4 ms·

Can someone explain to me why we are still using passwords? It's not like we don't have better technology. Why can't I just authenticate everywhere with a signe

Can someone explain to me why we are still using passwords? It's not like we don't have better technology. Why can't I just authenticate everywhere with a signed token? What's standing in the way of this?

tlrobinson 10y ago
Passwords are simple and convenient. Everyone basically understands how they work, and you can keep them in your head (not that you should). EDIT: I'm not saying passwords are ideal, just giving context as to why they haven't been replaced.
- astazangasta 10y ago
  Passwords are NOT simple and convenient, they are cumbersome and hard-to-remember, cause huge security problems, and are basically only standing on top of the crutch of email forgot-your-password systems.
  - tlrobinson 10y ago
    Yes, good passwords are hard to remember, and bad or reused passwords are a security risk, but conceptually passwords are way simpler and more convenient than the alternatives, for the average user. All I need to login from any device in the world is my password. As soon as you introduce tokens or private keys or whatever you need something to securely store that, most likely protected by... a password. I can imagine some crazy implant + biometric authentication scheme but we're a long ways off from that sort of thing being universally accepted.
    - astazangasta 10y ago
      I keep an ssh key on a USB drive on my keychain. The physical analogy to a key is easy to grasp and totally appropriate. You don't expect to get into your house without your keys; similarly, if we turn the key into a physical object on your person, we can build off an existing habit. I don't think this should be terribly difficult.
ericzawo 10y ago
Isn't the general stance that this is too new and scary for the average user?
- astazangasta 10y ago
  How about giving it a shot, at least? Can I even authenticate with Facebook or Gmail using a secure token? - as far as I know I can't. At least make it possible for the savvy user, and let the average user catch up as usability improves.
andrewstuart2 10y ago
Well, for one, the fact that your private key can be copied without you knowing it. At least for now, the only guaranteed read-only-for-owner storage is our brain.
- astazangasta 10y ago
  You can easily build a secure token machine that prevents this possibility. And compare this to the huge hole of having millions of people with the password 'password', the possibility of someone occasionally having their secret key stolen seems significantly less damaging.
  - andrewstuart2 10y ago
    True, but a token machine only serves to identify the token machine, which presumably is only held by the person it identifies. I think my point is that at a fundamental level, identity is internal, tied to a person's mind/soul/etc. Anything external is fundamentally a supplemental identifier. People lose things, steal things, etc. but you cannot (as of yet) steal someone's thoughts.
    - astazangasta 10y ago
      No, but you can obviously steal passwords, so what's the point?
dragonwriter 10y ago
> Can someone explain to me why we are still using passwords? Because, generally username/password remains the least-bad primary method we have for most uses, and most other methods work best as secondary methods with that rather than replacements. > It's not like we don't have better technology. Yes, it is. > Why can't I just authenticate everywhere with a signed token? Because, unless they are accompanied by (or secured on the user end by) passwords, signing keys that enable that are more prone to theft, whether by copying (if they aren't kept in a hardware device designed to prevent that) or by theft of the device they are in. Which is why that mechanism is usually used as a second-factor with passwords for systems needing additional security, rather than a replacement for passwords.

tlrobinson 10y ago

Passwords are simple and convenient. Everyone basically understands how they work, and you can keep them in your head (not that you should). EDIT: I'm not saying passwords are ideal, just giving context as to why they haven't been replaced.

astazangasta 10y ago
Passwords are NOT simple and convenient, they are cumbersome and hard-to-remember, cause huge security problems, and are basically only standing on top of the crutch of email forgot-your-password systems.
- tlrobinson 10y ago
  Yes, good passwords are hard to remember, and bad or reused passwords are a security risk, but conceptually passwords are way simpler and more convenient than the alternatives, for the average user. All I need to login from any device in the world is my password. As soon as you introduce tokens or private keys or whatever you need something to securely store that, most likely protected by... a password. I can imagine some crazy implant + biometric authentication scheme but we're a long ways off from that sort of thing being universally accepted.
  - astazangasta 10y ago
    I keep an ssh key on a USB drive on my keychain. The physical analogy to a key is easy to grasp and totally appropriate. You don't expect to get into your house without your keys; similarly, if we turn the key into a physical object on your person, we can build off an existing habit. I don't think this should be terribly difficult.

ericzawo 10y ago

Isn't the general stance that this is too new and scary for the average user?

astazangasta 10y ago
How about giving it a shot, at least? Can I even authenticate with Facebook or Gmail using a secure token? - as far as I know I can't. At least make it possible for the savvy user, and let the average user catch up as usability improves.

andrewstuart2 10y ago

Well, for one, the fact that your private key can be copied without you knowing it. At least for now, the only guaranteed read-only-for-owner storage is our brain.

astazangasta 10y ago
You can easily build a secure token machine that prevents this possibility. And compare this to the huge hole of having millions of people with the password 'password', the possibility of someone occasionally having their secret key stolen seems significantly less damaging.
- andrewstuart2 10y ago
  True, but a token machine only serves to identify the token machine, which presumably is only held by the person it identifies. I think my point is that at a fundamental level, identity is internal, tied to a person's mind/soul/etc. Anything external is fundamentally a supplemental identifier. People lose things, steal things, etc. but you cannot (as of yet) steal someone's thoughts.
  - astazangasta 10y ago
    No, but you can obviously steal passwords, so what's the point?

dragonwriter 10y ago

> Can someone explain to me why we are still using passwords? Because, generally username/password remains the least-bad primary method we have for most uses, and most other methods work best as secondary methods with that rather than replacements. > It's not like we don't have better technology. Yes, it is. > Why can't I just authenticate everywhere with a signed token? Because, unless they are accompanied by (or secured on the user end by) passwords, signing keys that enable that are more prone to theft, whether by copying (if they aren't kept in a hardware device designed to prevent that) or by theft of the device they are in. Which is why that mechanism is usually used as a second-factor with passwords for systems needing additional security, rather than a replacement for passwords.