5 ms·

I'm curious; why aren't we dropping the use of passwords in favor of U2F? I guess for one; not everyone wants to buy and carry a key. But we're at the point wh

by wepple 9y ago

I'm curious; why aren't we dropping the use of passwords in favor of U2F? I guess for one; not everyone wants to buy and carry a key. But we're at the point where you have to have a password manager anyhow, a token isn't that much more of a burden.

ivanbakel 9y ago
The first general-user services to enforce 2FA of any kind will be sacrificing a massive number of users to do it. As a company running a service for money, you have no incentive to make your system more secure on the user end - obstacles for the user are just users lost. Security-conscious users can push for 2FA on services, but we probably won't hit it being mandatory any time soon.
- danneu 9y ago
  But if there's any money at stake, then any money exfiltrated from your users is money that you never receive, so there's certainly an incentive but also trade-offs.
  - ivanbakel 9y ago
    Assuming 1. Your profits come directly from your users 2. A password crack can result in them losing a significant amount of money, and 3. This happens often enough that it offsets the userbase losses of 2FA If your user accounts are important enough to let them lose a large amount of money, your users are probably demanding better security from you already. The real blocker to 2FA are services which rely on being convenient, and make money off their users being users e.g. social media.
IncRnd 9y ago
> I'm curious; why aren't we dropping the use of passwords in favor of U2F? Well, you are favoring U2F, which is a _specific_ _implementation_ of 2FA. U2F isn't being used generally, because it isn't a general purpose solution. > I guess for one; not everyone wants to buy and carry a key. This statement is the problem with looking at specific implementations to solve a general problem, instead of looking at all the solutions. There are many solutions, not all of which even use physical keys fobs. RSA is a straightforward example of why a 3rd party shouldn't automatically be trusted for auth mechanisms. > But we're at the point where you have to have a password manager anyhow, a token isn't that much more of a burden. The burden isn't just a user side issue about carrying a fob. For general password replacement, key fobs will get lost. Passwords are a burden to the user, having to pay or deal with key fobs and their replacements will be an even greater burden. You are proposing to solve the auth problem by causing many users to stop using websites. Unfortunately, there are also issues with soft tokens. There are still applications that only use the "first soft token" in a list of soft tokens owned by a user. Plus, soft tokens are quite amenable to being copied. There are also many banks and credit card issuers who have consciously chosen various forms of 1.5FA instead of 2FA. In many cases this is a valid solution, a form of dual sided auth that works across all clients.

by wepple 9y ago

ivanbakel 9y ago

The first general-user services to enforce 2FA of any kind will be sacrificing a massive number of users to do it. As a company running a service for money, you have no incentive to make your system more secure on the user end - obstacles for the user are just users lost. Security-conscious users can push for 2FA on services, but we probably won't hit it being mandatory any time soon.

danneu 9y ago
But if there's any money at stake, then any money exfiltrated from your users is money that you never receive, so there's certainly an incentive but also trade-offs.
- ivanbakel 9y ago
  Assuming 1. Your profits come directly from your users 2. A password crack can result in them losing a significant amount of money, and 3. This happens often enough that it offsets the userbase losses of 2FA If your user accounts are important enough to let them lose a large amount of money, your users are probably demanding better security from you already. The real blocker to 2FA are services which rely on being convenient, and make money off their users being users e.g. social media.

IncRnd 9y ago

> I'm curious; why aren't we dropping the use of passwords in favor of U2F? Well, you are favoring U2F, which is a _specific_ _implementation_ of 2FA. U2F isn't being used generally, because it isn't a general purpose solution. > I guess for one; not everyone wants to buy and carry a key. This statement is the problem with looking at specific implementations to solve a general problem, instead of looking at all the solutions. There are many solutions, not all of which even use physical keys fobs. RSA is a straightforward example of why a 3rd party shouldn't automatically be trusted for auth mechanisms. > But we're at the point where you have to have a password manager anyhow, a token isn't that much more of a burden. The burden isn't just a user side issue about carrying a fob. For general password replacement, key fobs will get lost. Passwords are a burden to the user, having to pay or deal with key fobs and their replacements will be an even greater burden. You are proposing to solve the auth problem by causing many users to stop using websites. Unfortunately, there are also issues with soft tokens. There are still applications that only use the "first soft token" in a list of soft tokens owned by a user. Plus, soft tokens are quite amenable to being copied. There are also many banks and credit card issuers who have consciously chosen various forms of 1.5FA instead of 2FA. In many cases this is a valid solution, a form of dual sided auth that works across all clients.