Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google security exec: 'Passwords are dead'

news.cnet.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: Google security exec: 'Passwords are dead'

#21

Post by XorNot »

mstrem wrote: post #14
hawkharris wrote: post #7

I was thinking about password alternatives recently because I was designing a website just for friends and family. I wanted enough security to keep out strangers on the Web, but I didn't want to make people I know memorize a lengthy password. So I came up with a photo that fills up the screen. A small, invisible grid covers the photo, and the user has to click the image in a special sequence in order to unlock the ne…

There is a start up in the UK trying to do something very simlar: http://pixelpin.co.uk/

I hope it doesn't catch on. I do use a password manager, and anything which doesn't let me copy+paste is just a huge hassle.

Re: Google security exec: 'Passwords are dead'

#23

Post by walden42 »

sehrope wrote: post #19

Passwords are not dead. Simple single factor authentication using short passwords is dead. That's not a new thing either and they're not going away either. Biometric implants are cool but it's a long ways away ( and I'm pretty sure I don't want anything inserted into my arm... ). Ditto for security rings and other gadgets. Yes they work but the general populace is not going to be using them for a long while. I'd love…

> Don't login to anything from other people's computers (net cafe, shared computer in a hotel, etc)

Even over SSL connections?

Re: Google security exec: 'Passwords are dead'

#24

Post by mscarborough »

noptic wrote: post #22

And still there are "modern" games and services telling me that my password "May only contain letters and numbers" Really? Are you stupid or something?

Even Wells Fargo did/does this as well, and limited password length. At least when I still had an account with them.

Re: Google security exec: 'Passwords are dead'

#26

Post by herge »

walden42 wrote: post #23
sehrope wrote: post #19

Passwords are not dead. Simple single factor authentication using short passwords is dead. That's not a new thing either and they're not going away either. Biometric implants are cool but it's a long ways away ( and I'm pretty sure I don't want anything inserted into my arm... ). Ditto for security rings and other gadgets. Yes they work but the general populace is not going to be using them for a long while. I'd love…

> Don't login to anything from other people's computers (net cafe, shared computer in a hotel, etc) Even over SSL connections?

It's not the connection, it's the browser, the keylogger on the os, the screencapture software they might have installed, etc.

Re: Google security exec: 'Passwords are dead'

#27

Post by jebblue »

guard-of-terra wrote: post #5

Passwords are long overdue, it's a walking carcass. Hard for users to remember, trivial to intercept, easy to lose, not hard to guess.

There are tricks you can use to remember a strong password. As far as "trivial to intercept, easy to lose, not hard to guess", the point is mute over the network as long as the target system uses something like iptables rate limiting or MaxAuthRetries and LoginGraceTime in SSH.

If it's a local resource only then all an attacker needs is time and computing resources, but, that's true for key based authentication too.

Re: Google security exec: 'Passwords are dead'

#28

Post by sehrope »

walden42 wrote: post #23
sehrope wrote: post #19

Passwords are not dead. Simple single factor authentication using short passwords is dead. That's not a new thing either and they're not going away either. Biometric implants are cool but it's a long ways away ( and I'm pretty sure I don't want anything inserted into my arm... ). Ditto for security rings and other gadgets. Yes they work but the general populace is not going to be using them for a long while. I'd love…

> Don't login to anything from other people's computers (net cafe, shared computer in a hotel, etc) Even over SSL connections?

Yes even over SSL connections. You don't know if the other person's computer itself is compromised (e.g. key logger). Rather then instruct a not-so-tech-savvy person to make the decision of whether computer X is trustworthy the defacto default is "No it's not, don't use it".

In practice this doesn't really limit folks too much as how often do you really need to login from somebody else's computer? Can it seriously not wait till later?

Re: Google security exec: 'Passwords are dead'

#29

Post by ds9 »

JeffJenkins wrote: post #2

This article is about how two-factor authentication is great and should be used everywhere. It is not about passwords going away.

Maybe I'm too cynical (is that possible about csec anymore?), but as soon as I saw this line from Google, I thought "oh right, it'll be something to get Google inserted into every login interaction".

Well, not quite yet it seems, but this may be part of the set-up for it.

Re: Google security exec: 'Passwords are dead'

#30

Post by unethical_ban »

walden42 wrote: post #23
sehrope wrote: post #19

Passwords are not dead. Simple single factor authentication using short passwords is dead. That's not a new thing either and they're not going away either. Biometric implants are cool but it's a long ways away ( and I'm pretty sure I don't want anything inserted into my arm... ). Ditto for security rings and other gadgets. Yes they work but the general populace is not going to be using them for a long while. I'd love…

> Don't login to anything from other people's computers (net cafe, shared computer in a hotel, etc) Even over SSL connections?

Not talking your own laptop at Starbucks. Don't use a rented machine.
Post reply on HN