33 ms·

Why [Insert Thing Here] Is Not a Password Killer

213 points by nikbackm 8y ago

myWindoonn 8y ago
A little boring and reactionary, I think. Unguessable capabilities (long unchoosable URLs mostly) have been used to replace passwords. Plenty of systems refuse to let users choose passwords, and many common password problems are totally mitigated by this design.
- chme 8y ago
  That depends on what you want to do. Do you want to authenticate the system of the user or the user him/herself? If its the latter, then how do you protect the link from other uses of this system? Encryption? And how are you encrypting something? Password? If you do it via a keyfile then how do you protect the keyfile? If you do it via a hardware token, how do you prevent other people from stealing and using it?
- bad_user 8y ago
  An URL with a randomized path in it is, technically, a password. Also note that the transportation mechanism is pretty weak. If the URL is passed over HTTPS, then that keeps your ISP from seeing it, however it can still show up in logs on the server side or the client side, in your history. A URL will be remembered or even cached by your browser, whereas a regular password won't, unless you explicitly allow it. A regular authentication mechanism doesn't necessarily suffer from these weaknesses. Consider that you can derive the server-side password, like a client-side hash which may even be time dependent, such that the actual password is never sent to the server. You can implement systems in which the password you know is never sent over the wire. Basically a randomized URL is semi-public and you need to treat it as such. There aren’t many alternatives to classic authentication mechanisms around. The only one I can think of is having authentication links emailed to you, but that’s also less secure and it simply defers the problem to a third-party.
  - paulryanrogers 8y ago
    If those password-URLs are one time use then they are better than a static password. Still, it's likely those are managed via email which makes that a single point of failure.
- tinus_hn 8y ago
  Not the 'my password is on a post-it attached to my monitor' issue though.
new299 8y ago
I always liked the idea of having a password entry system where a single observation doesn’t provide enough information to reveal the password [0]. However in addition to creating issues with the secure storage of the password... I don’t think people would be able to use it reliably. Still, some banks still seem to use the “enter the Nth letter of your password” scheme” which seems almostly equally unworkable... [0] https://41j.com/blog/2011/10/unobservable-pin-and-password-entry/ https://41j.com/blog/2011/10/unobservable-pin-and-password-e...
- sbradford26 8y ago
  The Nth letter of password thing sounds sketchy to me. Mostly because it sounds like they have my password in plaintext if they can check that.
  - Dayshine 8y ago
    It's usually in addition to a password.
  - chme 8y ago
    No they just store a checksum for every letter of your password. /s
    - kevin_thibedeau 8y ago
      I'd hope they at least apply ROT13.
  - dmurray 8y ago
    They may have it in 2-way encryption in a HSM. That's not what will ever be recommended in a beginner guide to handling passwords for your SaaS, but it's a reasonable approach for a bank.
  - new299 8y ago
    Yes, it almost certainly is quite sketchy... I can’t think of any way it could be securely implemented. In the case I’ve seen it’s the only password used... I wonder if there is a hashing scheme that would work with some kind of ambiguous entry... I.e. “is the 3rd digit between 5 and 10”. If you could confirm certain properties of a password/pin from its hash...
cyborgx7 8y ago
It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always be able to enter a string of characters. To quote the unix phillosphy: Text is the universal interface.
- bhaak 8y ago
  I see where you are coming from but sometimes you have to enforce some things. If you don't have 2FA, you can't login into this site is a completely rational consequence if for example this site is handling financial assets of yours. But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself).
  - acdha 8y ago
    There’s also room for nuance even with financial sites: e.g. do MFA for everything which causes money to change hands but don’t require it every time someone checks their balance or confirms that their rent check went through, especially from a frequently-used client. Similarly, if you’re not a financial site question whether you’re doing anything of value. The Netflix example is great: a huge password really doesn’t matter unless the site allows you to see stored credit card information since the worst thing someone can do is load your viewing history up with high ratings for Iron Fist. Continuing to cargo cult DoD policies from the 1970s has caused more problems than it’s stopped.
    - AstralStorm 8y ago
      Indeed, the best policy is to not store any data. Even easier to comply with GDPR this way. No account is best account. This requires that the site supports automatic completion and pasting. Quite a few sites explicitly prevent it for stupid reasons like assuming user browser is compromised. (If it is, you shouldn't be using the webpage for authentication.)
chme 8y ago
I haven't heard of any system that replaces passwords all the way. Apart from usability most systems eighter rely on things that are hard to change (biometrics), things that can be copied (keyfiles, cookies, software) or things that can be stolen (hardware token). So they don't replace something that you have to remember (password). Passwords are easy to change and while they can be copied, that would be the result of the user or the login software doing something stupid. Not something wrong with concept of the password login itself. IMO those systems can be used to make the login more secure but replacing password all together not so much.
- will4274 8y ago
  > Apart from usability most systems eighter rely on things that are hard to change (biometrics), things that can be copied (keyfiles, cookies, software) or things that can be stolen (hardware token). Actually... When you log on with a password today, an Identity Provider like Google or Microsoft typically issues you a "ticket granting ticket" (TGT) which you can use to get more tickets. The TGT is stored in a cookie on the web or in the OS. This TGT is something that be can copied. So, today, when you log on, you provide your password to get something that can be copied that you then use to log on to various services. Point being, something that can be copied is in the flow anyway, so switching from password to something that can be copied and revoked is only an improvement.
  - chme 8y ago
    "copied" in my case is something negative. I meant that as this information is stored unencrypted somewhere and can be just copied and used by an attacker to authenticate as an specific user. The ticket or cookie or what ever is just used to signify to the system that you are authenticated as user x and specific to http because it is stateless. So an implementation detail and not part of the authentication concept. I meant cookies here as data that lives in the browser forever or until the user requests a new one just using that cookie alone. And removing that cookie results in locking that account forever.
dustinmoris 8y ago
> Despite their respective merits, every one of these solutions has a massive shortcoming that severely limits their viability and it's something they simply can't compete with: > Despite it's many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. This is (mostly) true, however, there is already evidence that new technology could kill the password indeed. What I am talking about is modern phones which all come with a fingerprint scan or facial recognition which, from my own limited experience and my own observations, has mostly killed of the "passcode" on the phone. Yes our phones still make us pick a passcode, but unless forced to use it nobody does anymore. Even my technology incompetent mother uses the fingerprint scan to log into her phone and I don't see why something similar couldn't replace the current experience of her having to type an insecure password into her hotmail all the time.
- TeMPOraL 8y ago
  <insert standard argument against biometrics> Biometrics is essentially putting a massively complex system in front of your password input, that lets the device read the password off your body, but the consequences are a) you now can't ever change your password, and b) there's this massively complex system in front of (now hidden) password form, and complexity means unreliability and exploitable holes. The reason it seems to be working in phones and in laptops is just because the protected systems - personal computing devices of random members of general population - are of low importance, so it's unlikely an attacker is going to bother, whereas the convenience benefits are substantial.
