6 ms·

Perhaps someone could come up with a service saying "sorry, this password has already been used somewhere on Internet, are you sure you want to proceed?". Sites

by dewiz 10y ago

Perhaps someone could come up with a service saying "sorry, this password has already been used somewhere on Internet, are you sure you want to proceed?". Sites would have to adopt it, a-la re-captcha

eatbitseveryday 10y ago
I ask, can we do away with passwords entirely? Trying to defeat computers with human memory seems like the wrong approach.
- prostoalex 10y ago
  http://www.prnewswire.com/news-releases/authy-accelerates-enterprise-reach-of-two-factor-authentication-with-launch-of-global-oem-program-300068401.html http://www.prnewswire.com/news-releases/authy-accelerates-en...
  - RubyPinch 10y ago
    That is just 2fac, isn't it?
    - prostoalex 10y ago
      Authy codes (as well as Google and Microsoft equivalents) can be the first factor, which would eliminate the need for passwords. Grandparent's question was about usage by groups and teams at the enterprise level, which Authy also supports.
- rangibaby 10y ago
  SSH keys all day. They can be troublesome for even an "expert" to look after, so I guess there's no hope for your average idiot. Still, logging in without using a password is the bomb
  - eatbitseveryday 10y ago
    Yea this seems easy to set up. But, what about <insert generic website>? Like... HN. I have an encrypted file with website|username|password on my laptop to allow for unique passwords across sites. But it's a pain, and definitely not something everyone will do.
    - lmm 10y ago
      SSL client certificates. If only the browser UX for them didn't suck.
  - varjag 10y ago
    Keys are great until you find a sudden need to log in from your wife's cellphone or a public terminal..
    - lmm 10y ago
      That should be soluble though. E.g. standardized smartcards that cellphones and terminals know how to communicate with.
      - varjag 10y ago
        In theory yes, although with caveats. You'd need to match the degree of anti-tamper measures currently present in POS terminals to all consumer devices. In practice, it would mean replacing most of the world's user-facing computer infrastructure.
        Kadin 10y ago
        You can get computers with smartcard readers from virtually every major manufacturer (except Apple, because Apple). The most frequent use case is government users who need to support the DOD Common Access Card (CAC) standard. The card reader doesn't have to be any more tamper-resistant than the rest of the computer. On a public terminal, it should probably be built like an ATM's card slot (and the rest of the machine should be similarly armored), but on a personal computer it doesn't need to be any more robust than the keyboard a user would otherwise type passwords in with. The card-computer communication is all encrypted anyway, so even if it's built like any old USB peripheral it's still better than typing into a keyboard.
- ashitlerferad 10y ago
  Yes. Debian uses client-side X.509, OpenPGP and OpenSSH certificates for all service authentication (including websites).
- fizbin 10y ago
  We can certainly do without passwords for every stupid little website. Unless you're rightfully a central force in the user's life - say, their main bank - you really should have users log in through Google, or Facebook, or Twitter, or someone else who almost certainly can guard their passwords better than you can. It's shameful that it's so much easier to find tutorials on how to store passwords "securely" (including several tutorials that tell you crazy insecure things, like storing with unsalted commodity hashes) than it is to find tutorials on how to integrate your brand new battling-fairies website game with OAuth for authentication.
0xFFC 10y ago
Coming up with appropriate password for ordinary user's is hard enough right now.lets imagine you are not being sarcastic-for the sake of argument-, then I think it is almost impossible to create good enough password, yet rememberable.
blake8086 10y ago
I've often wondered if this is possible. I bet there's an academic paper somewhere about zero-knowledge multi-lookups or something.
enobrev 10y ago
Lastpass does this. It will warn you when saving a password, and it also warns you when loading data for an already saved password.
dredmorbius 10y ago
This. I think it's going to have to be legislated: 1. Mandate that all publicly disclosed passwords are collected in a compiled set. 2. Require that any Internet service vendor check against this set on password change revisions, and against different portions of the file, as maintainable, on each authentication. Known passwords are rejected when set, and mandate changes when detected on login. Asking a 76 year old mostly-computer-illiterate pereson to come up with a never-been-used-before password simply doesn't work. This also means mandating password safes on all consumer-grade OSes. Apple already does, Microsoft and Android. For Linux, you might be semi- on your own, though most distros offer several options. I'd also like to see 2FA via a keyfob generator rather than contact token (e.g., phone, email).

