Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SQRL - Replacement for usernames and passwords

grc.com

Post reply on HN
Print view View original

91–100 of 138 posts

Re: SQRL - Replacement for usernames and passwords

#91

Post by ds9 »

peterwwillis wrote: post #72

Here's why this is stupid: This is 1-factor authentication, but it's actually LESS secure than a username and password. A password is something you know - it's in your head, so it can only be stolen if you save it somewhere, or if there's malware on your computer sniffing it. The tokens in the phone are saved in the phone, so if you lose the phone, you've just lost your password/set of keys. On top of that, malware i…

The user is vulnerable, not only to "malware" but also to the phone vendor (and anyone the vendor enables, notably government). The degree of control one can attain over a phone or tablet is much less than on a general-purpose PC, and the latter is hard enough to relatively secure. Smartphones are captive, remote-controllable devices and as such are not trustworthy for secure communications or any important secrets.

This fact, together with grc's implications that the scheme is novel, important or secure, supports the derisive view of the author in the sub-thread above. Also check out the stylistic buffoonery on his site.

Re: SQRL - Replacement for usernames and passwords

#92

Post by peterwwillis »

nly wrote: post #80
peterwwillis wrote: post #72

Here's why this is stupid: This is 1-factor authentication, but it's actually LESS secure than a username and password. A password is something you know - it's in your head, so it can only be stolen if you save it somewhere, or if there's malware on your computer sniffing it. The tokens in the phone are saved in the phone, so if you lose the phone, you've just lost your password/set of keys. On top of that, malware i…

No, it's two factor. If you look at the crypto page the scheme he proposes uses an 'identity password' in combination with a strong KDF (scrypt). The resulting hash is XOR'd against the masked master device key.

Do you enter the identity password each time you scan a qr code? If not, it's still one factor. Even if you can enter it each time you scan, it's still only on the phone, making it the same if not less secure than doing it all on your desktop.

Re: SQRL - Replacement for usernames and passwords

#93

Post by city41 »

pbreit wrote: post #79
habosa wrote: post #57

This looks like a much less polished version of Clef ( https://getclef.com/ ). Clef is a really awesome app and they're already powering this type of integration for a few hundred websites. One of the founders is an HN regular, although I can't remember his username (Jesse, reply if you see this).

Using this type of technique (Clef and SQRL) on every login sounds like a particularly evil version of hell.

I have found 1Password to be pretty hellish, and I don't even consider not using a password manager an option anymore. So clef and SQRL sound great to me.

Re: SQRL - Replacement for usernames and passwords

#94

Post by gcr »

hamburglar wrote: post #42
richardjs wrote: post #19

Earlier quoted context omitted.

Not to use a debate cliché, but isn't this a ridiculously shameless ad hominem? He's published the protocol and disavowed any intellectual property claim to it. Let's focus on critiquing the protocol.

Personally, even if the design is ok, I don't care to give this chucklehead any publicity. Maybe the blind squirrel found a nut (see what I did there? SQRL?) by getting a design right. Doesn't mean it's anything particularly clever, or that we should use it and give him something to base his incessant self-promotion on for the next 20 years.

For not wanting to give Gibson any publicity, you sure are talking about him a lot.

note that i am not affiliated with grc, my name is simply permuted :)

Re: SQRL - Replacement for usernames and passwords

#95

Post by gcr »

ds9 wrote: post #91
peterwwillis wrote: post #72

Here's why this is stupid: This is 1-factor authentication, but it's actually LESS secure than a username and password. A password is something you know - it's in your head, so it can only be stolen if you save it somewhere, or if there's malware on your computer sniffing it. The tokens in the phone are saved in the phone, so if you lose the phone, you've just lost your password/set of keys. On top of that, malware i…

The user is vulnerable, not only to "malware" but also to the phone vendor (and anyone the vendor enables, notably government). The degree of control one can attain over a phone or tablet is much less than on a general-purpose PC, and the latter is hard enough to relatively secure. Smartphones are captive, remote-controllable devices and as such are not trustworthy for secure communications or any important secrets.…

If you have ever typed your password into your phone, your password is vulnerable to the exact same attacks (keyloggers, caching, ...) you mention.

note that i am not affiliated with grc; my name is permuted :)

Re: SQRL - Replacement for usernames and passwords

#96

Post by nly »

I think you can MITM this by presenting legitimate (proxied) ycombinator.com QR codes on e.g. ycombigator.com.