  - bad_user 8y ago
    It’s also not the complexity that’s the problem. Even if it’s flawless, which is impossible, with biometrics you can easily be coerced into giving access without effort, whereas we haven’t invented a mind reader yet. In other words I can easily imagine kids gaining access to a credit card via fingerprints or facial recognition, while their parents are sleeping ;-) I wanted to write about law enforcement agencies, but this is so easy that your kids can do it.
M_Bakhtiari 8y ago
I can't help but think that browser vendors could have at least made an effort to make client certs and Kerberos authentication more user-friendly on the web. Perhaps not so useful for private consumers, but it would sure come in handy in enterprise.
- kiriakasis 8y ago
  the one feature I would like is an integrated "generate password" for one off registrations.
- wmil 8y ago
  Is there a good place to go for the current state of client certificates? I've heard that there was an issue where other websites could see the certificate, so there were privacy problems with having them installed. It seems like something that would have been fixed, but it's hard to search for. Server certificates are so much more common. They end up taking over all the search results.
jrockway 8y ago
> Despite it's [sic] many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. I think the problem is that people don't understand how to use passwords. They will reuse them among sites. They pick easily-guessable and low entropy ones. They will type them into any website that asks. The end result is that not much security is provided. (Things are just as bad on the server side, of course. Developers store them in plain text. They will email them to you. They delete entropy so that you can use your password to log in over the phone or from a computer terminal that apparently only has capital letters. I've even seen a website where the password is sent to the browser and the password checking happens in Javascript. Not great guys, not great.)
- amf12 8y ago
  > I think the problem is that people don't understand how to use passwords. They do understand it. They just trade security for laziness.
  - sametmax 8y ago
    Exactly. The thing is, they keep doing it because... it works. The vast majority of the time, for the vast majority of people, it never results in any issue at all. And solve plenty of their problems.
  - FooBarWidget 8y ago
    Agreed. I've tried educating non-technical friends and family about insecure passwords and how random long strings are more secure. Their responses are: 1. "I can't remember that password! / I don't want to type that!" 2. "I'm a nobody, hackers wouldn't be interested in me. My account has no interesting data." [explanations about botnets doing damage to others go way over their heads] 3. "If someone REALLY wants to hack me then I can't stop them anyway." They think that the inconveniences of secure password practices are not worth it. I don't think a password manager will solve it for them. Especially older family members are "afraid of technology" - they are constantly worried that they will break something, and when something is written on the screen 9 out of 10 times they have no idea what it means. I have enough trouble explaining how copy-paste works — I don't think I can explain them what a password manager is, or how to keep in in sync across their devices, let alone convincing them to pay for such a thing. I've tried the low-tech way. Advising them to use XKCD-style password and writing them down on paper. The result: they keep passwords over multiple pieces of paper/notebooks and they always lose them. I've resorted to PMaaS — Password Management as a Service. In other words: I dictate what passwords they use, and I manage it for them in my password manager. Their login method is to call me to retrieve their login credentials.
orblivion 8y ago
If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all? What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? How could that _possibly_ be more friction? It would be strictly less. Hell, it could be done without even informing the user that this new feature was being rolled out, and they sure as hell wouldn't complain about inconvenience because of a step removed from the login process. Asking people to deal with more and more and longer and longer passwords is a usability nightmare. It's a absurdity.
- nathantotten 8y ago
  I wouldn’t say 2FA or password managers have “taken off”. I don’t have numbers, but just from my small sample of friends/family, only people who are technically advanced or who I have forced (my wife ;) use password managers.
  - orblivion 8y ago
    Well hey, it's a start. They've got more adoption than Troy claims any of the niche experimental password replacers do.
- kiriakasis 8y ago
  For one 2FA is (often) an addition to password and almost always it is required only at registration time (e.g. email confirmation)
- bspammer 8y ago
  The claim wasn't that nobody understands anything other than passwords, it was that everyone understands passwords.
  - orblivion 8y ago
    The claim was that nothing else will take off. 2FA and password maangers at least are used out there beyond a niche thing nobody ever heard of (which is how he described the viability of other schemes he didn't bother naming)
iamgopal 8y ago
Password is like email, even slack would not be able to kill it.
- ndnxhs 8y ago
  Because I don't want to use some proprietary silo for communication just like I don't want to install some websites shitty app to be able to log in.
devit 8y ago
Here's the "password" killer: generating random passwords on the server and never letting users input their own passwords. All issues with reused passwords, password strength, hashing passwords with slow hashes, etc. instantly solved. Also improves conversion rate since there's no risk the user gives up signing up because he can't be bothered to think about or generate a password.
- LeonM 8y ago
  Except that people won't be able to remember them, so expect massive churn when it's time for them to enter the password the very first time.
  - devit 8y ago
    Just set a never-expiring authentication cookie in the browser, so they never need to enter the password in typical one-device use. When they need to change devices, have the standard e-mail based password reset as well as "show password" in the account settings (make the password reset not reset login, unless the user explicitly elects to "log me out on all devices").
    - thecatspaw 8y ago
      > show password You should not be able to do that if you're doing security properly. If you can show the password it means you're not hashing it properly and instead storing it as plaintext
      - devit 8y ago
        1. You can store it on the client side in a cookie. 2. You can encrypt the passwords with a key outside of the database instead of hashing them. That means that people can now login with a read-only compromise of both your app and the database, but chances are that such a compromise would be a full compromise anyway. 3. You can also not show them the current password, but instead generate another one and have them both be valid (until explicitly revoked)
ilovetux 8y ago
I think that a lot of the problems that are inherent to passwords might be mitigated by not allowing the user to choose a password. A strong, randomly generated password being given to the user and changed periodically would almost force the user to use some sort of password manager. If this were adopted industry-wide (a big ask, I know) then users would be able to use the familiar "enter username and password" system while being protected from common mistakes/misjudgments.
- lexs 8y ago
  At that point why not just switch to PKI?
  - ilovetux 8y ago
    pki is a barrier to entry for most. the user would have to set their browser up to present a unique key pair for each site they use. I think mutual auth is better suited to automated administrative tasks.
    - lexs 8y ago
      but isn't a password manager just as much of a barrier in this context?
      - ilovetux 8y ago
        I don't believe so, I remember learning about Public Key Infrastructure a while ago. It's one of those things (kind of like git) where there is a steep learning curve up front, but once you understand it seems simple. A password manager on the other hand is just a place to store credentials. Credentials is a concept that most people understand. A password manager in this context could be as simple as a text file on your desktop (not a great idea), or the one included with your browser (a little better, but make sure you set a master password), but if you want more features there are more sophisticated options available.
        8y ago
deleted 8y ago
[deleted]
guidodassori 8y ago
The only password killer is a password manager. And guess what, is password protected.
- marcosdumay 8y ago