by dewiz 10y ago

eatbitseveryday 10y ago

I ask, can we do away with passwords entirely? Trying to defeat computers with human memory seems like the wrong approach.

prostoalex 10y ago
http://www.prnewswire.com/news-releases/authy-accelerates-enterprise-reach-of-two-factor-authentication-with-launch-of-global-oem-program-300068401.html http://www.prnewswire.com/news-releases/authy-accelerates-en...
- RubyPinch 10y ago
  That is just 2fac, isn't it?
  - prostoalex 10y ago
    Authy codes (as well as Google and Microsoft equivalents) can be the first factor, which would eliminate the need for passwords. Grandparent's question was about usage by groups and teams at the enterprise level, which Authy also supports.
rangibaby 10y ago
SSH keys all day. They can be troublesome for even an "expert" to look after, so I guess there's no hope for your average idiot. Still, logging in without using a password is the bomb
- eatbitseveryday 10y ago
  Yea this seems easy to set up. But, what about <insert generic website>? Like... HN. I have an encrypted file with website|username|password on my laptop to allow for unique passwords across sites. But it's a pain, and definitely not something everyone will do.
  - lmm 10y ago
    SSL client certificates. If only the browser UX for them didn't suck.
- varjag 10y ago
  Keys are great until you find a sudden need to log in from your wife's cellphone or a public terminal..
  - lmm 10y ago
    That should be soluble though. E.g. standardized smartcards that cellphones and terminals know how to communicate with.
    - varjag 10y ago
      In theory yes, although with caveats. You'd need to match the degree of anti-tamper measures currently present in POS terminals to all consumer devices. In practice, it would mean replacing most of the world's user-facing computer infrastructure.
      - Kadin 10y ago
        You can get computers with smartcard readers from virtually every major manufacturer (except Apple, because Apple). The most frequent use case is government users who need to support the DOD Common Access Card (CAC) standard. The card reader doesn't have to be any more tamper-resistant than the rest of the computer. On a public terminal, it should probably be built like an ATM's card slot (and the rest of the machine should be similarly armored), but on a personal computer it doesn't need to be any more robust than the keyboard a user would otherwise type passwords in with. The card-computer communication is all encrypted anyway, so even if it's built like any old USB peripheral it's still better than typing into a keyboard.
ashitlerferad 10y ago
Yes. Debian uses client-side X.509, OpenPGP and OpenSSH certificates for all service authentication (including websites).
fizbin 10y ago
We can certainly do without passwords for every stupid little website. Unless you're rightfully a central force in the user's life - say, their main bank - you really should have users log in through Google, or Facebook, or Twitter, or someone else who almost certainly can guard their passwords better than you can. It's shameful that it's so much easier to find tutorials on how to store passwords "securely" (including several tutorials that tell you crazy insecure things, like storing with unsalted commodity hashes) than it is to find tutorials on how to integrate your brand new battling-fairies website game with OAuth for authentication.

0xFFC 10y ago

Coming up with appropriate password for ordinary user's is hard enough right now.lets imagine you are not being sarcastic-for the sake of argument-, then I think it is almost impossible to create good enough password, yet rememberable.

blake8086 10y ago

I've often wondered if this is possible. I bet there's an academic paper somewhere about zero-knowledge multi-lookups or something.

enobrev 10y ago

Lastpass does this. It will warn you when saving a password, and it also warns you when loading data for an already saved password.

dredmorbius 10y ago

This. I think it's going to have to be legislated: 1. Mandate that all publicly disclosed passwords are collected in a compiled set. 2. Require that any Internet service vendor check against this set on password change revisions, and against different portions of the file, as maintainable, on each authentication. Known passwords are rejected when set, and mandate changes when detected on login. Asking a 76 year old mostly-computer-illiterate pereson to come up with a never-been-used-before password simply doesn't work. This also means mandating password safes on all consumer-grade OSes. Apple already does, Microsoft and Android. For Linux, you might be semi- on your own, though most distros offer several options. I'd also like to see 2FA via a keyfob generator rather than contact token (e.g., phone, email).