Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords Are Fine

herman.bearblog.dev

Post reply on HN
Print view View original

21–30 of 169 posts

Re: Passwords Are Fine

#21

Post by [deleted] »

hulitu wrote: post #9
jlmb wrote: post #4

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method. I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

> so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?

[deleted]

Re: Passwords Are Fine

#22

Post by stevage »

k8sToGo wrote: post #10
stevage wrote: post #7

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

Of course you despise it. Security always comes at the cost of convenience.

I don't despise all inconvenient things. I don't mind carrying house keys. It's just a question of whether you value the security enough to make it worthwhile.

Re: Passwords Are Fine

#23

Post by jlmb »

stevage wrote: post #7

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

But you can also use passkeys from a computer, no separate mobile device needed!

And for services (like AWS) that don't (yet) support passkeys, a hardware token like a YubiKey is also an option.

Re: Passwords Are Fine

#24

Post by creshal »

figbert wrote: post #20

The argument that passwords are acceptable as long as everyone practices good "hygiene" strikes me as having many parallels with the argument that C code is memory safe as long as it is written properly. I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it.

> I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it.

It's a hard problem. I don't think passkeys really are the solution long term, they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately.

Re: Passwords Are Fine

#25

Post by dspillett »

foobarbecue wrote: post #3
bkishan wrote: post #2

Of course passwords are fine. What's not fine is getting billions of people to change their behavior and switch to and use a password manager (that's not chrome). You could even argue passwords are better than passkeys for those with strong password hygiene. However when it to the masses, the convenience-security tradeoff of something like passkeys is always going to be better. And for the nerds and geeks, passwords…

Why not chrome?

Not sure if it is what the GPP is referring to, but I prefer to keep a larger gap between my browser and password manager to reduce the potential spread of difficulties if the browser falls foul of a security vulnerability. The risk of this happening is of course small, it would require significant bugs in a couple of different places, but the potential damage is high. Firefox's password manager, or those built into any other web UAs, I'd be wary of for the same reason rather than it being specifically an anti-chrome thing.

An air gap would be preferable still, as that would protect from similar issues at the OS level, but that is another step or few into less practical (well, significantly more inconvenient) territory. I at least have my master password on a USB device (and backed up by other physical means in case that dies) which is only plugged in when needed, that is effectively an air gap when I don't leave the password manager unlocked between uses.

Re: Passwords Are Fine

#26

Post by NoZebra120vClip »

stevage wrote: post #22
k8sToGo wrote: post #10

Earlier quoted context omitted.

Of course you despise it. Security always comes at the cost of convenience.

I don't despise all inconvenient things. I don't mind carrying house keys. It's just a question of whether you value the security enough to make it worthwhile.

> I don't mind carrying house keys.

House keys are a minimal inconvenience because the lock on your front door also affords minimal security. Just ask the Lock Picking Lawyer how long it would take a determined intruder to get into your home, whether by picking, force, or finding a weakness such as open window.

If your home had high security, I can guarantee that you'd feel the inconvenience.

Re: Passwords Are Fine

#27

Post by riffraff »

stevage wrote: post #7

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

> I hate having to keep my phone with me while I work

I use a desktop app for most time based authentication tokens, there are plenty that sync up across mobile and desktop.

Re: Passwords Are Fine

#28

Post by blackhaz »

highwaylights wrote: post #15
stevage wrote: post #7

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

But MFA is not supposed to replace your password. It’s in addition to it, and if it’s implemented correctly, only on new devices. Once you’ve done the second factor dance on a new device once, and assuming the MFA setup has been done well, you shouldn’t need to reach for the MFA code again (at least, not often).

In reality, the vast majority of services ignore that principle and MFA is a never-ending daily nightmare. It feels like I can't even take a leak without the phone now.

Re: Passwords Are Fine

#29

Post by coldtea »

4ad wrote: post #12
wheybags wrote: post #5

> My bank only supports SMS 2FA so while I'm travelling I'm effectively cut off from certain functionality EU citizen here. Do you... not have roaming?

International SMS delivery is unreliable. Unreliable is not strong enough word. It more often doesn't work that it does. Or it works with enough of a delay to cause a timeout on the site where you want to login. Plus, you know, SMS hijacking and all that.

Where do you travel? Because I've gotten international text in dozens of countries in different continents with no problem. Delays I've seen (but also sometimes I also see them in my home country). Usually trying 1-2 times more it gets in time.

Re: Passwords Are Fine

#30

Post by MrVandemar »

> 2. People don't have their phone on them all the time (and some don't even have a smartphone).

I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service.

ChatGPT that everyone is spamming on every discussion? I can't even sign up for it (I'm not really bothered about that; it seems like a dangerous crutch than a useful technology).

The problem is the developers have smartphones, their friends have smartphones, their bosses have smartphones and their clients have smartphones. Everyone they know have smartphones and live in places with reception. So they don't or can't imagine something different.

Post reply on HN