SQRL - Replacement for usernames and passwords • Hacker News Board

Re: SQRL - Replacement for usernames and passwords

#31

Post by anateus » Wed, Oct 02, 2013, 9:47 PM UTC

richardjs wrote: post #19

dsl wrote: post #18

http://attrition.org/errata/charlatan/steve_gibson/ > Steve Gibson is somewhat of a "fringe" charlatan. In some professional security circles, he is not considered a reputable security professional, rather more of a snake oil salesman peddling third-rate software with bold claims. While many of his claims are a bit outlandish or bold, few, if any, are demonstrably false. However, when asked to speak on security topic…

Not to use a debate cliché, but isn't this a ridiculously shameless ad hominem? He's published the protocol and disavowed any intellectual property claim to it. Let's focus on critiquing the protocol.

There are a few types of ad hominem but they all involve using some property of a person that is only tangentially related. This note about how the majority of the security community sees Steve Gibson speaks directly to an assessment of his ability in this field.

Re: SQRL - Replacement for usernames and passwords

#32

Post by derefr » Wed, Oct 02, 2013, 9:48 PM UTC

The thing this is most similar to is Twitter's recent 2FA implementation. Except, instead of the site automatically pinging the app to open on your phone (and then you ACKing or NAKing the ping), it requires you to open it yourself and scan a code on the screen (thus implicitly ACKing it.) Everything else happens the same.

Re: SQRL - Replacement for usernames and passwords

#33

Post by asgentile » Wed, Oct 02, 2013, 9:48 PM UTC

Thinking about the user experience for this. I want to authenticate, so I hunt down my phone, launch an app, scan a code, press a button in the app to submit. This seems to me like quite a long process versus the traditional typing in a username and password. What about the implications of a stolen phone?

Re: SQRL - Replacement for usernames and passwords

#34

Post by anateus » Wed, Oct 02, 2013, 9:50 PM UTC

diminoten wrote: post #29

dsl wrote: post #24

Earlier quoted context omitted.

An ad hominem attack would be attacking him for unrelated traits, i.e. "we can't trust people with blue eyes!" I believe his history as a snake oil salesman is highly relevant to his current "security" work.

It's still an ad hominem - the merits of his argument should stand independent to who he is or his history on any topic. Doesn't mean it's not worth talking about, though. After all, science is entirely founded on a kind of inductive reasoning, so logical fallacies aren't crazy to consider.

Note: https://yourlogicalfallacyis.com/ad-hominem

Gibson's personality isn't the thing in question here, the quotation above is specifically about his history in security. If the comment was about how he's a major asshole (just an example, I'm not saying that) in conferences or something like that, it would be an ad hominem, as that sort of information would not be relevant.

Re: SQRL - Replacement for usernames and passwords

#35

Post by jimueller » Wed, Oct 02, 2013, 9:50 PM UTC

Seems similar to the discontinued Google Sesame. http://www.zdnet.com/open-sesame-googles-no-password-log-in-...

It would be interesting to know why Google didn't pursue it. Maybe a 20% project? https://plus.google.com/101935995649723391317/posts/P94xEz9D...

Re: SQRL - Replacement for usernames and passwords

#36

Post by DanBC » Wed, Oct 02, 2013, 9:55 PM UTC

phpnode wrote: post #20

juhanima wrote: post #6

Not exactly a new idea. Here is some prior art http://openaccess.uoc.edu/webapps/o2/bitstream/10609/14761/6... http://www.computer.org/csdl/proceedings/ares/2009/3564/00/3... As far as I know, QR-TAN is being used in Germany for authentication by a number of banks.

drivebyacct2 - your account has been dead for about 100 days and 200 posts, basically no one can seen your messages unless they have showdead on. Here's the "offending" post that you were banned for https://news.ycombinator.com/item?id=5982741 (hint - the ban is completely unjustified)

Ahem.

(https://news.ycombinator.com/item?id=5974604)

Re: SQRL - Replacement for usernames and passwords

#37

Post by bargl » Wed, Oct 02, 2013, 9:55 PM UTC

dsl wrote: post #24

richardjs wrote: post #19

Earlier quoted context omitted.

