5 ms·

SSH keys all day. They can be troublesome for even an "expert" to look after, so I guess there's no hope for your average idiot. Still, logging in without using

SSH keys all day. They can be troublesome for even an "expert" to look after, so I guess there's no hope for your average idiot. Still, logging in without using a password is the bomb

eatbitseveryday 10y ago
Yea this seems easy to set up. But, what about <insert generic website>? Like... HN. I have an encrypted file with website|username|password on my laptop to allow for unique passwords across sites. But it's a pain, and definitely not something everyone will do.
- lmm 10y ago
  SSL client certificates. If only the browser UX for them didn't suck.
varjag 10y ago
Keys are great until you find a sudden need to log in from your wife's cellphone or a public terminal..
- lmm 10y ago
  That should be soluble though. E.g. standardized smartcards that cellphones and terminals know how to communicate with.
  - varjag 10y ago
    In theory yes, although with caveats. You'd need to match the degree of anti-tamper measures currently present in POS terminals to all consumer devices. In practice, it would mean replacing most of the world's user-facing computer infrastructure.
    - Kadin 10y ago
      You can get computers with smartcard readers from virtually every major manufacturer (except Apple, because Apple). The most frequent use case is government users who need to support the DOD Common Access Card (CAC) standard. The card reader doesn't have to be any more tamper-resistant than the rest of the computer. On a public terminal, it should probably be built like an ATM's card slot (and the rest of the machine should be similarly armored), but on a personal computer it doesn't need to be any more robust than the keyboard a user would otherwise type passwords in with. The card-computer communication is all encrypted anyway, so even if it's built like any old USB peripheral it's still better than typing into a keyboard.
- joshka 10y ago
  opsec 101 - don't use other people's devices / machines
  - varjag 10y ago
    Do you never, ever, use devices not in your full possession?
    - pop8row9 10y ago
      Isn't that what you do? If you have deals with many strangers do you not expect to get your hands dirty in some way?
      - varjag 10y ago
        I definitely don't store my SSH keys on stranger computers. I however used passwords on my relatives or customers devices on numerous occasions. Don't pretend you never did, I'm not going to believe you.
        joshka 10y ago
        Sure, I've used other machines in the past. I prefer not to though in most circumstances and assume that any account / password that I use on said machine is compromised from then on. This was something I changed when I realized that a tax related government agency's machine I was using about 10 years ago man in the middled SSL connections to my online banking. Who knows what was logged and what the retention on that was? I don't have time or the inclination to ensure every relative's / customer's devices are secure, so I use my own or go without.
dredmorbius 10y ago
Key disclosure and key loss are things. The first makes your public key useless for security. The second locks you out of everything. So you've still got to have patterns-of-fraudulent-use detection, and some sort of token-reset mechanism. Persistent data encryption is another option, but that compounds the key-loss problem in that you cannot access earlier data.

SSH keys all day. They can be troublesome for even an "expert" to look after, so I guess there's no hope for your average idiot. Still, logging in without using a password is the bomb

eatbitseveryday 10y ago

Yea this seems easy to set up. But, what about <insert generic website>? Like... HN. I have an encrypted file with website|username|password on my laptop to allow for unique passwords across sites. But it's a pain, and definitely not something everyone will do.

lmm 10y ago
SSL client certificates. If only the browser UX for them didn't suck.

varjag 10y ago

Keys are great until you find a sudden need to log in from your wife's cellphone or a public terminal..

lmm 10y ago
That should be soluble though. E.g. standardized smartcards that cellphones and terminals know how to communicate with.
- varjag 10y ago
  In theory yes, although with caveats. You'd need to match the degree of anti-tamper measures currently present in POS terminals to all consumer devices. In practice, it would mean replacing most of the world's user-facing computer infrastructure.
  - Kadin 10y ago
    You can get computers with smartcard readers from virtually every major manufacturer (except Apple, because Apple). The most frequent use case is government users who need to support the DOD Common Access Card (CAC) standard. The card reader doesn't have to be any more tamper-resistant than the rest of the computer. On a public terminal, it should probably be built like an ATM's card slot (and the rest of the machine should be similarly armored), but on a personal computer it doesn't need to be any more robust than the keyboard a user would otherwise type passwords in with. The card-computer communication is all encrypted anyway, so even if it's built like any old USB peripheral it's still better than typing into a keyboard.
joshka 10y ago
opsec 101 - don't use other people's devices / machines
- varjag 10y ago
  Do you never, ever, use devices not in your full possession?
  - pop8row9 10y ago
    Isn't that what you do? If you have deals with many strangers do you not expect to get your hands dirty in some way?
    - varjag 10y ago
      I definitely don't store my SSH keys on stranger computers. I however used passwords on my relatives or customers devices on numerous occasions. Don't pretend you never did, I'm not going to believe you.
      - joshka 10y ago
        Sure, I've used other machines in the past. I prefer not to though in most circumstances and assume that any account / password that I use on said machine is compromised from then on. This was something I changed when I realized that a tax related government agency's machine I was using about 10 years ago man in the middled SSL connections to my online banking. Who knows what was logged and what the retention on that was? I don't have time or the inclination to ensure every relative's / customer's devices are secure, so I use my own or go without.

dredmorbius 10y ago

Key disclosure and key loss are things. The first makes your public key useless for security. The second locks you out of everything. So you've still got to have patterns-of-fraudulent-use detection, and some sort of token-reset mechanism. Persistent data encryption is another option, but that compounds the key-loss problem in that you cannot access earlier data.