5 ms·

What would a solution even look like with less friction than what we have now? You can hit a key shortcut, pull up a list, select the password and it's done. I

What would a solution even look like with less friction than what we have now? You can hit a key shortcut, pull up a list, select the password and it's done. I personally hit one keyboard shortcut, type a few characters into a fuzzy matching narrowing list, hit enter and the password is in my clipboard (password-store + dmenu) and there are equally minimal friction GUI versions of the same. Total blue sky it, or describe it in principle. We are basically approaching the theoretical minimum in regards to friction. We have a lot of solutions that accept large decreases in security for small improvements in ease of use in an attempt to attract users. Users don't want these tools. It's not friction, it's a complete disinterest from users. Maybe there is some theoretical approach with less friction that would win everyone over but this analysis of what the problem is stinks of tech solutionism to me.

unholiness 9y ago
The friction isn't about the workflow when the system just works. There are gains to be made in situations where I'm using another computer, or my phone, or the password manager isn't recognizing the site properly, or isn't finding the right the input fields. But mostly the friction is in front of all those users who don't use password managers. There are gains to be made in making the setup process simple, secure, and predictable. There are gains in making it cross-browser, cross-platform, and well-integrated with the setup process for browsers and operating systems. Users "don't want" most things, until a lot of thought and effort gets made to create a wholistic solutions that just work.
setr 9y ago
Well for one, using a generated password on a machine I don't own (ie a library computer) is a PITA, and thats if I have my phone. If its elsewhere for whatever reason, then I'm simply fucked since I'm no longer the source of truth. However, I'm not sure if hardware solutions like yubikey solve this (particularly for initial logon, or "interfaces", like a computer serving solely as a printer terminal) But anyways, the easy case is when the manager is trivially available; the hard case to solve is when its not. You can instead imagine a world where all computers by standard support some interface for hardware login in all states of operation, and by standard practice, people keep this hardware on them, and you'd have a significant improvement on the state of affairs. (ie nfc authentication by phone)

unholiness 9y ago

The friction isn't about the workflow when the system just works. There are gains to be made in situations where I'm using another computer, or my phone, or the password manager isn't recognizing the site properly, or isn't finding the right the input fields. But mostly the friction is in front of all those users who don't use password managers. There are gains to be made in making the setup process simple, secure, and predictable. There are gains in making it cross-browser, cross-platform, and well-integrated with the setup process for browsers and operating systems. Users "don't want" most things, until a lot of thought and effort gets made to create a wholistic solutions that just work.

setr 9y ago

Well for one, using a generated password on a machine I don't own (ie a library computer) is a PITA, and thats if I have my phone. If its elsewhere for whatever reason, then I'm simply fucked since I'm no longer the source of truth. However, I'm not sure if hardware solutions like yubikey solve this (particularly for initial logon, or "interfaces", like a computer serving solely as a printer terminal) But anyways, the easy case is when the manager is trivially available; the hard case to solve is when its not. You can instead imagine a world where all computers by standard support some interface for hardware login in all states of operation, and by standard practice, people keep this hardware on them, and you'd have a significant improvement on the state of affairs. (ie nfc authentication by phone)