I used to control the passwords manually, but now I just rely on the Firefox password manager. I have it on my notebooks and in my smartphone, it syncs all the passwords, generates them and that's basically all I need. It completely abstracted the password handling away from me, and I have not types a password manually for quite some time. I hope that it's safe.
Passwords Are Fine
41–50 of 169 posts
Re: Passwords Are Fine
#42Earlier quoted context omitted.
If you use an authentication app instead of SMS 2FA (which you should anyway), you don’t need cell service. You can even have the authentication app on your laptop so you don’t need to switch devices (1Password at least supports this).
Lots of services do not offer that ability, especially when signing up.
I have never had a problem with Authy in that regard.
Yeah, I share my 2fa with every device and defy the purpose. I know. But if you have access to any of my devices I sm already compromised.
Re: Passwords Are Fine
#43Earlier quoted context omitted.
If you use an authentication app instead of SMS 2FA (which you should anyway), you don’t need cell service. You can even have the authentication app on your laptop so you don’t need to switch devices (1Password at least supports this).
Lots of services do not offer that ability, especially when signing up.
Sure, I was just pointing out a clarification for GP since a lot of people aren’t actually aware that you can use 2FA without an internet-connected device. Maybe they already knew it, maybe not.
Re: Passwords Are Fine
#44I want whatever solution that my parents, wife and coworkers will actually use so I don’t have to help them.
I try to explain that if they’d just commit to using a password manager, they just won’t have to think about it anymore, but it’s like pulling teeth.
I’m sure one day we’ll have some sort of standard that replaces passwords (maybe it’ll be passkey) but until then I’m prepared for the continued death by a thousand cuts of password related IT.
Re: Passwords Are Fine
#45The argument that passwords are acceptable as long as everyone practices good "hygiene" strikes me as having many parallels with the argument that C code is memory safe as long as it is written properly. I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it.
> I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it. It's a hard problem. I don't think passkeys really are the solution long term, they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately.
> they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately.
Can you expand on these 2 points? I'm still trying to wrap my head around passkeys and these are some of the arguments I see around but never quite explained.
Re: Passwords Are Fine
#46Earlier quoted context omitted.
International SMS delivery is unreliable. Unreliable is not strong enough word. It more often doesn't work that it does. Or it works with enough of a delay to cause a timeout on the site where you want to login. Plus, you know, SMS hijacking and all that.
Where do you travel? Because I've gotten international text in dozens of countries in different continents with no problem. Delays I've seen (but also sometimes I also see them in my home country). Usually trying 1-2 times more it gets in time.
It's nice that you were lucky enough for it to work reliably, but it's not a universal experience.
Re: Passwords Are Fine
#47Earlier quoted context omitted.
I don't despise all inconvenient things. I don't mind carrying house keys. It's just a question of whether you value the security enough to make it worthwhile.
> I don't mind carrying house keys. House keys are a minimal inconvenience because the lock on your front door also affords minimal security. Just ask the Lock Picking Lawyer how long it would take a determined intruder to get into your home, whether by picking, force, or finding a weakness such as open window. If your home had high security, I can guarantee that you'd feel the inconvenience.
You can have a very secure facility that only uses a "house key"-style entry flow for the user. The key will look really weird (see Medeco and Evva for examples) and the building will have some design compromises - few entry points, no openable windows, etc.
A password, in theory, could work the same way. Except that the normal password UX involves people remembering the password, which entails a huge security compromise.
Re: Passwords Are Fine
#48> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service . ChatGPT that everyone is spamming on every discussion? I can't eve…
> it seems like a dangerous crutch than a useful technology Not to sidetrack, but could you expound further? I struggle to reach the blanket conclusion of “not useful”. I don’t really see how it’s a crutch, more than any other assistance tool like Google, StackOverflow, code-completion or actual docs. Hallucination is a separate problem, which is solved by using fine-tuned models.
[dead]
Re: Passwords Are Fine
#49passwords are not fine.
my user agent should do otp on my behalf with clean, hassle free and reliable ux. my secrets should auto-rotate on a regular schedule and i should be able to force a rotation at any time in the event of a compromise. the existence of a relationship between myself and any party i wish to authenticate with, or knowledge of authentication events shall remain private between myself and that party exclusively. in the event of a catastrophic loss of control over my digital identity, i should be able to work with a partner to quickly prove my physical identity and regain access to my digital one.
Re: Passwords Are Fine
#50Earlier quoted context omitted.
Lots of services do not offer that ability, especially when signing up.
I have never had a problem with Authy in that regard. Yeah, I share my 2fa with every device and defy the purpose. I know. But if you have access to any of my devices I sm already compromised.
You are not if you use 2FA.