The app would still authenticate to the legitimate site and then 'activate' the session, and ycombigator.com could have at it. HTTPS won't help either. The problem is there's no way for the phone app to transfer additional secure session cookies back to your desktop browser, so this has to be the case.

Sure, the app will display the legitimate domain or URL but the user probably thinks that's what they're viewing on their desktop anyway, so will likely accept.

Requires mutual authentication.

Re: SQRL - Replacement for usernames and passwords

#97

Post by gcr »

anateus wrote: post #34
diminoten wrote: post #29

Earlier quoted context omitted.

It's still an ad hominem - the merits of his argument should stand independent to who he is or his history on any topic. Doesn't mean it's not worth talking about, though. After all, science is entirely founded on a kind of inductive reasoning, so logical fallacies aren't crazy to consider.

Note: https://yourlogicalfallacyis.com/ad-hominem Gibson's personality isn't the thing in question here, the quotation above is specifically about his history in security. If the comment was about how he's a major asshole (just an example, I'm not saying that) in conferences or something like that, it would be an ad hominem, as that sort of information would not be relevant.

How is the quote about his history? It provides none of the following:

- Examples of Gibson's previous ideas that have been proven fake

- Examples of Gibson's previous projects that have security flaws

- Examples of projects that Gibson is purported to "peddle" through his "snake oil salesmanship"

- A quotable, referrable, expert opinion of Gibson's standing, or lack thereof, in the broader security community

The post includes none of those things. It is no better than saying "$NAME is a bad person!"; it merely uses more words to say so.

note that i am not affiliated with grc; my name is permuted :)

Re: SQRL - Replacement for usernames and passwords

#98

Post by gcr »

nly wrote: post #96

I think you can MITM this by presenting legitimate (proxied) ycombinator.com QR codes on e.g. ycombigator.com. The app would still authenticate to the legitimate site and then 'activate' the session, and ycombigator.com could have at it. HTTPS won't help either. The problem is there's no way for the phone app to transfer additional secure session cookies back to your desktop browser, so this has to be the case. Sure,…

This attack can be stopped by referer checking. A site that hosts a QR code should display a warning instead of the QR code if the referer doesn't match.

Re: SQRL - Replacement for usernames and passwords

#99

Post by diminoten »

anateus wrote: post #34
diminoten wrote: post #29

Earlier quoted context omitted.

It's still an ad hominem - the merits of his argument should stand independent to who he is or his history on any topic. Doesn't mean it's not worth talking about, though. After all, science is entirely founded on a kind of inductive reasoning, so logical fallacies aren't crazy to consider.

Note: https://yourlogicalfallacyis.com/ad-hominem Gibson's personality isn't the thing in question here, the quotation above is specifically about his history in security. If the comment was about how he's a major asshole (just an example, I'm not saying that) in conferences or something like that, it would be an ad hominem, as that sort of information would not be relevant.

He can be as wrong as he wants to be on all other topics of security, but that has zero relevance to whether or not he's right about this.

So yes, regardless of what your link says, the argument is an ad hominem.

Re: SQRL - Replacement for usernames and passwords

#100

Post by anateus »

gcr wrote: post #97
anateus wrote: post #34

Earlier quoted context omitted.

Note: https://yourlogicalfallacyis.com/ad-hominem Gibson's personality isn't the thing in question here, the quotation above is specifically about his history in security. If the comment was about how he's a major asshole (just an example, I'm not saying that) in conferences or something like that, it would be an ad hominem, as that sort of information would not be relevant.

How is the quote about his history? It provides none of the following: - Examples of Gibson's previous ideas that have been proven fake - Examples of Gibson's previous projects that have security flaws - Examples of projects that Gibson is purported to "peddle" through his "snake oil salesmanship" - A quotable, referrable, expert opinion of Gibson's standing, or lack thereof, in the broader security community The pos…

OK, mild correction, the quote itself doesn't really contain those, but the link from which it was taken does.

Attrition is itself the "expert opinion" of Gibson's standing, here's their Wikipedia page for more information: http://en.wikipedia.org/wiki/Attrition.org

Post reply on HN