  Keepass can use a key file too.
  - kevin_thibedeau 8y ago
    Turning "something you know" into "something you have"... or anyone else can have too.
    - TremendousJudge 8y ago
      or worse (and more likely), it's something you can lose
    - marcosdumay 8y ago
      It's turning "something you know" into "something you know and something you have". For most people it's completely redundant because the passwords database is also "something you have". But it leads to some nice possibilities.
  - guidodassori 8y ago
    I use unix pass with GPG, I know what you mean. And how the key is protected? By a password. You can stretch the chain, but at the end the point is the same.
- stephenr 8y ago
  I don't know what password manager you use, but I use TouchID to access mine. Yes it still has a password, which I can type if I need to, but it's a device-local password (or PIN in the case of my phone). I feel like every argument against password managers, uses the worst possible implementation as their basis for how they work.
lifeisstillgood 8y ago
Ancient Egyptians probably made the same argument "Keys just won't work - everyone knows how to use a door knob, but these new dangled keys, no one carries them, we have not invented key rings yet so people will fumble. Best not to." No people dealt with keys and locks because they did not want their stuff stolen. As more and more valuable stuff is kept behind our passwords we will accept more and more cost to protect them.
- Wowfunhappy 8y ago
  Keys aren't actually secure at all. Anyone with a lock-pick and a bit of practice can break in. I'd say that's actually about equivalent to a poor password—it's not that secure, but random person off the street won't be able to break in with a snap of the finger. Yes, with a password on the internet, there are far more possible attackers because you can attempt to break in from anywhere in the world. But that's somewhat beside the point—the standard locks we use on our homes are absolutely about convenience above ideal security. We could use locks that are more difficult to break, or keypads that require you to both turn the key and input a passcode. Most of us don't.
  - ken 8y ago
    Old joke: "What's a padlock for? Keeps honest people out."
  - lifeisstillgood 8y ago
    It's kind of not the point - there are levels of security we accept because they match the cost / benefit ratio - at least the perceived cost benefit ratio. thousands (millions?) of people are daily losing money / privacy due to poor "locks" on our digital doors. if millions of people were burgled every day then these poor quality locks would be replaced with hardened steel doors and seven tumbler whatevers. I think it is the invisibility of the attacks that is mispricing the cost/benefit ratio, and allowing the idea "people won't accept anything better than passwords" A friend recently lost control of his business email, which lead to someone asking a client to chnage bank routing detail before paying an invoice - police were involved but it's still not clear what's going to happen. He is not happy with passwords. Now as these scenarios spread, as attacks cost more money, we will see the perceived cost benefit sweet spot chnage - away from weaker security and towards better solutions - password managers, 2FA, U2F etc. we will give up our passwords. if the cost not too is too great.
auslander 8y ago
Related, looks interesting, generated QR on login pages. A big thread: https://news.ycombinator.com/item?id=14459537 https://news.ycombinator.com/item?id=14459537
PunchTornado 8y ago
still blows my mind how companies like medium think they use a superior system by making you log in to email in order to log in to medium.com makes my 1password app useless and I just don't bother to login to medium => irrelevant articles => less time spent there.
scraft 8y ago
I signed up for something recently and on the password screen it popped up with something along the lines of "Hey, can we generate a secure password for you, don't worry, your browser will remember it for you?" I said yes, sure enough a strong password appeared and Chrome offered to remember it. Seemed like a nice introduction to using secure passwords. The next thing I signed up for I manually generated a secure password and pasted it in and that is now stored in my browser too.
- Wowfunhappy 8y ago
  And now that person is forever locked in to the browser they were using at sign up time. What happens if they move from Mac → Windows or Android → iOS?
  - Ajedi32 8y ago
    As long as they use the same browser on each of those platforms, they're good. Yes, vendor lock-in is an issue; and I hope eventually there'll be a way to sync credentials across browsers. But keep in mind that, even as things are now, it only locks you to a specific browser, not to a specific OS.
    - Filligree 8y ago
      Exporting the passwords is also possible, so it's not really much lock-in. Not to the kind of person who'd care, and want to switch browsers.
      - Skunkleton 8y ago
        You got it backwards. Vendor lock-in rarely applies to experts. It is the people who "don't care" that _we_ should care about protecting from lock-in. After all, that is how we got internet explorer 6.
        Filligree 8y ago
        Those, in my experience, are the same people who can't switch browsers. They aren't capable of learning new things, and can often barely keep going with what they have.
BitterSweets 8y ago
Closest to a password killer I've used so far is the built-in iCloud Keychain. My iPhone and MacBook both have access to the same passwords and most of the are randomly generated.
- jakelazaroff 8y ago
  Additionally, iOS now integrates third-party password managers, so you get the same convenience with e.g. 1Password.
- aeternus 8y ago
  Ever watch security footage that overlooks people using iPhones? It's amazing how many sites display the plain-text password on the screen briefly even when using Keychain.
Ajedi32 8y ago
WebAuthn is coming. In fact, it's actually already here. There are only two things it needs before it can start to take over the world: a cross-browser, cross-platform implementation with synced credentials, and server-side implementations from a few large companies like Google and Facebook. A cross-browser, cross-platform implementation with synced credentials will solve the one remaining usability issue WebAuthn has; the need for users to register every device with the site they want to sign up on. It's not acceptable for users to sign up on their PCs and then have to jump through a bunch of hoops to sign in on their phones; and bootstrapping with passwords eliminates many of the benefits of Web Authn. Implementations from major companies will solve the chicken-egg problem that Troy mentions. Once the system is commonplace, smaller sites will be less hesitant to jump on board with an authentication solution that's different from the password-based one that users are used to.
- quickben 8y ago
  And that too, won't be a password killer. Heck almost 20 years ago Nortel had something better than what you described, and still we have passwords around. Everything old is new again, today we are solving passwords with X, tomorrow with Y, etc.
  - Ajedi32 8y ago
    Webauthn is a web standard; not a proprietary product by a company I've never heard of. Whatever it was Nortel had, I highly doubt it was as usable or ubiquitous as what WebAuthn already is.
- creeble 8y ago
  Doesn't WebAuthn require hardware? I can't find any user examples that don't mention a phone or yubikey or whatever.
  - detaro 8y ago
    No, it doesn't. It's the most advertised scenario, but a software application could act as an Authenticator too. The spec explicitly mentions platform authenticators that just require a PIN as a possibility.
creeble 8y ago
I just wish there were a more universal acceptance of entropy. I.e.: Use at least one upper case letter and symbol OR Use a password that is at least 20 characters long Passwords are fine, it's the differing standards that are nutty. Especially when you don't know them until after trying.
- bhauer 8y ago
  You can satisfy most entropy requirements without even trying by using a password manager's "create random password" feature. I feel the more important thing to attack is making password management more approachable to laypeople. To your point though: the most bothersome constraint put on passwords by applications and web sites are limits such as restricting certain special characters (To what end? You're going to hash it anyway, so why limit my special characters? You are going to hash it, right?) and limiting password length to something surprisingly short like 16 characters.
  - creeble 8y ago
    Password manager? That's what I'm trying to eliminate because they are inconvenient. But I totally agree with your point about limiting special characters and length.
  - TremendousJudge 8y ago
