4 ms·

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would requi

by CHY872 11y ago

No. They are not superior to passwords - they merely provide different tradeoffs. For example, the site that requires your hypothetical key-type key would require that either all of their customers have spent money on such a key (bad) or that they are willing to pay for keys for all of their customers. This is something that has been thought about in detail - see https://vtllf.org/blog/ssh-web-sign-in/quest-to-replace-passwords.png https://vtllf.org/blog/ssh-web-sign-in/quest-to-replace-pass... for Stajano's analysis.

xixixao 11y ago
More importantly, you just replaced the problems of virtual keys with the problems of physical keys: you can lose them. Recovery is much more difficult than recovery of a virtual key.
- danieldk 11y ago
  With keys such as a U2F key, you can use it for multiple sites (each site will have a site-specific keypair). Most sites allow you to associate multiple U2F keys as well. Since U2F keys typically cost 7 to 15 Euro, it's really not much of a problem to buy one for use and to put one as a backup in a fire-proof safe. That said, I think it's bad to rely on one factor. If the key gets stolen, security is compromised. The combination of a password and a security token is far more secure. People should just stop memorizing passwords for every site and e.g. use a password manager.
  - netheril96 11y ago
    People in developing countries probably won't ever buy a U2F key. 7 to 15 Euros are too expensive for them (and me).
    - codedokode 11y ago
      U2F looks very promising. The prices will probably go down as the standard will get adopted and there will be more competition.
    - CydeWeys 11y ago
      A lot of banks already give them away to their customers because the hardware costs are less than the fraud costs associated with compromised accounts. And in an ideal world, said keys would be general use, not just for logging into the bank's site.
- codedokode 11y ago
  To steal a physical key you need to find a person and make him give you the key (and tell a PIN code if it is protected). It is hard to do on a large scale and you probably get beaten or go to jail soon. And passwords can be stolen remotely using trojan software. You won't even know whether your password was compromized. I agree the recovery can be a problem but there probably are ways to solve it.
- JoeAltmaier 11y ago
  Really? You don't lose (forget) virtual keys? It's a far worse problem. A physical key can always be found if you look hard enough. A virtual key can truly be lost forever.
  - pavel_lishin 11y ago
    "Aha! I found it! It was in my pants' pocket! Which was in the dryer! And before that, in the washer! And before that, in that puddle!"
  - citruspi 11y ago
    > A virtual key can truly be lost forever. Sure, but it's super easy to make backups of virtual keys. It's a digital file - just copy it. Worried one backup isn't enough? Make a million. Space is cheap.
    - JoeAltmaier 11y ago
      Ok, but that makes is harder, not easier, to manage virtual keys. And the more copies, the weaker the key (the easier to find). A million is a terrible, terrible idea. No, I despise passwords. The whole scheme is backwards. I don't want to authenticate myself to the server; I want to authenticate the server to me. Why doesn't it provide the password, and my computer verify it? Why is a fallible human being in this game at all?
      - citruspi 11y ago
        > A million is a terrible, terrible idea. Well, yeah. That was a hyperbole. I didn't actually mean that you should go out and make a million copies of your key. It simply meant to show that it's easier to prevent the loss of a virtual key than it is to prevent the loss of the physical key. > The whole scheme is backwards. I don't want to authenticate myself to the server; I want to authenticate the server to me. That's... interesting. My first thought when I read that is that the server is the one with your data and multiple users - so it needs to authenticate you to make sure that you only access your data and don't gain access to other users' data. A server authenticating itself with you would tell you that you're actually talking to XYZ and not an imposter, but once that authentication took place you'd have access to everything on that server. Including other users' data. How do you imagine this working?
codedokode 11y ago
If there were an open source protocol you could use software emulator and pay nothing (if you don't care about security).
- drdaeman 11y ago
  There is, it's called TLS, the same one that's used in HTTPS ;) But, sadly, it's not usable. See my reply to grandparent comment.
qiemem 11y ago
What about fingerprints? You don't need to buy anything, phones and such are already coming out with fingerprint readers and the technology is improving all the time. Finally, you can't lose your finger print (except in the case of extreme accidents, which exist for any type of security).
- M2Ys4U 11y ago
  Fingerprints are usernames, not passwords. You can't lose your fingerprint, but you can't replace it either - so what happens when somebody clones it?

