4 ms·

Instead of actually fixing authentication they are baking "have this password been exposed in plaintext" into the browsers. What's the deal with WebAuthN? Such

Instead of actually fixing authentication they are baking "have this password been exposed in plaintext" into the browsers. What's the deal with WebAuthN? Such a basic functionality still not completed.

JumpCrisscross 8y ago
> Instead of actually fixing authentication they are baking "have this password been exposed in plaintext" into the browsers “Perfect is the enemy of good” [1]. [1] https://en.m.wikipedia.org/wiki/Perfect_is_the_enemy_of_good https://en.m.wikipedia.org/wiki/Perfect_is_the_enemy_of_good
- homakov 8y ago
  I'd argue there is no "good" auth at the moment, only "poor". And upgrade to authenticator-based "good enough" is much needed.
  - gldalmaso 8y ago
    https://en.wiktionary.org/wiki/no_good_deed_goes_unpunished https://en.wiktionary.org/wiki/no_good_deed_goes_unpunished
detaro 8y ago
I thought Firefox supported Web Authentication API since Version 60, as much as a standard that isn't finished yet can be supported?
Piskvorrr 8y ago
"Fixing." Don't ask me how many sites are still only supporting Basic Auth, in 2018 - I frequent several. How is FF ("they") supposed to fix that?
- homakov 8y ago
  I don't recall any popular website using Basic Auth. FF must implement WebAuthN or whatever was last offered to fix auth. Have i been pwned brings nothing new to the table.
  - Piskvorrr 8y ago
    Well, that's the problem with browsers though: they need to support a slightly broader range of sites than just the currently popular ones; long tail and whatnot. Now, I am all for actually secure auth, and support in browsers is the necessary first step; for "fixing auth", someone then needs to implement the other side of the equation, too (I do remember when OpenId+HW 2FA was supposed to have fixed this, a few years back). As for "nothing new" - for the people of HN, perhaps. For the casual user, this is something radically new.
    - homakov 8y ago
      >I do remember when OpenId+HW 2FA was supposed to have fixed this HW 2fa can never fix auth because it's hardware, and cannot scale. There are solutions out there, all what's left is to raise awareness to add it. Showing popular passwords will just move us to a new set of popular passwords and so on.

JumpCrisscross 8y ago

> Instead of actually fixing authentication they are baking "have this password been exposed in plaintext" into the browsers “Perfect is the enemy of good” [1]. [1] https://en.m.wikipedia.org/wiki/Perfect_is_the_enemy_of_good https://en.m.wikipedia.org/wiki/Perfect_is_the_enemy_of_good

homakov 8y ago
I'd argue there is no "good" auth at the moment, only "poor". And upgrade to authenticator-based "good enough" is much needed.
- gldalmaso 8y ago
  https://en.wiktionary.org/wiki/no_good_deed_goes_unpunished https://en.wiktionary.org/wiki/no_good_deed_goes_unpunished

detaro 8y ago

I thought Firefox supported Web Authentication API since Version 60, as much as a standard that isn't finished yet can be supported?

Piskvorrr 8y ago

"Fixing." Don't ask me how many sites are still only supporting Basic Auth, in 2018 - I frequent several. How is FF ("they") supposed to fix that?

homakov 8y ago
I don't recall any popular website using Basic Auth. FF must implement WebAuthN or whatever was last offered to fix auth. Have i been pwned brings nothing new to the table.
- Piskvorrr 8y ago
  Well, that's the problem with browsers though: they need to support a slightly broader range of sites than just the currently popular ones; long tail and whatnot. Now, I am all for actually secure auth, and support in browsers is the necessary first step; for "fixing auth", someone then needs to implement the other side of the equation, too (I do remember when OpenId+HW 2FA was supposed to have fixed this, a few years back). As for "nothing new" - for the people of HN, perhaps. For the casual user, this is something radically new.
  - homakov 8y ago
    >I do remember when OpenId+HW 2FA was supposed to have fixed this HW 2fa can never fix auth because it's hardware, and cannot scale. There are solutions out there, all what's left is to raise awareness to add it. Showing popular passwords will just move us to a new set of popular passwords and so on.