4 ms·

Why on earth isn't the industry moving away from per-site passwords? They are terrible. The fact that you need your own app to "manage" them is just evidence

Why on earth isn't the industry moving away from per-site passwords? They are terrible. The fact that you need your own app to "manage" them is just evidence of how terrible they are. People should be able to use their phones, Yubikey, TouchID, etc. as their authentication, without needing a password (except a master password for the phone/Yubikey/TouchID). And yet I see no movement towards this from the industry. Are we stuck in this terrible state forever? If I could see into the future I would dearly hope that in 10 years we are not seeing HN front page articles about the newest innovations in password managers.

taeric 9y ago
I'm not sure I actually agree with this. Do you know of any studies that go into this? My concern is around having a single source of failure/attack. Which, to be fair, is probably not that different than most people's scenarios. That is, most people just let their browsers and phones remember passwords. So, in practice this already happens. I just don't feel like it is safe. I'm highly interested in being challenged on this.
- haberman 9y ago
  I think the only way you avoid a single source of failure is if your brain is actually capable of remembering a separate, high-entropy password for every website you visit. If you use the same password (even a high-entropy one) on every website, any hack of a single site compromises you on every website. If you use a password manager to store high-entropy passwords for every site you visit, then the password manager is a single point of failure. Both of these attacks happen in the real world. But securing a single authentication system like a phone app/Yubikey/TouchID/etc. seems more tractable than securing every website that you visit. Password managers are available today, but since the websites you are using don't actually know about them, the integration and ease of use are not as great as they could be. My vision is that you can use a phone app/Yubikey/TouchID/etc. to create as many identities as you want, and then you can use these to robustly authenticate to any website. To the website you would just be a GUID: an opaque identifier that it doesn't know anything about unless you tell it more. And all the app/Yubikey/TouchID does is let the website know (securely) that you are the same GUID that logged in last time.
  - taeric 9y ago
    I primarily rely on resets, oddly. Drives me crazy when folks think I will actively try to remember a password that I do not use daily for more than a few days. If you have my email, you have everything you need to let me initiate a reset. Which, I fully cede is also a single point of failure. Basically, I think we have plenty of weak links in the chains. I'm not too keen on codifying any new ones. If you have something that increases the strength of everything, I'm game to try it. And I am highly interested in studies that look into different strategies.
PeterisP 9y ago
Username/password is the least common denominator that's supported by everything and everyone. If I make an integration with Yubikey or iPhone, then that works only for that style of authentication. On the other hand, if I make simple username/password authentication, then all password managers in all browsers and with all devices will work for securely storing the authentication tokens. The whole point is that sites don't (and shouldn't) make a decision about how the user should store all their credentials, otherwise some users would be prevented from using the password management process of their choice. Instead, they just ask for a random password and the user (or his/her devices) can store it however they want.
Rafert 9y ago
The industry is working on killing the password. It started at Google with U2F, handed over to the FIDO Alliance (an industry group) and is now being worked on by the W3C. Have you seen the Web Authentication work? https://www.w3.org/TR/webauthn/ https://www.w3.org/TR/webauthn/
pishpash 9y ago
A hundred times yes. Passwords should only ever have been allowed locally. When untrusted web sites started to demand passwords for authentication they went down the wrong path already. The industry (including OS and hardware makers) really dropped the ball on this one in the early days with scant support for physical token authentication that people could have gotten used to. Even Yubikey piggybacks on a USB port, when all the energy spent on idiotic fingerprint readers could have been better spent on creating a standardized, dedicated hardware key port.
deleted 9y ago
[deleted]

taeric 9y ago

I'm not sure I actually agree with this. Do you know of any studies that go into this? My concern is around having a single source of failure/attack. Which, to be fair, is probably not that different than most people's scenarios. That is, most people just let their browsers and phones remember passwords. So, in practice this already happens. I just don't feel like it is safe. I'm highly interested in being challenged on this.

haberman 9y ago
I think the only way you avoid a single source of failure is if your brain is actually capable of remembering a separate, high-entropy password for every website you visit. If you use the same password (even a high-entropy one) on every website, any hack of a single site compromises you on every website. If you use a password manager to store high-entropy passwords for every site you visit, then the password manager is a single point of failure. Both of these attacks happen in the real world. But securing a single authentication system like a phone app/Yubikey/TouchID/etc. seems more tractable than securing every website that you visit. Password managers are available today, but since the websites you are using don't actually know about them, the integration and ease of use are not as great as they could be. My vision is that you can use a phone app/Yubikey/TouchID/etc. to create as many identities as you want, and then you can use these to robustly authenticate to any website. To the website you would just be a GUID: an opaque identifier that it doesn't know anything about unless you tell it more. And all the app/Yubikey/TouchID does is let the website know (securely) that you are the same GUID that logged in last time.
- taeric 9y ago
  I primarily rely on resets, oddly. Drives me crazy when folks think I will actively try to remember a password that I do not use daily for more than a few days. If you have my email, you have everything you need to let me initiate a reset. Which, I fully cede is also a single point of failure. Basically, I think we have plenty of weak links in the chains. I'm not too keen on codifying any new ones. If you have something that increases the strength of everything, I'm game to try it. And I am highly interested in studies that look into different strategies.

PeterisP 9y ago

Username/password is the least common denominator that's supported by everything and everyone. If I make an integration with Yubikey or iPhone, then that works only for that style of authentication. On the other hand, if I make simple username/password authentication, then all password managers in all browsers and with all devices will work for securely storing the authentication tokens. The whole point is that sites don't (and shouldn't) make a decision about how the user should store all their credentials, otherwise some users would be prevented from using the password management process of their choice. Instead, they just ask for a random password and the user (or his/her devices) can store it however they want.

Rafert 9y ago

The industry is working on killing the password. It started at Google with U2F, handed over to the FIDO Alliance (an industry group) and is now being worked on by the W3C. Have you seen the Web Authentication work? https://www.w3.org/TR/webauthn/ https://www.w3.org/TR/webauthn/

pishpash 9y ago

A hundred times yes. Passwords should only ever have been allowed locally. When untrusted web sites started to demand passwords for authentication they went down the wrong path already. The industry (including OS and hardware makers) really dropped the ball on this one in the early days with scant support for physical token authentication that people could have gotten used to. Even Yubikey piggybacks on a USB port, when all the energy spent on idiotic fingerprint readers could have been better spent on creating a standardized, dedicated hardware key port.

deleted 9y ago

[deleted]