6 ms·

"Technology by legislation" - that's the new trend it seems. How about replacing passwords with something technologically superior instead?

cpburns2009 8y ago
Superior technologies such as...?
- Jach 8y ago
  The obvious one is public-private keys. Servers only ever get your public key.
  - cpburns2009 8y ago
    That's a solution I do like. I was expecting to hear biometrics, email login tokens, or social account logins.
maltalex 8y ago
Replacing passwords won’t suddenly alight large companies interests with yours.
- zerostar07 8y ago
  ... because twitter has an interest in leaking passwords?
  - maltalex 8y ago
    ... because Yahoo had an interest in leaking passwords? Security is expensive, breaches have to be made more expensive. That's the difference between a company's management thinking about security as a checkbox they have to fill as opposed to an ongoing investment meant to reduce risk.
aaronbrethorst 8y ago
It isn't a new trend. Section 508 of the Rehabilitation Act legislated that the government purchase accessible software. HIPAA legislated that your medical data be kept secure. Minnesota, Nevada, and Washington have enshrined some or all of PCI DSS into law: https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard#Mandated_compliance https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec... A little farther afield, seat belt technology has been legally mandated to be included in most automobiles sold in the United States since 1968: https://en.wikipedia.org/wiki/Seat_belt_laws_in_the_United_States https://en.wikipedia.org/wiki/Seat_belt_laws_in_the_United_S...
- deleted 8y ago
  [deleted]
- zerostar07 8y ago
  Those are great examples of regulations that actually benefit the user. When the regulation however addresses the wrong problem, then it becomes burdensome and dumb. If the user uses a simplistic password, his account will be hacked even if it's never leaked. Studies show that bad passwords and phishing are more destructive than leaks.

cpburns2009 8y ago

Superior technologies such as...?

Jach 8y ago
The obvious one is public-private keys. Servers only ever get your public key.
- cpburns2009 8y ago
  That's a solution I do like. I was expecting to hear biometrics, email login tokens, or social account logins.

maltalex 8y ago

Replacing passwords won’t suddenly alight large companies interests with yours.

zerostar07 8y ago
... because twitter has an interest in leaking passwords?
- maltalex 8y ago
  ... because Yahoo had an interest in leaking passwords? Security is expensive, breaches have to be made more expensive. That's the difference between a company's management thinking about security as a checkbox they have to fill as opposed to an ongoing investment meant to reduce risk.

aaronbrethorst 8y ago

It isn't a new trend. Section 508 of the Rehabilitation Act legislated that the government purchase accessible software. HIPAA legislated that your medical data be kept secure. Minnesota, Nevada, and Washington have enshrined some or all of PCI DSS into law: https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard#Mandated_compliance https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec... A little farther afield, seat belt technology has been legally mandated to be included in most automobiles sold in the United States since 1968: https://en.wikipedia.org/wiki/Seat_belt_laws_in_the_United_States https://en.wikipedia.org/wiki/Seat_belt_laws_in_the_United_S...

deleted 8y ago
[deleted]
zerostar07 8y ago
Those are great examples of regulations that actually benefit the user. When the regulation however addresses the wrong problem, then it becomes burdensome and dumb. If the user uses a simplistic password, his account will be hacked even if it's never leaked. Studies show that bad passwords and phishing are more destructive than leaks.