it's account recovery; blockchains make that incredibly difficult.

Fair enough, I guess for crypto wallets there isn’t any recovery that can be done if you lose the private key. In the end a cryptocurrency wallet is usually just a pub/priv keypair, so purely for login/identity purposes it’s similar to passkeys. And can be backed up easily. What I wanted to say is that hopping around different ‘dapps’ is quite seamless from a login point of view (and has benefits like ability to pay…

There's a new trend coming up of "Smart Wallets" which make use of synced passkeys for authentication.

I can share a blog post about this topic that I recently wrote if you're interested in some details (e.g. Coinbase did it this way).

Re: Why Login Security Sucks

#74

Post by cassianoleal »

bruce343434 wrote: post #67
wlesieutre wrote: post #32

Earlier quoted context omitted.

An SSH key isn’t exactly a long password since the service you use it for can’t leak your private key in a security breach

The password isn't leaked, a hash of the salted and peppered password is the only thing in the database (+ the salt, and the pepper elsewhere).

Assuming it's implemented that way. Which is a big assumption.

Re: Why Login Security Sucks

#75

Post by bluepuma77 »

hinkley wrote: post #49
bluepuma77 wrote: post #16

It could be a good thing to have a confirmed email in the database, in case a 3-letter-agency knocks on your door because of some highly illegal content on your site.

I have to unsubscribe from five things a week that are clearly other people using my email address to sign up for things. Someone used my email address to sign up for a Mint account. And the only way you can delink Mint is to call Mint or log into someone else’s financial account. I’m no lawyer but that seems like a very, very bad idea to me.

Usually you have to click a unique confirmation link in the email to activate the account.

Re: Why Login Security Sucks

#76

Post by hinkley »

bluepuma77 wrote: post #75
hinkley wrote: post #49

Earlier quoted context omitted.

I have to unsubscribe from five things a week that are clearly other people using my email address to sign up for things. Someone used my email address to sign up for a Mint account. And the only way you can delink Mint is to call Mint or log into someone else’s financial account. I’m no lawyer but that seems like a very, very bad idea to me.

Usually you have to click a unique confirmation link in the email to activate the account.

My inbox says otherwise. Many sites don’t require the activation code to start using the account apparently. Fucking internet, man.

Re: Why Login Security Sucks

#77

Post by bruce343434 »

cassianoleal wrote: post #74
bruce343434 wrote: post #67

Earlier quoted context omitted.

The password isn't leaked, a hash of the salted and peppered password is the only thing in the database (+ the salt, and the pepper elsewhere).

Assuming it's implemented that way. Which is a big assumption.

As the main post was written in the voice of a knowledgeable developer picking a login flow, I assumed so indeed.

Re: Why Login Security Sucks

#78

Post by aseipp »

RadiozRadioz wrote: post #25

Controversial opinion: Username and password is perfectly fine. To provide an example that most people here are probably comfortable with: An SSH key is effectively a really long password with cryptographic properties. It's a single factor, one thing, that you use to complete a challenge for the server. We are fine to use SSH keys as our only authentication factor for servers, with IP whitelisting where security trum…

> An SSH key is effectively a really long password with cryptographic properties

"An SSH key is basically a really long password, but also at the same time it's not a really long password, and you interact with it entirely differently." OK.

Modern password managers make long passwords vaguely "look like" SSH keys much in the same way a truck might vaguely "look like" a train. But they only achieve this by taking over the creation and use of the password entirely, even going so far as to tie them to origins in your browser, to prevent them from being inserted into a hostile webpage (phishing attacks still work just fine.)

So they're not really passwords anymore, just bearer tokens. But bearer tokens are not SSH keys, anymore than a password is an SSH key.

The SSH analogue to login passwords are SSH passwords, not SSH keys. And nobody uses SSH passwords anymore for the same reason people don't like web passwords, today (at least on the web 90% of the time you can email reset.) Even the follow up methods like credential stuffing are identical; typing in a password to a hostile SSH server will absolutely result in that username+password being spammed at every possible service as a brute force method. The reason this method isn't still popular today is because collectively ~everyone started using keys like 20 years ago for everything. But credential stuffing and phishing are still massive problems for the web.

Re: Why Login Security Sucks

#79

Post by bigfatkitten »

hinkley wrote: post #44
smcnally wrote: post #33

Earlier quoted context omitted.

The xkcd password requires the use of spaces as legal characters. For some reason, this is still an issue with the majority of orgs with complex password requirements.

I practically see red when they tell me I can’t use spaces in my password. What kind of clown car are you idiots running over there?

I worked for a government agency who banned @, because it would SQLi and break their Oracle-based LOB apps when you logged on and when they synced your password in the clear.

Re: Why Login Security Sucks

#80

Post by will1james »

tptacek wrote: post #10

This person is wildly overthinking their problems. Early in the piece, they marvel that it's somehow OK to email magic login links to people, but not to SMS logins. Yes: among other reasons, that's because there's nobody an attacker can realistically call on the phone or bribe at a neighborhood cell phone store to rehome an email account. Nobody wants to do away with SMTP more than I do, but everybody has it, and mos…

> It's even weird for you to do login-with-Google or SIWA.

What is "SIWA"?

Post reply on HN