    my _bank_ requires passwords to be exactly 8 characters and is case insensitive. when I first realized I literally couldn't believe it, it's infuriating
    - ajford 8y ago
      Sounds like it might be time to switch banks....
      - TremendousJudge 8y ago
        I know, but it's one of those things that are much easier said than done sadly
rocqua 8y ago
From the article: > I'm referring to passwordless solutions that involves things like QR codes, pictorial representations, 3rd party mobile apps, dedicated hardware devices or "magic" links sent via email. I'm not entirely sure the argument holds for the magic links sent via email. To me, those feel like lower friction that entering a password. Because all of a sudden, users don't have to remember their password. For any company considering this, I'd suggest looking at how often the 'forgot my password please send me an email' feature is used. I know that, before I had a password manager, there were accounts where I simply never remembered my password. I had to use them like once every month, and it was easier to just get the password reset link. Now consider how much easier a 'click here and be logged in' link is than a password reset system. This only really gives friction for those few people who aren't always connected to their e-mail system. On account creation, this system is even better. All a user needs to enter is their e-mail address. No more needing to enter a password (twice!). No more dealing with password requirements. "magic" e-mail links feel like they really could be a password killer in terms of lower friction. However, it isn't clear at all that "magic" e-mail links are more secure than passwords. I'd guess that, given enough adoption, they'd develop some issues.
- ryan-c 8y ago
  There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link. So then you need to open the link in the same browser you want to use. But what if you want to log in on a desktop browser and only have your email on your phone? Maybe have the magic link show a couple letters you need to type into the browser?
  - comma-ampersand 8y ago
    You might as well email them the letters.
  - BillinghamJ 8y ago
    They are trivially solvable problems. PKCE and just displaying a QR code if you open it on the wrong device makes it pretty much foolproof. e.g.: https://magic.cuvva.com/auth-callback?code=authzcode_000000BUbZIHZJMzS8f4NLD7tmltY.fa5e2579d6693016765cf04d2c69b3a58785352591244b69c0e04f3c0e5411ce&state=Ijn8I4qQr6HqfG0kxh05rsLmF4IqB3JNchgpbSRR7HY https://magic.cuvva.com/auth-callback?code=authzcode_000000B... We're oriented around mobile use cases. Admittedly less ideal if you don't have your email on your desktop. But ultimately, if all else fails, you can always log into your webmail. For me the key thing is that it doesn't rely on users having any particular knowledge or understanding best practices - they just need to hit the big green button. Sure people are more used to passwords, but that doesn't mean the usability of magic links isn't still better despite them being much less common. Normal people are so bad at dealing with passwords. They reuse them, they forget them, they write them down on text files on their computer. Almost anything is better if your userbase isn't primarily technically adept people. And frankly most popular email providers are pretty good at keeping the accounts secure. Likely much better than anything homegrown we could do. Especially given the fact that you'll just end up having password resets via email anyway.
PhasmaFelis 8y ago
> The point of all this is that usability is an absolutely essential attribute of the auth discussion. What I often find when I have these discussions is a myopic focus on technical merits. This problem is ubiquitous to all of tech, pretty much. It's particularly iconic to FOSS grognards like Richard Stallman. Software that respects people's rights is fantastic, and we need more of it, but if you're not making that software usable then you're wasting your time.
PopeDotNinja 8y ago
One thing I like about passwords is they live in my head. No one can force to me give it up easily. But with a fingerprint or retina scan, anyone can push me up to a sensor and force me to supply the bodypart(s) needed to authenticate.
zyx321 8y ago
Passwords, if used correctly, are extremely secure. However 99% of my accounts are just not important enough to warrant that level of security. I don't worry about someone cutting off my finger in order to steal my Reddit account. My Github account doesn't have any projects that aren't forked elsewhere. Temporarily losing access to Steam for a day or two would not be the end of the world. I have two-factor authentication for email, cloud storage, and banking. For everything else just give me convenience over security, please.
sgustard 8y ago
This is an interesting argument, given that my phone over the past few years has moved from passcodes to Touch ID to Face ID. Most apps and sites on my phone that want to prompt me for a password are intercepted by the OS, which generates a one-time code and authenticates me via the same Touch/Face ID. The number of passwords I actually key in has been dropping steadily to near zero.
turc1656 8y ago
All valid points. But there two other main reasons I see as why (strong) passwords are essentially a superior choice to everything: 1) Using passwords properly is an exceptionally powerful way of protecting your account/data/etc. If you use strong, unique passwords and store in a password manager (with the PW database encrypted, of course), it's virtually impossible to break into anything on the user side of things. You might be able to gain access via the server/business side depending on the hack you are pulling off, but that's on the company rather than the user. For instance, I do personally have my passwords stored in a password manager with an encrypted database. They're all unique and strong, as is the password used to access the password database. That password exists only in my mind. It's not written down anywhere or stored in some file on any computer. It's not physically printed out on paper or anything like that. It literally only exists in my head. And given its complexity and length, there is effectively nothing that will be able to break it in any reasonable amount of time. The government also can't force it from me as they could with other methods like 2FA, QR codes, fingerprints, etc. due to 1st amendment issues. Basically, short of getting me to log in from a compromised (i.e. keylogged) device (highly unlikely) or torturing me for the info, there's no way of getting it. And if you're willing to torture me for it - ok, you win then. 2) From a technical point - basically every device we would use to log into anything has either a keyboard (whether physical or on-screen) or some sort of keypad (again, physical or on-screen). This makes for universal compatibility. If people need to have special QR-code scanning/creation software installed on a device, or fingerprint-reading hardware - that creates a non-trivial barrier to the device compatible with the login process.
- krupan 8y ago
  "If you use strong, unique passwords and store in a password manager (with the PW database encrypted, of course)" You aren't talking about passwords the same way everyone else here, especially TFA, is talking about passwords. You might as well be talking about RSA keys at this point.
  - tialaramex 8y ago
    Perhaps more appropriately AES keys, as they are a shared secret (shared with the target site even if it's using a decent password hash) rather than a private key.
tzs 8y ago
> Netflix requiring... 4. But I'm hesitant to berate Netflix for what seems like an extremely low number because they're also dealing with the usability challenge that is people logging on to TVs with remote controls Amazon handled this great when I set up Prime Video streaming on my Sony Blu-Ray player. I don't remember the exact sequence because it was 8 years ago, but it was something like this: 1. Go to Amazon on my computer, log in, and tell them I'm trying to set up a new device for Prime Video streaming. They ask me for the make and model and serial number, which was available on the device in the Prime Video app. 2. Amazon gives me an integer. I don't remember the length, but I'm pretty sure it was in the 4-6 digit range. 3. On the Blu-Ray player, give that integer to the Amazon Prime Video app, and it completes the setup.
krupan 8y ago
Troy Hunt's whole career is basically based on the brokenness of passwords, but now he's defending them here, and then touting his own services that claim to make passwords better. Something is fishy here. It could be that passwords are terrible, but everything else is worse, but I'm not convinced. We have had a big push towards SSL (TLS, actually) everywhere lately. I don't have to ask Amazon for a password to verify that it's really Amazon that I'm transacting with. It really feels like we should be able to come up with a seamless way for that to work both ways in every web transaction.