Not to use a debate cliché, but isn't this a ridiculously shameless ad hominem? He's published the protocol and disavowed any intellectual property claim to it. Let's focus on critiquing the protocol.

An ad hominem attack would be attacking him for unrelated traits, i.e. "we can't trust people with blue eyes!" I believe his history as a snake oil salesman is highly relevant to his current "security" work.

Actually it's still ad hominem. The fact that you completely ignored the original post and instead attacked Steve Gibson, is indicative of an ad hominem attack. If you'd even said, this new idea is ridiculous because QR codes are inherently insecure (which is false) you'd be fine.

Sources:

http://plover.net/~bonds/adhominem.html

I think this example is pretty much what you did.

    A: "All rodents are mammals, but a weasel isn't a rodent, so it can't be a mammal."
    B: "I'm sorry, but I'd prefer to trust the opinion of a trained zoologist on this one."

B's argument is ad hominem: he is attempting to counter A not by addressing his argument, but by casting doubt on A's credentials. Note that B is polite and not at all insulting.

If you want further reading from other sources you can go to any of the following links. en.wikipedia.org/wiki/Ad_hominem http://www.nizkor.org/features/fallacies/ad-hominem.html http://c2.com/cgi/wiki?AdHominem

Re: SQRL - Replacement for usernames and passwords

#38

Post by richardjs » Wed, Oct 02, 2013, 10:01 PM UTC

asgentile wrote: post #33

Thinking about the user experience for this. I want to authenticate, so I hunt down my phone, launch an app, scan a code, press a button in the app to submit. This seems to me like quite a long process versus the traditional typing in a username and password. What about the implications of a stolen phone?

With the traditional username/password system, you have to remember a unique, secure password for each site--or else you use a password manager, which involves more steps as well. He's also mentioned that this could be adapted into a browser plugin, so that would streamline use on a trusted machine.

As for losing the phone, he suggests a passphrase-like "local password" on "The user's view of the application" page [1].

[1] https://www.grc.com/sqrl/userview.htm

Re: SQRL - Replacement for usernames and passwords

#39

Post by bargl » Wed, Oct 02, 2013, 10:05 PM UTC

anateus wrote: post #34

diminoten wrote: post #29

Earlier quoted context omitted.

It's still an ad hominem - the merits of his argument should stand independent to who he is or his history on any topic. Doesn't mean it's not worth talking about, though. After all, science is entirely founded on a kind of inductive reasoning, so logical fallacies aren't crazy to consider.

Note: https://yourlogicalfallacyis.com/ad-hominem Gibson's personality isn't the thing in question here, the quotation above is specifically about his history in security. If the comment was about how he's a major asshole (just an example, I'm not saying that) in conferences or something like that, it would be an ad hominem, as that sort of information would not be relevant.

I disagree. He doesn't address the actual topic here at all. All he is doing is saying that Steve Gibson is a charlatan.

His history as a security professional has no bearing on the actual content here. We are all talking about an idea SQRL not Steve Gibson. If you said, "SQRL isn't worth my time because I don't trust Steve Gibson" that's fine, but the author made no note on SQRL at all, he just attacked Steve Gibson and let it be.

Sure there may be precedence to say that SQRL isn't worth your time, but Steve's credentials don't affect this idea at all. For all you know he may have been given the idea by a team of security researchers who wanted to see if the top post on Hacker News would be some bull shit argument about Steve Gibson. Obviously not the case, but come on let's talk about the freaking content here not the man.

The saying "throwing the baby out with the bath water" comes to mind. Let's look at SQRL and see if it actually makes any sense before we throw it all away.

Re: SQRL - Replacement for usernames and passwords

#40

Post by roc » Wed, Oct 02, 2013, 10:09 PM UTC

__david__ wrote: post #7

tptacek wrote: post #5

How is this better than any other phone-based 2-factor auth scheme?

Well, it's not really 2-factor is it? It's just the phone part of a 2-factor login and no web form part. Presumably the screen shot that showed a login form was for people without the phone app.

> "Well, it's not really 2-factor is it?"

Whatever you use to unlock/authenticate to the device would be the other factor.