4 ms·
It’s time to replace passwords with keys
- LinuxBender 9y agoI would add, it is time to use properly managed keys. i.e. ssh keys with passwords and IP restrictions. Even better, a centralized CA and expiration of keys. Keys can be equally as dangerous as passwords if not managed correctly. Public keys, even more so. What systems and accounts trust my public key? Who knows? What is managing and mapping that? Did I have sudo for a while and shove my public key into your authorized_keys file? Are your ssh instances using the default location for authorized_keys that users can write to? Is this appropriate in your use case? Certainly not for production machines, right? Do you rotate your ssh keys that are used in automation? Are your keys limited to specific CIDR blocks? etc... things to consider.
- pc2g4d 9y agoMoving in that direction: https://www.w3.org/TR/webauthn/ https://www.w3.org/TR/webauthn/
- zeveb 9y agoThat looks pretty cool at first glance — I need to spend some time reading it in my free time to figure it out.
- JamesLeonis 9y agoI'm slacking right now from a project that's tackling this right now. I'm taking this as a sign to get back to work.
- dgroves 9y agoThis is so overdue it is not even funny.
- vschum 9y agohttps://keybase.io https://keybase.io It's mission is to bring public key cryptography to the masses, starting with programmers. The amount of progress that they've made in the last two years is actually quite impressive.
- ItzHaunT 9y agoKeybase is how I found this site. Was looking through the list of accounts I could prove, and figured this was worth checking out.
- sowbug 9y agoCar keys and house keys could be implemented as U2F tokens. A person could carry a single device, which could be a discrete token like a Yubikey, or virtualized in a phone, to authenticate to work, home, car, and computers. I wish Tesla would adopt U2F. They already have something that seems to be BLE/NFC for the Model 3.
- vortico 9y ago>People can't barely manage passwords, they can't manage them at all. This is like walking in a room, seeing a tiny speck of red paint on the wall and saying that the wall is painted red. Virtually everyone who owns a computer uses passwords, and probably 0.1-1% use a password manager. The others manage the passwords with memorization or post-it-notes just fine. Sometimes they forget, but email password resets solve that problem. They're not trivial for developers, but you shouldn't care about that. You should care about the end result and UX. Passwords are simple. No alternative is better because it's a solved problem. End of story.
- beaconstudios 9y agoMore users will use password managers if you include those who use browsers' "remember my password for this site" functionality.
- type0 9y agoEven better, ship it with operating system like so: https://www.engadget.com/2017/12/16/windows-10-bundled-password-manager-had-security-flaw/ https://www.engadget.com/2017/12/16/windows-10-bundled-passw... /s
- zeveb 9y agoI think part of his point is that memorization & post-it notes are improper ways to manage passwords. In general, a password one can memorise is too low-entropy to be used — and I think we all agree that writing passwords down is just terrible. And email resets have their own failure modes. For one things, it gives your email provider access to all your email-resettable accounts.
- maxerickson 9y agoWriting passwords down is fine, just don't leave the paper sitting in front of the computer.
- krupan 9y agoAwesome. Now address the other two groups of people discussed in the article. EDIT: oh, you did mention developers by saying I shouldn't care what they do with my secrets. Um, really?