- mkane848 8y ago
  >passwords are terrible, but everything else is worse I mean, isn't that a decent summary of a lot of things we rely on in the real world? Too late to stop, already out running in the wild, and everyone hates it but are used to using it, but what's the alternative? NJTRANSIT, I'm looking at you.
- onion2k 8y ago
  Troy Hunt's whole career is basically based on the brokenness of passwords... That's unfair. Troy's career is based on the brokenness of bad password implementations, not passwords themselves.
  - krupan 8y ago
    If every implementation of an idea is bad, maybe the idea is bad
    - onion2k 8y ago
      They aren't all bad.
    - ranman 8y ago
      Is this a JavaScript joke?
MrStonedOne 8y ago
Passwords can always be used. You can forget a password, but you can't drop it down a storm drain, or have it all of the sudden fail to boot, or forget to bring it when you're at a friends house and now you can't answer your user's calls to fix the site that went down for some reason.
balibebas 8y ago
Did I just see a popover cross-selling products on my mobile? It covered about half the screen.
Anonymous4C54D6 8y ago
Has anybody made a list of [Insert Thing Here]s? I'm curious what kind of trade-offs they offer.
- nickpsecurity 8y ago
  Here's a great one from Pico project: http://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf http://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-... Other publications that might interest you: http://pico.cl.cam.ac.uk/technical/ http://pico.cl.cam.ac.uk/technical/ Ross Anderson's blog, LightBlueTouchpaper, has writeups on this in authentication category.
beatgammit 8y ago
What about forcing some set of users to change their password if it shows up in a breach?
- TheDong 8y ago
  Troy hunt created a service for this. He provides an API where you can securely check if a user's password is pwned without revealing the password to his server. He's written about it several times, here's one of the posts: https://www.troyhunt.com/enhancing-pwned-passwords-privacy-by-exclusively-supporting-anonymity/ https://www.troyhunt.com/enhancing-pwned-passwords-privacy-b...
xte 8y ago
Why I like passwords (and various key locked/unlocked with passwords? Simply because I can change them, I control them. Biometrics is unsafe by design because our body can change outside our control and our body is public enough and unchangeable enough to be a REALLY unsafe authentication system for anything but human being interacting together. External other-factor auths like OTP, side verification, port-knocking, ... are good, but they still need a password somewhere in the chain. So no, it's not only a matter of reactionary users not willing to change but also a matter of rational safety reasoning.
- danielrm26 8y ago
  When current bio-related credentials are stolen, they're not stealing your hand or your iris or your face. They're stealing destructive hashes of those things. It'd be like having someone sketch a stick figure version of you, and then you claim your identity was stolen. No, it wasn't. Stick figure drawings only work in stick figure readers.
  - xte 8y ago
    Take a look at some "sophisticated" retinal scan, they are in the end cameras, a special kind one. Fingerprint readers? Another kind of scanner. It doesn't matter that today's only few simpler model can be cracked with a single strip of scotch, it's only a matter of time. And we can go up, even imaging quick DNA scanner, quick enough and smart, it does not change that much, your DNA can be grabbed around you in many way. The essential point is simple: using your body means using an exposed key, using a password means using your brain that it's far harder to "expose". Also passwords are trivial enough, you can even check your keyboard for builtin keylogger, protect your environment from camera, microphone (phone/audio analyze to determine key's you press) etc. Try to hw check a biometric system and well... Good luck.
elwell 8y ago
At ClearCoin, we use a stored private key in the user's browser extension to sign every authenticated request. The signature is verified on the server, checking that it matches the Ethereum wallet address listed in the payload.
comma-ampersand 8y ago
What is wrong with magic links exactly? Email already is the single point of failure, password resets. People are already used to looking at their email, account verification etc. People are already used to looking at their email after signing in, 2nd factor with email exists on some sites. Downsides are that they might be scanned by security software and visited, but surely that's also a problem for verification links? I can't imagine that people would appreciate accounts being automatically verified... All other reasons I can think of indicate a problem with password resets as well, which also gives access to the account anyway.
- BillinghamJ 8y ago
  On a properly implemented magic link system, automatic visiting wouldn't be an issue at all. Should only work within the same originating session, and ideally should use PKCE too.
Svoka 8y ago
In my humble opinion, very few know how to use a password. Most of the people still believe that their cat name starting with a capital letter and with 1 in the end is a good password. Or that once you have a good password it is enough to use it everywhere. Same passwords everywhere is not a security, it's a vision of security. It may surprise author that main reason to provide authentication is to give some security, and in case of every single non-it person I know their passwords are just an illusion. So, I would argue, while anyone can type in some staff, how to make it secure is rare knowledge almost no one has. So, is it, really "everyone knows how it works"? Or just everyone repeating their not quite secure passwords to make machine happy without any understanding of consequences
- dgzl 8y ago
  You could argue that few people use passwords in a properly secure manner, and you'd likely be right, but the real question is what will replace passwords? The truth you describe doesn't mean that we should convince people to use passwords correctly, rather that passwords aren't the best security medium for humans. It's unreasonable for people to be expected to craft highly secure, brand new passwords each time they need one, and also expect it to be stored in long-term memory. That process is simply out of scope for most humans. So then, how do we make this easier without compromising security?
codedokode 8y ago
I don't agree with the author. Passwords are difficult to remember and easy to steal. Example I saw: old people write their card's PIN code on it because they cannot remember it. Everyone knows how to use it, you say? I think that for an average, not computer-loving type of person, a hardware key is the best solution. You don't need to remember anything: just insert the key and press the button. Why aren't they popular? I think because they are not a standard and are not built in. You don't get a free key when buying a laptop or a smartphone and that's the main reason why nobody is using them. But there already are applications that don't use passwords. For example, Telegram (IM application): when you install it you only have to enter your phone number, it sends the code in SMS, the app reads the code without user's interaction, and authenticates the device. No passwords, no need to remember anything. I don't like this (it is not convenient for those who use a burner phone number for registration), but for a more typical user it is convenient and doesn't require them to remember anything. I think we will see more passwordsless authentication in the future.
- Leace 8y ago
  When using hardware keys remember to register at least two. In case one stops working or is lost/stolen you're locked out of your account. Backup codes help but they're another barrier one have to remember.
_pdp_ 8y ago
Sign up for monzo and some of the new banking apps and try to find really hard a password field anywhere.
czei002 8y ago
If done right, passwords are a very powerful and universal auth method, i.e. all credentials can be remembered and no third party or auth device are needed (e.g. you are still able to login even when you lost all your belongings while traveling). However, there are problems when reusing passwords and passwords are usually leaked to the remote party when authenticating, e.g. its trivial for a web service to learn what password or password pattern you are using. I am working on an open source project called FejoaAuth where we are working on a secure authentication solution that does not leak the password during login. This allows to reuse a password, e.g. to use a password for authentication and for data encryption. This makes true one password solutions possible. Its an open source project so please get in contact :) https://fejoa.org/fejoapage/auth.html https://fejoa.org/fejoapage/auth.html

