Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

theregister.co.uk

Post reply on HN
Print view View original

51–58 of 58 posts

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#51

Post by nowen »

EGreg wrote: post #22
reitanqild wrote: post #16

Earlier quoted context omitted.

> What if the salt was derived from a key the user had to supply and wasn't stored anywhere? If I understood you that is the same as demanding the user to input two strings for password authentication, one for salt and one for password, in which case you might just as well require the user to use a longer password.

Good point. Why do we have passwords anyway? Just to authenticate at unanticipated access points? We could always just do two-factor authentication for that. A code would be sent to Google Authenticator on your phone or something like that, encrypted with your public key, and you'd just decrypt it with your private key. The phone would be secured with your password or fingerprint, which is never sent anywhere. The co…

Google authenticator is only one-factor, possession of the shared secret in the phone. That's why it requires 'two-steps'.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#53

Post by dragonwriter »

astazangasta wrote: post #42

Can someone explain to me why we are still using passwords? It's not like we don't have better technology. Why can't I just authenticate everywhere with a signed token? What's standing in the way of this?

> Can someone explain to me why we are still using passwords?

Because, generally username/password remains the least-bad primary method we have for most uses, and most other methods work best as secondary methods with that rather than replacements.

> It's not like we don't have better technology.

Yes, it is.

> Why can't I just authenticate everywhere with a signed token?

Because, unless they are accompanied by (or secured on the user end by) passwords, signing keys that enable that are more prone to theft, whether by copying (if they aren't kept in a hardware device designed to prevent that) or by theft of the device they are in.

Which is why that mechanism is usually used as a second-factor with passwords for systems needing additional security, rather than a replacement for passwords.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#54

Post by tlrobinson »

astazangasta wrote: post #48
tlrobinson wrote: post #44

Earlier quoted context omitted.

Passwords are simple and convenient. Everyone basically understands how they work, and you can keep them in your head (not that you should ). EDIT: I'm not saying passwords are ideal, just giving context as to why they haven't been replaced.

Passwords are NOT simple and convenient, they are cumbersome and hard-to-remember, cause huge security problems, and are basically only standing on top of the crutch of email forgot-your-password systems.

Yes, good passwords are hard to remember, and bad or reused passwords are a security risk, but conceptually passwords are way simpler and more convenient than the alternatives, for the average user.

All I need to login from any device in the world is my password. As soon as you introduce tokens or private keys or whatever you need something to securely store that, most likely protected by... a password.

I can imagine some crazy implant + biometric authentication scheme but we're a long ways off from that sort of thing being universally accepted.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#55

Post by EGreg »

nowen wrote: post #51
EGreg wrote: post #22

Earlier quoted context omitted.

Good point. Why do we have passwords anyway? Just to authenticate at unanticipated access points? We could always just do two-factor authentication for that. A code would be sent to Google Authenticator on your phone or something like that, encrypted with your public key, and you'd just decrypt it with your private key. The phone would be secured with your password or fingerprint, which is never sent anywhere. The co…

Google authenticator is only one-factor, possession of the shared secret in the phone. That's why it requires 'two-steps'.

Well, the password on the phone is the other factor. No need to send the password anywhere.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#56

Post by astazangasta »

tlrobinson wrote: post #54
astazangasta wrote: post #48

Earlier quoted context omitted.

Passwords are NOT simple and convenient, they are cumbersome and hard-to-remember, cause huge security problems, and are basically only standing on top of the crutch of email forgot-your-password systems.

Yes, good passwords are hard to remember, and bad or reused passwords are a security risk, but conceptually passwords are way simpler and more convenient than the alternatives, for the average user. All I need to login from any device in the world is my password. As soon as you introduce tokens or private keys or whatever you need something to securely store that, most likely protected by... a password. I can imagine…

I keep an ssh key on a USB drive on my keychain. The physical analogy to a key is easy to grasp and totally appropriate. You don't expect to get into your house without your keys; similarly, if we turn the key into a physical object on your person, we can build off an existing habit. I don't think this should be terribly difficult.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#57

Post by andrewstuart2 »

astazangasta wrote: post #50
andrewstuart2 wrote: post #46

Earlier quoted context omitted.

Well, for one, the fact that your private key can be copied without you knowing it. At least for now, the only guaranteed read-only-for-owner storage is our brain.

You can easily build a secure token machine that prevents this possibility. And compare this to the huge hole of having millions of people with the password 'password', the possibility of someone occasionally having their secret key stolen seems significantly less damaging.

True, but a token machine only serves to identify the token machine, which presumably is only held by the person it identifies. I think my point is that at a fundamental level, identity is internal, tied to a person's mind/soul/etc. Anything external is fundamentally a supplemental identifier.

People lose things, steal things, etc. but you cannot (as of yet) steal someone's thoughts.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#58

Post by astazangasta »

andrewstuart2 wrote: post #57
astazangasta wrote: post #50

Earlier quoted context omitted.

You can easily build a secure token machine that prevents this possibility. And compare this to the huge hole of having millions of people with the password 'password', the possibility of someone occasionally having their secret key stolen seems significantly less damaging.

True, but a token machine only serves to identify the token machine, which presumably is only held by the person it identifies. I think my point is that at a fundamental level, identity is internal, tied to a person's mind/soul/etc. Anything external is fundamentally a supplemental identifier. People lose things, steal things, etc. but you cannot (as of yet) steal someone's thoughts.

No, but you can obviously steal passwords, so what's the point?
Post reply on HN