4 ms·

Great work and glad to hear it. Do you have any thoughts on a post-password internet? What are some cool not-password-login-schemes, if you've ever thought ab

by sova 10y ago

Great work and glad to hear it. Do you have any thoughts on a post-password internet? What are some cool not-password-login-schemes, if you've ever thought about it?

Sir_Cmpwn 10y ago
I'm not very good at thinking of technologies that work for non-technical users. Personally, I'm happy with password store + TOTP. Some interesting experiments I've seen include SSH and PGP-based challenges. I would like to see a browser-driven solution like better client-side certificates support, but none of these ideas work well for non-techies.
Godel_unicode 10y ago
The vast majority of US government agencies use smartcard certs for authentication to web services, Google uses yubikey. Both are really solid solutions.
- sova 10y ago
  Okay, awesome. This makes me contemplate the following: physical identity links (such as yubikeys) are necessary in a real-world situation where credentials need to kept as securely. However, what about cases that do not need such levels of security? It may make sense to have two groups: simple "identity assertion" & secure individual link. Do you feel me? For many of my projects a compromised account would not be disastrous, or any more disastrous than a compromised HN account. It's simply a matter of ease-of-participation that one needs passwords in the first place for many of my applications. Do you think a "drawable" password would be cool?
  - thasaleni 10y ago
    Drawable Password = Lock Parttern
igor47 10y ago
everyone uses email for password resets anyway, and most people persist sessions. i always thought we should just email the user a link if their session has expired. there's no reason to have passwords. this is the scheme sandstorm already uses. maybe i find this less annoying since i have a dedicated terminal window for my email, and don't have to hunt around tabs for it? do people who use web-based email lose their email tabs?
- sova 10y ago
  >i always thought we should just email the user a link if their session has expired. there's no reason to have passwords. Yes! You are so right. What have I been thinking. This is an excellent and care-free way to do it. I didn't even consider persisting e-mail tokens, but that makes so much sense! Thanks!

by sova 10y ago

Great work and glad to hear it. Do you have any thoughts on a post-password internet? What are some cool not-password-login-schemes, if you've ever thought about it?

Sir_Cmpwn 10y ago

I'm not very good at thinking of technologies that work for non-technical users. Personally, I'm happy with password store + TOTP. Some interesting experiments I've seen include SSH and PGP-based challenges. I would like to see a browser-driven solution like better client-side certificates support, but none of these ideas work well for non-techies.

Godel_unicode 10y ago

The vast majority of US government agencies use smartcard certs for authentication to web services, Google uses yubikey. Both are really solid solutions.

sova 10y ago
Okay, awesome. This makes me contemplate the following: physical identity links (such as yubikeys) are necessary in a real-world situation where credentials need to kept as securely. However, what about cases that do not need such levels of security? It may make sense to have two groups: simple "identity assertion" & secure individual link. Do you feel me? For many of my projects a compromised account would not be disastrous, or any more disastrous than a compromised HN account. It's simply a matter of ease-of-participation that one needs passwords in the first place for many of my applications. Do you think a "drawable" password would be cool?
- thasaleni 10y ago
  Drawable Password = Lock Parttern

igor47 10y ago

everyone uses email for password resets anyway, and most people persist sessions. i always thought we should just email the user a link if their session has expired. there's no reason to have passwords. this is the scheme sandstorm already uses. maybe i find this less annoying since i have a dedicated terminal window for my email, and don't have to hunt around tabs for it? do people who use web-based email lose their email tabs?

sova 10y ago
>i always thought we should just email the user a link if their session has expired. there's no reason to have passwords. Yes! You are so right. What have I been thinking. This is an excellent and care-free way to do it. I didn't even consider persisting e-mail tokens, but that makes so much sense! Thanks!