213 points by nikbackm 8y ago

A little boring and reactionary, I think. Unguessable capabilities (long unchoosable URLs mostly) have been used to replace passwords. Plenty of systems refuse to let users choose passwords, and many common password problems are totally mitigated by this design.

chme 8y ago
That depends on what you want to do. Do you want to authenticate the system of the user or the user him/herself? If its the latter, then how do you protect the link from other uses of this system? Encryption? And how are you encrypting something? Password? If you do it via a keyfile then how do you protect the keyfile? If you do it via a hardware token, how do you prevent other people from stealing and using it?
bad_user 8y ago
An URL with a randomized path in it is, technically, a password. Also note that the transportation mechanism is pretty weak. If the URL is passed over HTTPS, then that keeps your ISP from seeing it, however it can still show up in logs on the server side or the client side, in your history. A URL will be remembered or even cached by your browser, whereas a regular password won't, unless you explicitly allow it. A regular authentication mechanism doesn't necessarily suffer from these weaknesses. Consider that you can derive the server-side password, like a client-side hash which may even be time dependent, such that the actual password is never sent to the server. You can implement systems in which the password you know is never sent over the wire. Basically a randomized URL is semi-public and you need to treat it as such. There aren’t many alternatives to classic authentication mechanisms around. The only one I can think of is having authentication links emailed to you, but that’s also less secure and it simply defers the problem to a third-party.
- paulryanrogers 8y ago
  If those password-URLs are one time use then they are better than a static password. Still, it's likely those are managed via email which makes that a single point of failure.
tinus_hn 8y ago
Not the 'my password is on a post-it attached to my monitor' issue though.

new299 8y ago

I always liked the idea of having a password entry system where a single observation doesn’t provide enough information to reveal the password [0]. However in addition to creating issues with the secure storage of the password... I don’t think people would be able to use it reliably. Still, some banks still seem to use the “enter the Nth letter of your password” scheme” which seems almostly equally unworkable... [0] https://41j.com/blog/2011/10/unobservable-pin-and-password-entry/ https://41j.com/blog/2011/10/unobservable-pin-and-password-e...

sbradford26 8y ago
The Nth letter of password thing sounds sketchy to me. Mostly because it sounds like they have my password in plaintext if they can check that.
- Dayshine 8y ago
  It's usually in addition to a password.
- chme 8y ago
  No they just store a checksum for every letter of your password. /s
  - kevin_thibedeau 8y ago
    I'd hope they at least apply ROT13.
- dmurray 8y ago
  They may have it in 2-way encryption in a HSM. That's not what will ever be recommended in a beginner guide to handling passwords for your SaaS, but it's a reasonable approach for a bank.
- new299 8y ago
  Yes, it almost certainly is quite sketchy... I can’t think of any way it could be securely implemented. In the case I’ve seen it’s the only password used... I wonder if there is a hashing scheme that would work with some kind of ambiguous entry... I.e. “is the 3rd digit between 5 and 10”. If you could confirm certain properties of a password/pin from its hash...

cyborgx7 8y ago

It is not just that everyone knows how passwords work. It is also that you can always enter a password. What if I don't have my phone to scan a qr-code? What if I want to use a minimalistic browser that doesn't implement a key pair store and I don't want to or can't set up one external? What if my minimal browser is text only? What if I'm on another device and don't have my stuff on there? I will pretty much always be able to enter a string of characters. To quote the unix phillosphy: Text is the universal interface.

bhaak 8y ago
I see where you are coming from but sometimes you have to enforce some things. If you don't have 2FA, you can't login into this site is a completely rational consequence if for example this site is handling financial assets of yours. But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself).
- acdha 8y ago
  There’s also room for nuance even with financial sites: e.g. do MFA for everything which causes money to change hands but don’t require it every time someone checks their balance or confirms that their rent check went through, especially from a frequently-used client. Similarly, if you’re not a financial site question whether you’re doing anything of value. The Netflix example is great: a huge password really doesn’t matter unless the site allows you to see stored credit card information since the worst thing someone can do is load your viewing history up with high ratings for Iron Fist. Continuing to cargo cult DoD policies from the 1970s has caused more problems than it’s stopped.
  - AstralStorm 8y ago
    Indeed, the best policy is to not store any data. Even easier to comply with GDPR this way. No account is best account. This requires that the site supports automatic completion and pasting. Quite a few sites explicitly prevent it for stupid reasons like assuming user browser is compromised. (If it is, you shouldn't be using the webpage for authentication.)

chme 8y ago

I haven't heard of any system that replaces passwords all the way. Apart from usability most systems eighter rely on things that are hard to change (biometrics), things that can be copied (keyfiles, cookies, software) or things that can be stolen (hardware token). So they don't replace something that you have to remember (password). Passwords are easy to change and while they can be copied, that would be the result of the user or the login software doing something stupid. Not something wrong with concept of the password login itself. IMO those systems can be used to make the login more secure but replacing password all together not so much.

will4274 8y ago
> Apart from usability most systems eighter rely on things that are hard to change (biometrics), things that can be copied (keyfiles, cookies, software) or things that can be stolen (hardware token). Actually... When you log on with a password today, an Identity Provider like Google or Microsoft typically issues you a "ticket granting ticket" (TGT) which you can use to get more tickets. The TGT is stored in a cookie on the web or in the OS. This TGT is something that be can copied. So, today, when you log on, you provide your password to get something that can be copied that you then use to log on to various services. Point being, something that can be copied is in the flow anyway, so switching from password to something that can be copied and revoked is only an improvement.
- chme 8y ago
  "copied" in my case is something negative. I meant that as this information is stored unencrypted somewhere and can be just copied and used by an attacker to authenticate as an specific user. The ticket or cookie or what ever is just used to signify to the system that you are authenticated as user x and specific to http because it is stateless. So an implementation detail and not part of the authentication concept. I meant cookies here as data that lives in the browser forever or until the user requests a new one just using that cookie alone. And removing that cookie results in locking that account forever.

dustinmoris 8y ago

> Despite their respective merits, every one of these solutions has a massive shortcoming that severely limits their viability and it's something they simply can't compete with: > Despite it's many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. This is (mostly) true, however, there is already evidence that new technology could kill the password indeed. What I am talking about is modern phones which all come with a fingerprint scan or facial recognition which, from my own limited experience and my own observations, has mostly killed of the "passcode" on the phone. Yes our phones still make us pick a passcode, but unless forced to use it nobody does anymore. Even my technology incompetent mother uses the fingerprint scan to log into her phone and I don't see why something similar couldn't replace the current experience of her having to type an insecure password into her hotmail all the time.

