Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless login done right

programming.tudorconstantin.com

Post reply on HN
Print view View original

51–56 of 56 posts

Re: Passwordless login done right

#51

Post by cm2187 »

nly wrote: post #37
jrasmussen0 wrote: post #23

I thought this would be a write-up on SQRL https://www.grc.com/sqrl/sqrl.htm that uses QR codes and a secure identity database on your phone to authenticate you. Unlike the article, SQRL is an open protocol that can be developed and used by anyone. It is in alpha stages but I have used a prototype and it works really well.

SQRL is worse in many respects. While it uses public key cryptography, which helps in the MITM scenario, it suffers from only weakly addressing the complexities of spoof protection (A malicious site, or a trustworthy but compromised site, can display a QR code for a different website or session). UNLOQ avoids some of this because it relies on direct notifications from the server to your phone (hopefully over TLS, whi…

But do you know any system that can eliminate a MITM attack?

Re: Passwordless login done right

#52

Post by Caprinicus »

arethuza wrote: post #19
olemartinorg wrote: post #7

I'm intrigued! But a few questions/comments: * How is this two-factor? I only see one factor (a thing you have, your phone). Email adresses are not secret. * Again, email adresses are not secret. How do you limit login-spamming? I don't want to wake up in the middle of the night because someone is trying to break into my account. * What about timing attacks? If i stand over your shoulder while you're in the library -…

So two factor would be "something you know" (password) and "something you have" (phone) - and this just has the latter. So it's single factor but with a different single factor than the passwords we are all used to.

Well then I'd rather just have a password

Re: Passwordless login done right

#53

Post by MacsHeadroom »

mpatachi wrote: post #41

First of all, thanks for all the great feedback. We’ve just launched in beta and we are striving to make UNLOQ the simplest authentication system. We know that we have a long way ahead of us so we appreciate all the feedback. Here’re a few answers to the comments I’ve seen above: 1. We believe it is a two factor: something you have = your phone; something you are = you’re fingerprint (for the phones that comes with t…

Even if it is two-factor, for the reasons you described, it's all over a single channel. There is no out of band mechanism- meaning this can easily be MITM'd. UNLOQ is poor authentication security in more ways than one.

By the way, the founders of Duo Security hold the patent on completing an authentication from a smartphone. Something to keep in mind. http://www.google.com/patents/US20110219230

Re: Passwordless login done right

#54

Post by EGreg »

anaolykarpov wrote: post #50
EGreg wrote: post #46

Earlier quoted context omitted.

I have never found a good solution to the trade-off of protection against brute-force vs availability. If I disallow X requests per second then I might enable DOS attacks on a user. What if a cluster of zombie machines around the world is attempting to log in as a politician to gmail at their publicly known address? How would the politician ever get in, if login attempts are rate limited?

the rate limit can be per username/per ip address/per time period (you receive one notification once every 10 minutes), or a combination. Yes, when you have a botnet of a few thousands computers you could DoS someone. But with that in hand you can also DoS every web service on the internet (with a few exceptions)

But sometimes DoSing an individual is more effective

Re: Passwordless login done right

#55

Post by devinegan »

MacsHeadroom wrote: post #53
mpatachi wrote: post #41

First of all, thanks for all the great feedback. We’ve just launched in beta and we are striving to make UNLOQ the simplest authentication system. We know that we have a long way ahead of us so we appreciate all the feedback. Here’re a few answers to the comments I’ve seen above: 1. We believe it is a two factor: something you have = your phone; something you are = you’re fingerprint (for the phones that comes with t…

Even if it is two-factor, for the reasons you described, it's all over a single channel. There is no out of band mechanism- meaning this can easily be MITM'd. UNLOQ is poor authentication security in more ways than one. By the way, the founders of Duo Security hold the patent on completing an authentication from a smartphone. Something to keep in mind. http://www.google.com/patents/US20110219230

It looks like that patent had a final rejection in 2013. http://portal.uspto.gov/pair/PublicPair (13/039,209)

Re: Passwordless login done right

#56

Post by jasonlotito »

mpatachi wrote: post #48
jasonlotito wrote: post #44

> Well, the above scenario is not science fiction anymore. Proceeds to describe something that is not the above scenario. Secondly, this ignores the reality that phones in the hands of real users are not a reliable means of identification. People lose or change their phones all the time. Next, this creates a massive road block for users in trying to sign up. As it stands now, unloq limits itself to a single email for…

Thanks for the feedback. A few answers: "As it stands now, unloq limits itself to a single email for a single user." -> We do offer the option to create additional profiles on others email a user might have. "that phones in the hands of real users are not a reliable means of identification" -> We do agree that phones by themselves are not secure enough. Currently we do offer the option to add a secondary PIN on each…

> We do offer the option to create additional profiles on others email a user might have.

I looked at the API, and it didn't offer that feature.

> Currently we do offer the option to add a secondary PIN on each profile, but we are thinking to enforce it to the application level.

So a password.

Post reply on HN