Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

theregister.co.uk

Post reply on HN
Print view View original

41–50 of 58 posts

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#41

Post by rietta »

EGreg wrote: post #22
reitanqild wrote: post #16

Earlier quoted context omitted.

> What if the salt was derived from a key the user had to supply and wasn't stored anywhere? If I understood you that is the same as demanding the user to input two strings for password authentication, one for salt and one for password, in which case you might just as well require the user to use a longer password.

Good point. Why do we have passwords anyway? Just to authenticate at unanticipated access points? We could always just do two-factor authentication for that. A code would be sent to Google Authenticator on your phone or something like that, encrypted with your public key, and you'd just decrypt it with your private key. The phone would be secured with your password or fingerprint, which is never sent anywhere. The co…

Because usernames and passwords can be implemented without reliance on 3rd party infrastructure and they are culturally accepted and understood - however poorly - by everyone. We're still using 80 character lines in programming because of IBM punch card design from 1928. Similarly, I doubt the password will completely go away within our grandchildren's lifetimes. That said, our mobile devices are likely to play an increasing role in authentication for everyday activities.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#44

Post by tlrobinson »

astazangasta wrote: post #42

Can someone explain to me why we are still using passwords? It's not like we don't have better technology. Why can't I just authenticate everywhere with a signed token? What's standing in the way of this?

Passwords are simple and convenient. Everyone basically understands how they work, and you can keep them in your head (not that you should).

EDIT: I'm not saying passwords are ideal, just giving context as to why they haven't been replaced.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#45

Post by ericzawo »

astazangasta wrote: post #42

Can someone explain to me why we are still using passwords? It's not like we don't have better technology. Why can't I just authenticate everywhere with a signed token? What's standing in the way of this?

Isn't the general stance that this is too new and scary for the average user?

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#46

Post by andrewstuart2 »

astazangasta wrote: post #42

Can someone explain to me why we are still using passwords? It's not like we don't have better technology. Why can't I just authenticate everywhere with a signed token? What's standing in the way of this?

Well, for one, the fact that your private key can be copied without you knowing it. At least for now, the only guaranteed read-only-for-owner storage is our brain.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#47

Post by astazangasta »

ericzawo wrote: post #45
astazangasta wrote: post #42

Can someone explain to me why we are still using passwords? It's not like we don't have better technology. Why can't I just authenticate everywhere with a signed token? What's standing in the way of this?

Isn't the general stance that this is too new and scary for the average user?

How about giving it a shot, at least? Can I even authenticate with Facebook or Gmail using a secure token? - as far as I know I can't. At least make it possible for the savvy user, and let the average user catch up as usability improves.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#48

Post by astazangasta »

tlrobinson wrote: post #44
astazangasta wrote: post #42

Can someone explain to me why we are still using passwords? It's not like we don't have better technology. Why can't I just authenticate everywhere with a signed token? What's standing in the way of this?

Passwords are simple and convenient. Everyone basically understands how they work, and you can keep them in your head (not that you should ). EDIT: I'm not saying passwords are ideal, just giving context as to why they haven't been replaced.

Passwords are NOT simple and convenient, they are cumbersome and hard-to-remember, cause huge security problems, and are basically only standing on top of the crutch of email forgot-your-password systems.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#50

Post by astazangasta »

andrewstuart2 wrote: post #46
astazangasta wrote: post #42

Can someone explain to me why we are still using passwords? It's not like we don't have better technology. Why can't I just authenticate everywhere with a signed token? What's standing in the way of this?

Well, for one, the fact that your private key can be copied without you knowing it. At least for now, the only guaranteed read-only-for-owner storage is our brain.

You can easily build a secure token machine that prevents this possibility. And compare this to the huge hole of having millions of people with the password 'password', the possibility of someone occasionally having their secret key stolen seems significantly less damaging.
Post reply on HN