9 ms·

Elevator Pitch: Clickpass brings some password relief

23 points by dcurtis 19y ago

abstractbill 19y ago
If you're in San Francisco today, don't forget to come to the justin.tv office (36 Clyde Street) to see Peter talk about Clickpass. Talk starts at 12:30pm. If you're not in SF, Peter's talk will be broadcast at http://www.justin.tv/hackertv http://www.justin.tv/hackertv
- abstractbill 19y ago
  Here's the archived talk: http://www.justin.tv/hackertv/86574/Peter_Nixey_Clickpass__OpenID_and_how_ http://www.justin.tv/hackertv/86574/Peter_Nixey_Clickpass__O...
huhtenberg 19y ago
There is a very big and rather obvious issue of trust with a solution like theirs. I am expected to entrust them with my passwords, essentially creating a single point of failure for a lot of sensitive information. Sorry, can't do. Not even if they were a spin-off of VeriSign. The only passwords I am willing to share with them at the moment are those I am finding at BugMeNot :)
- spolsky 19y ago
  Wouldn't it be possible to create a site that remembers all your passwords but only has them in encrypted form? It would use JavaScript on the browser to encrypt and decrypt the passwords (using your master passphrase) before sending them to the server?
  - simonw 19y ago
    Client-side encryption wouldn't protect you against that site turning evil and deciding to steal your passwords - they'd just have to change their code to decrypt your passwords and then post them back to the server.
    - spolsky 19y ago
      But they could be audited by looking at the JavaScript, so at least you have a way to prove to yourself they're legit.
- brlewis 19y ago
  How many sites do you use with "I forgot my password" features that send you email? Email is that exact single point of failure for most people.
  - huhtenberg 19y ago
    No, it is not. The only place where the email can actually be a single point of anything is either my local Inbox or an Inbox at my mail provider. Latter is temporary, so compromising provider's systems does not jeopardize all my web accounts. And compromised local Inbox is an indication of a far more serious security breach, not isolated to the email. So, no, your analogy is wrong.
    - simonw 19y ago
      I don't see your point. If I steal the password for your e-mail somehow, I can access your inbox (through webmail or POP or whatever) and then use "I forgot my password" on sites you use to steal your accounts there. If you use webmail and don't delete your e-mail I can search through your inbox to figure out what those sites are. Seems like a pretty serious single point of failure to me.
      - huhtenberg 19y ago
        If Clickpass servers are compromised, then so will be all my web accounts. And I have no reason to believe they will not be. That's the point.
        justindz 19y ago
        So, in a nutshell, you trust ClickPass security less than you trust your email provider's security. And, the margin is great enough to overcome whatever ease-of-use gains you might get from ClickPass over email. Did I get that right?
        huhtenberg 19y ago
- immad 19y ago
  If you have different secure passwords at every single website and some how avoid email as a single point of failure then Clickpass/OpenID might not be the right solution for you. For everyone else its better then whats currently out there, and we are going to implement further security measures going forward.
  - huhtenberg 19y ago
    Email is not a single point of failure as I just explained in another reply and Internet users with rudimental sense of security is not a rarity. I'm afraid the ignorant "everyone else" crowd you are planning to cater to might not be as big as you expect it to be. Also you are tasking yourselves with handling confidential information, so stating that your "lips are sealed and encrypted" is not good enough. I fail to see how this is "better then whats currently out there". Sorry to be peeing in your punch on a launch day, but you do have a serious problem with a security disclosure.
    - immad 19y ago
      1. If your email servers are compromised, than it makes them a single point of failure as most web accounts are accessible through forgotten password procedures. 2. Most people (66%) of users use the same password on all websites. Which is a far worse multiple trusted party single point of failure. Which is what I meant by "better than whats currently out there". 3. For services that really require a significantly increased level of security, like banks, it is very easy and likely that further security measures that don't rely on the OpenID provider will be built in on the websites. 4. It is important to figure out the security issue and make a rewarding web experience than hold up ones hands and decrease data portability and increase friction on the web. We are hoping to help that process along and are very open to suggestions on how we can improve that.
spolsky 19y ago
As far as I can tell Clickpass only works with 6 websites. Am I missing something? This is the mother of all chicken-and-egg problems... with no backwards compatibility mode to deal with websites that haven't gone along with a little two-guy startup's big scheme yet. Even Microsoft couldn't pull that off. Wake me up when it can handle the 200-odd passwords I keep in PasswordSafe for 200-odd websites.
- brlewis 19y ago
  They are an OpenID provider, so yes you can use them with the 11,000 or so web sites that support OpenID. Obviously it's a lot more slick if you set things up their way. This is the opposite of a chicken-and-egg problem. The fact that there are so few web sites on clickpass while it's getting so much attention motivates implementors to work with them. It sure motivated me.