TeMPOraL 8y ago
<insert standard argument against biometrics> Biometrics is essentially putting a massively complex system in front of your password input, that lets the device read the password off your body, but the consequences are a) you now can't ever change your password, and b) there's this massively complex system in front of (now hidden) password form, and complexity means unreliability and exploitable holes. The reason it seems to be working in phones and in laptops is just because the protected systems - personal computing devices of random members of general population - are of low importance, so it's unlikely an attacker is going to bother, whereas the convenience benefits are substantial.
- bad_user 8y ago
  It’s also not the complexity that’s the problem. Even if it’s flawless, which is impossible, with biometrics you can easily be coerced into giving access without effort, whereas we haven’t invented a mind reader yet. In other words I can easily imagine kids gaining access to a credit card via fingerprints or facial recognition, while their parents are sleeping ;-) I wanted to write about law enforcement agencies, but this is so easy that your kids can do it.

M_Bakhtiari 8y ago

I can't help but think that browser vendors could have at least made an effort to make client certs and Kerberos authentication more user-friendly on the web. Perhaps not so useful for private consumers, but it would sure come in handy in enterprise.

kiriakasis 8y ago
the one feature I would like is an integrated "generate password" for one off registrations.
wmil 8y ago
Is there a good place to go for the current state of client certificates? I've heard that there was an issue where other websites could see the certificate, so there were privacy problems with having them installed. It seems like something that would have been fixed, but it's hard to search for. Server certificates are so much more common. They end up taking over all the search results.

jrockway 8y ago

> Despite it's [sic] many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone. I think the problem is that people don't understand how to use passwords. They will reuse them among sites. They pick easily-guessable and low entropy ones. They will type them into any website that asks. The end result is that not much security is provided. (Things are just as bad on the server side, of course. Developers store them in plain text. They will email them to you. They delete entropy so that you can use your password to log in over the phone or from a computer terminal that apparently only has capital letters. I've even seen a website where the password is sent to the browser and the password checking happens in Javascript. Not great guys, not great.)

amf12 8y ago
> I think the problem is that people don't understand how to use passwords. They do understand it. They just trade security for laziness.
- sametmax 8y ago
  Exactly. The thing is, they keep doing it because... it works. The vast majority of the time, for the vast majority of people, it never results in any issue at all. And solve plenty of their problems.
- FooBarWidget 8y ago
  Agreed. I've tried educating non-technical friends and family about insecure passwords and how random long strings are more secure. Their responses are: 1. "I can't remember that password! / I don't want to type that!" 2. "I'm a nobody, hackers wouldn't be interested in me. My account has no interesting data." [explanations about botnets doing damage to others go way over their heads] 3. "If someone REALLY wants to hack me then I can't stop them anyway." They think that the inconveniences of secure password practices are not worth it. I don't think a password manager will solve it for them. Especially older family members are "afraid of technology" - they are constantly worried that they will break something, and when something is written on the screen 9 out of 10 times they have no idea what it means. I have enough trouble explaining how copy-paste works — I don't think I can explain them what a password manager is, or how to keep in in sync across their devices, let alone convincing them to pay for such a thing. I've tried the low-tech way. Advising them to use XKCD-style password and writing them down on paper. The result: they keep passwords over multiple pieces of paper/notebooks and they always lose them. I've resorted to PMaaS — Password Management as a Service. In other words: I dictate what passwords they use, and I manage it for them in my password manager. Their login method is to call me to retrieve their login credentials.

orblivion 8y ago

If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all? What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? How could that _possibly_ be more friction? It would be strictly less. Hell, it could be done without even informing the user that this new feature was being rolled out, and they sure as hell wouldn't complain about inconvenience because of a step removed from the login process. Asking people to deal with more and more and longer and longer passwords is a usability nightmare. It's a absurdity.

nathantotten 8y ago
I wouldn’t say 2FA or password managers have “taken off”. I don’t have numbers, but just from my small sample of friends/family, only people who are technically advanced or who I have forced (my wife ;) use password managers.
- orblivion 8y ago
  Well hey, it's a start. They've got more adoption than Troy claims any of the niche experimental password replacers do.
kiriakasis 8y ago
For one 2FA is (often) an addition to password and almost always it is required only at registration time (e.g. email confirmation)
bspammer 8y ago
The claim wasn't that nobody understands anything other than passwords, it was that everyone understands passwords.
- orblivion 8y ago
  The claim was that nothing else will take off. 2FA and password maangers at least are used out there beyond a niche thing nobody ever heard of (which is how he described the viability of other schemes he didn't bother naming)

iamgopal 8y ago

Password is like email, even slack would not be able to kill it.

ndnxhs 8y ago
Because I don't want to use some proprietary silo for communication just like I don't want to install some websites shitty app to be able to log in.

devit 8y ago

Here's the "password" killer: generating random passwords on the server and never letting users input their own passwords. All issues with reused passwords, password strength, hashing passwords with slow hashes, etc. instantly solved. Also improves conversion rate since there's no risk the user gives up signing up because he can't be bothered to think about or generate a password.

LeonM 8y ago
Except that people won't be able to remember them, so expect massive churn when it's time for them to enter the password the very first time.
- devit 8y ago
  Just set a never-expiring authentication cookie in the browser, so they never need to enter the password in typical one-device use. When they need to change devices, have the standard e-mail based password reset as well as "show password" in the account settings (make the password reset not reset login, unless the user explicitly elects to "log me out on all devices").
  - thecatspaw 8y ago
    > show password You should not be able to do that if you're doing security properly. If you can show the password it means you're not hashing it properly and instead storing it as plaintext
    - devit 8y ago
      1. You can store it on the client side in a cookie. 2. You can encrypt the passwords with a key outside of the database instead of hashing them. That means that people can now login with a read-only compromise of both your app and the database, but chances are that such a compromise would be a full compromise anyway. 3. You can also not show them the current password, but instead generate another one and have them both be valid (until explicitly revoked)

ilovetux 8y ago

I think that a lot of the problems that are inherent to passwords might be mitigated by not allowing the user to choose a password. A strong, randomly generated password being given to the user and changed periodically would almost force the user to use some sort of password manager. If this were adopted industry-wide (a big ask, I know) then users would be able to use the familiar "enter username and password" system while being protected from common mistakes/misjudgments.

lexs 8y ago
At that point why not just switch to PKI?
- ilovetux 8y ago
  pki is a barrier to entry for most. the user would have to set their browser up to present a unique key pair for each site they use. I think mutual auth is better suited to automated administrative tasks.
  - lexs 8y ago
    but isn't a password manager just as much of a barrier in this context?
    - ilovetux 8y ago
      I don't believe so, I remember learning about Public Key Infrastructure a while ago. It's one of those things (kind of like git) where there is a steep learning curve up front, but once you understand it seems simple. A password manager on the other hand is just a place to store credentials. Credentials is a concept that most people understand. A password manager in this context could be as simple as a text file on your desktop (not a great idea), or the one included with your browser (a little better, but make sure you set a master password), but if you want more features there are more sophisticated options available.
      - 8y ago

deleted 8y ago

[deleted]

guidodassori 8y ago

The only password killer is a password manager. And guess what, is password protected.