by CHY872 11y ago

xixixao 11y ago

More importantly, you just replaced the problems of virtual keys with the problems of physical keys: you can lose them. Recovery is much more difficult than recovery of a virtual key.

danieldk 11y ago
With keys such as a U2F key, you can use it for multiple sites (each site will have a site-specific keypair). Most sites allow you to associate multiple U2F keys as well. Since U2F keys typically cost 7 to 15 Euro, it's really not much of a problem to buy one for use and to put one as a backup in a fire-proof safe. That said, I think it's bad to rely on one factor. If the key gets stolen, security is compromised. The combination of a password and a security token is far more secure. People should just stop memorizing passwords for every site and e.g. use a password manager.
- netheril96 11y ago
  People in developing countries probably won't ever buy a U2F key. 7 to 15 Euros are too expensive for them (and me).
  - codedokode 11y ago
    U2F looks very promising. The prices will probably go down as the standard will get adopted and there will be more competition.
  - CydeWeys 11y ago
    A lot of banks already give them away to their customers because the hardware costs are less than the fraud costs associated with compromised accounts. And in an ideal world, said keys would be general use, not just for logging into the bank's site.
codedokode 11y ago
To steal a physical key you need to find a person and make him give you the key (and tell a PIN code if it is protected). It is hard to do on a large scale and you probably get beaten or go to jail soon. And passwords can be stolen remotely using trojan software. You won't even know whether your password was compromized. I agree the recovery can be a problem but there probably are ways to solve it.
JoeAltmaier 11y ago
Really? You don't lose (forget) virtual keys? It's a far worse problem. A physical key can always be found if you look hard enough. A virtual key can truly be lost forever.
- pavel_lishin 11y ago
  "Aha! I found it! It was in my pants' pocket! Which was in the dryer! And before that, in the washer! And before that, in that puddle!"
- citruspi 11y ago
  > A virtual key can truly be lost forever. Sure, but it's super easy to make backups of virtual keys. It's a digital file - just copy it. Worried one backup isn't enough? Make a million. Space is cheap.
  - JoeAltmaier 11y ago
    Ok, but that makes is harder, not easier, to manage virtual keys. And the more copies, the weaker the key (the easier to find). A million is a terrible, terrible idea. No, I despise passwords. The whole scheme is backwards. I don't want to authenticate myself to the server; I want to authenticate the server to me. Why doesn't it provide the password, and my computer verify it? Why is a fallible human being in this game at all?
    - citruspi 11y ago
      > A million is a terrible, terrible idea. Well, yeah. That was a hyperbole. I didn't actually mean that you should go out and make a million copies of your key. It simply meant to show that it's easier to prevent the loss of a virtual key than it is to prevent the loss of the physical key. > The whole scheme is backwards. I don't want to authenticate myself to the server; I want to authenticate the server to me. That's... interesting. My first thought when I read that is that the server is the one with your data and multiple users - so it needs to authenticate you to make sure that you only access your data and don't gain access to other users' data. A server authenticating itself with you would tell you that you're actually talking to XYZ and not an imposter, but once that authentication took place you'd have access to everything on that server. Including other users' data. How do you imagine this working?

codedokode 11y ago

If there were an open source protocol you could use software emulator and pay nothing (if you don't care about security).

drdaeman 11y ago
There is, it's called TLS, the same one that's used in HTTPS ;) But, sadly, it's not usable. See my reply to grandparent comment.

qiemem 11y ago

What about fingerprints? You don't need to buy anything, phones and such are already coming out with fingerprint readers and the technology is improving all the time. Finally, you can't lose your finger print (except in the case of extreme accidents, which exist for any type of security).

M2Ys4U 11y ago
Fingerprints are usernames, not passwords. You can't lose your fingerprint, but you can't replace it either - so what happens when somebody clones it?