Google security exec: 'Passwords are dead' • Hacker News Board

Re: Google security exec: 'Passwords are dead'

#51

Post by jerf » Wed, Sep 11, 2013, 6:20 PM UTC

lifeisstillgood wrote: post #43

jerf wrote: post #18

Something you know, something you have, something you are. Google may be trying to prefer something you have, but that's hardly going to kill "something you know" forever and ever. I also look forward to the silly "two-factor authentication" that involves having two "something you have"s. It'll complement my bank's silly use of two "something you know"s nicely. (Perhaps they can get together for the true security ult…

> Something you know, something you have, something you are. Excellent point - and oddly reflects a subtle point: Something you are (bio-id) is what we are asserting, and using one or both of the others to give the far point a guage of how likely fraud is. In short: * Something you are -> Username * Something you know -> Password * Something you have -> RSA fob

When it comes to security, when people refer to "something you are", they mean that distinct from the "totality of who you are" or "who you truly are" (if you can even define that). Thus, fingerprints are "something you are"... but they can still be faked, and they aren't necessarily immutable, either. They explicitly aren't talking about "who you 'really' are" because if we had a way of telling that, we would be done. We wouldn't need any of the the three factors if we simply knew who you were, magically, 100% accurately.

So, the "something you are" is still distinct from "who you really are", which is the thing we are trying to establish. (And we should have at least another two or three decades before that becomes a tricky question of its own.)

Re: Google security exec: 'Passwords are dead'

#52

Post by guard-of-terra » Wed, Sep 11, 2013, 6:24 PM UTC

Vivtek wrote: post #31

sehrope wrote: post #19

Passwords are not dead. Simple single factor authentication using short passwords is dead. That's not a new thing either and they're not going away either. Biometric implants are cool but it's a long ways away ( and I'm pretty sure I don't want anything inserted into my arm... ). Ditto for security rings and other gadgets. Yes they work but the general populace is not going to be using them for a long while. I'd love…

I'll go one further on your first paragraph: I'm pretty sure I don't want something implanted in my arm that lets Google identify me . Passwords may have insecurity - but they also permit anonymity. I think people haven't even started thinking that far yet.

But do you want something in your arm that lets you identify yourself to Google when you choose so?

Re: Google security exec: 'Passwords are dead'

#53

Post by lifeisstillgood » Wed, Sep 11, 2013, 10:05 PM UTC

jerf wrote: post #51

lifeisstillgood wrote: post #43

Earlier quoted context omitted.

> Something you know, something you have, something you are. Excellent point - and oddly reflects a subtle point: Something you are (bio-id) is what we are asserting, and using one or both of the others to give the far point a guage of how likely fraud is. In short: * Something you are -> Username * Something you know -> Password * Something you have -> RSA fob

When it comes to security, when people refer to "something you are", they mean that distinct from the "totality of who you are" or "who you truly are" (if you can even define that). Thus, fingerprints are "something you are"... but they can still be faked, and they aren't necessarily immutable, either. They explicitly aren't talking about "who you 'really' are" because if we had a way of telling that, we would be don…

who I am (my identity) is for all sensible purposes a construct of other people.

the real me sits behind my eyes. lets ignore that for current purposes.

my identity then is what other people chose to use to distinguish me from the other seven billion on the planet. mostly we used faces, and became real good at recognising them. then we moved to using names because there were so many of us.

but it is still notable that who I am (Paul) is really just a shorthand for other people's convenience. if I was the only human on the planet I would have no use for a name but everything about me otherwise would still be unchanged

in short who I am is my "identity" and that is just an assertion to help you tell me from the guy next door. Who I am is my name (if you are on the telephone) or my face if we are in the pub, or my DNA if you are in CSI. none of those things are to do with the quale of being Paul - but they are useful for other people.

make sense?

I'm saying that don't call into the trap of thinking that if there was some way to determine who I am really, the we could get rid of passwords. who I am really is a quale in my head and no use to anyone else - so instead we find ways to distinguish bags of meat and call it identity

Re: Google security exec: 'Passwords are dead'

#54

Post by zobzu » Fri, Sep 13, 2013, 8:57 AM UTC

nyrina wrote: post #8

zobzu wrote: post #4

Earlier quoted context omitted.

According to the article, she did say exactly those words: "password are dead" "passwords are done at Google" "our relationship with passwords are done" Then they go on about how they're experimenting with hardware tokens and stuff, and how all startup should be solving that for them now. It looks like PR to me, and it also looks like Google has lost it's soul. Obviously, passwords are far from dead. It's wishful thi…

What are these many superior technical solutions you speak of? Care to give any examples of such?

care, nope. if nicely asked.. :P

basically you can have an ECDSA or RSA key pair and store the private key locally, either in a PGP smartcard (which can really be just a USB stick), or more conveniently into a piece of clothing that use some sort of NFC to transmit the data.

again, the yubikey neo does that (using NFC) but with OTPs for example.