4 ms·
Do you have a source for that? (not arguing, just want to read more about this)
by kej 10y ago
Do you have a source for that? (not arguing, just want to read more about this)
- tptacek 10y agoNo, just experience training organizations for this stuff. User passwords are extremely bad.
- derefr 10y agoHow do you feel about reversed 2FA flows? 1. Install a client cert/pairing token/SSH key/etc. onto each client device; 2. ask the user to configure a password, with a recommendation that that password be short and memorable rather than long and unwieldy; 3. either encrypt the device-credential with the user-password, or send the server the password to hash and store; 4. if the password challenge-response is on the server, have the server validate the device credential "before" or "outside of" accepting password-auth challenges (e.g. in the case of a client cert, validating the cert at the TLS level before the auth request can even reach the backend.) In other words, systems isomorphic to the financial chip-and-PIN system: the chip is something you have, while the PIN—something you know—is only there to prevent robbers from using the chip, rather than to provide any cryptographic security.