23 points by dcurtis 19y ago

If you're in San Francisco today, don't forget to come to the justin.tv office (36 Clyde Street) to see Peter talk about Clickpass. Talk starts at 12:30pm. If you're not in SF, Peter's talk will be broadcast at http://www.justin.tv/hackertv http://www.justin.tv/hackertv

abstractbill 19y ago
Here's the archived talk: http://www.justin.tv/hackertv/86574/Peter_Nixey_Clickpass__OpenID_and_how_ http://www.justin.tv/hackertv/86574/Peter_Nixey_Clickpass__O...

huhtenberg 19y ago

There is a very big and rather obvious issue of trust with a solution like theirs. I am expected to entrust them with my passwords, essentially creating a single point of failure for a lot of sensitive information. Sorry, can't do. Not even if they were a spin-off of VeriSign. The only passwords I am willing to share with them at the moment are those I am finding at BugMeNot :)

spolsky 19y ago
Wouldn't it be possible to create a site that remembers all your passwords but only has them in encrypted form? It would use JavaScript on the browser to encrypt and decrypt the passwords (using your master passphrase) before sending them to the server?
- simonw 19y ago
  Client-side encryption wouldn't protect you against that site turning evil and deciding to steal your passwords - they'd just have to change their code to decrypt your passwords and then post them back to the server.
  - spolsky 19y ago
    But they could be audited by looking at the JavaScript, so at least you have a way to prove to yourself they're legit.
brlewis 19y ago
How many sites do you use with "I forgot my password" features that send you email? Email is that exact single point of failure for most people.
- huhtenberg 19y ago
  No, it is not. The only place where the email can actually be a single point of anything is either my local Inbox or an Inbox at my mail provider. Latter is temporary, so compromising provider's systems does not jeopardize all my web accounts. And compromised local Inbox is an indication of a far more serious security breach, not isolated to the email. So, no, your analogy is wrong.
  - simonw 19y ago
    I don't see your point. If I steal the password for your e-mail somehow, I can access your inbox (through webmail or POP or whatever) and then use "I forgot my password" on sites you use to steal your accounts there. If you use webmail and don't delete your e-mail I can search through your inbox to figure out what those sites are. Seems like a pretty serious single point of failure to me.
    - huhtenberg 19y ago
      If Clickpass servers are compromised, then so will be all my web accounts. And I have no reason to believe they will not be. That's the point.
      - justindz 19y ago
        So, in a nutshell, you trust ClickPass security less than you trust your email provider's security. And, the margin is great enough to overcome whatever ease-of-use gains you might get from ClickPass over email. Did I get that right?
        huhtenberg 19y ago
immad 19y ago
If you have different secure passwords at every single website and some how avoid email as a single point of failure then Clickpass/OpenID might not be the right solution for you. For everyone else its better then whats currently out there, and we are going to implement further security measures going forward.
- huhtenberg 19y ago
  Email is not a single point of failure as I just explained in another reply and Internet users with rudimental sense of security is not a rarity. I'm afraid the ignorant "everyone else" crowd you are planning to cater to might not be as big as you expect it to be. Also you are tasking yourselves with handling confidential information, so stating that your "lips are sealed and encrypted" is not good enough. I fail to see how this is "better then whats currently out there". Sorry to be peeing in your punch on a launch day, but you do have a serious problem with a security disclosure.
  - immad 19y ago
    1. If your email servers are compromised, than it makes them a single point of failure as most web accounts are accessible through forgotten password procedures. 2. Most people (66%) of users use the same password on all websites. Which is a far worse multiple trusted party single point of failure. Which is what I meant by "better than whats currently out there". 3. For services that really require a significantly increased level of security, like banks, it is very easy and likely that further security measures that don't rely on the OpenID provider will be built in on the websites. 4. It is important to figure out the security issue and make a rewarding web experience than hold up ones hands and decrease data portability and increase friction on the web. We are hoping to help that process along and are very open to suggestions on how we can improve that.

spolsky 19y ago

As far as I can tell Clickpass only works with 6 websites. Am I missing something? This is the mother of all chicken-and-egg problems... with no backwards compatibility mode to deal with websites that haven't gone along with a little two-guy startup's big scheme yet. Even Microsoft couldn't pull that off. Wake me up when it can handle the 200-odd passwords I keep in PasswordSafe for 200-odd websites.

brlewis 19y ago
They are an OpenID provider, so yes you can use them with the 11,000 or so web sites that support OpenID. Obviously it's a lot more slick if you set things up their way. This is the opposite of a chicken-and-egg problem. The fact that there are so few web sites on clickpass while it's getting so much attention motivates implementors to work with them. It sure motivated me.