marcosdumay 8y ago
Keepass can use a key file too.
- kevin_thibedeau 8y ago
  Turning "something you know" into "something you have"... or anyone else can have too.
  - TremendousJudge 8y ago
    or worse (and more likely), it's something you can lose
  - marcosdumay 8y ago
    It's turning "something you know" into "something you know and something you have". For most people it's completely redundant because the passwords database is also "something you have". But it leads to some nice possibilities.
- guidodassori 8y ago
  I use unix pass with GPG, I know what you mean. And how the key is protected? By a password. You can stretch the chain, but at the end the point is the same.
stephenr 8y ago
I don't know what password manager you use, but I use TouchID to access mine. Yes it still has a password, which I can type if I need to, but it's a device-local password (or PIN in the case of my phone). I feel like every argument against password managers, uses the worst possible implementation as their basis for how they work.

lifeisstillgood 8y ago

Ancient Egyptians probably made the same argument "Keys just won't work - everyone knows how to use a door knob, but these new dangled keys, no one carries them, we have not invented key rings yet so people will fumble. Best not to." No people dealt with keys and locks because they did not want their stuff stolen. As more and more valuable stuff is kept behind our passwords we will accept more and more cost to protect them.

Wowfunhappy 8y ago
Keys aren't actually secure at all. Anyone with a lock-pick and a bit of practice can break in. I'd say that's actually about equivalent to a poor password—it's not that secure, but random person off the street won't be able to break in with a snap of the finger. Yes, with a password on the internet, there are far more possible attackers because you can attempt to break in from anywhere in the world. But that's somewhat beside the point—the standard locks we use on our homes are absolutely about convenience above ideal security. We could use locks that are more difficult to break, or keypads that require you to both turn the key and input a passcode. Most of us don't.
- ken 8y ago
  Old joke: "What's a padlock for? Keeps honest people out."
- lifeisstillgood 8y ago
  It's kind of not the point - there are levels of security we accept because they match the cost / benefit ratio - at least the perceived cost benefit ratio. thousands (millions?) of people are daily losing money / privacy due to poor "locks" on our digital doors. if millions of people were burgled every day then these poor quality locks would be replaced with hardened steel doors and seven tumbler whatevers. I think it is the invisibility of the attacks that is mispricing the cost/benefit ratio, and allowing the idea "people won't accept anything better than passwords" A friend recently lost control of his business email, which lead to someone asking a client to chnage bank routing detail before paying an invoice - police were involved but it's still not clear what's going to happen. He is not happy with passwords. Now as these scenarios spread, as attacks cost more money, we will see the perceived cost benefit sweet spot chnage - away from weaker security and towards better solutions - password managers, 2FA, U2F etc. we will give up our passwords. if the cost not too is too great.

auslander 8y ago

Related, looks interesting, generated QR on login pages. A big thread: https://news.ycombinator.com/item?id=14459537 https://news.ycombinator.com/item?id=14459537

PunchTornado 8y ago

still blows my mind how companies like medium think they use a superior system by making you log in to email in order to log in to medium.com makes my 1password app useless and I just don't bother to login to medium => irrelevant articles => less time spent there.

scraft 8y ago

I signed up for something recently and on the password screen it popped up with something along the lines of "Hey, can we generate a secure password for you, don't worry, your browser will remember it for you?" I said yes, sure enough a strong password appeared and Chrome offered to remember it. Seemed like a nice introduction to using secure passwords. The next thing I signed up for I manually generated a secure password and pasted it in and that is now stored in my browser too.

Wowfunhappy 8y ago
And now that person is forever locked in to the browser they were using at sign up time. What happens if they move from Mac → Windows or Android → iOS?
- Ajedi32 8y ago
  As long as they use the same browser on each of those platforms, they're good. Yes, vendor lock-in is an issue; and I hope eventually there'll be a way to sync credentials across browsers. But keep in mind that, even as things are now, it only locks you to a specific browser, not to a specific OS.
  - Filligree 8y ago
    Exporting the passwords is also possible, so it's not really much lock-in. Not to the kind of person who'd care, and want to switch browsers.
    - Skunkleton 8y ago
      You got it backwards. Vendor lock-in rarely applies to experts. It is the people who "don't care" that _we_ should care about protecting from lock-in. After all, that is how we got internet explorer 6.
      - Filligree 8y ago
        Those, in my experience, are the same people who can't switch browsers. They aren't capable of learning new things, and can often barely keep going with what they have.

BitterSweets 8y ago

Closest to a password killer I've used so far is the built-in iCloud Keychain. My iPhone and MacBook both have access to the same passwords and most of the are randomly generated.

jakelazaroff 8y ago
Additionally, iOS now integrates third-party password managers, so you get the same convenience with e.g. 1Password.
aeternus 8y ago
Ever watch security footage that overlooks people using iPhones? It's amazing how many sites display the plain-text password on the screen briefly even when using Keychain.

Ajedi32 8y ago

WebAuthn is coming. In fact, it's actually already here. There are only two things it needs before it can start to take over the world: a cross-browser, cross-platform implementation with synced credentials, and server-side implementations from a few large companies like Google and Facebook. A cross-browser, cross-platform implementation with synced credentials will solve the one remaining usability issue WebAuthn has; the need for users to register every device with the site they want to sign up on. It's not acceptable for users to sign up on their PCs and then have to jump through a bunch of hoops to sign in on their phones; and bootstrapping with passwords eliminates many of the benefits of Web Authn. Implementations from major companies will solve the chicken-egg problem that Troy mentions. Once the system is commonplace, smaller sites will be less hesitant to jump on board with an authentication solution that's different from the password-based one that users are used to.

quickben 8y ago
And that too, won't be a password killer. Heck almost 20 years ago Nortel had something better than what you described, and still we have passwords around. Everything old is new again, today we are solving passwords with X, tomorrow with Y, etc.
- Ajedi32 8y ago
  Webauthn is a web standard; not a proprietary product by a company I've never heard of. Whatever it was Nortel had, I highly doubt it was as usable or ubiquitous as what WebAuthn already is.
creeble 8y ago
Doesn't WebAuthn require hardware? I can't find any user examples that don't mention a phone or yubikey or whatever.
- detaro 8y ago
  No, it doesn't. It's the most advertised scenario, but a software application could act as an Authenticator too. The spec explicitly mentions platform authenticators that just require a PIN as a possibility.

creeble 8y ago

I just wish there were a more universal acceptance of entropy. I.e.: Use at least one upper case letter and symbol OR Use a password that is at least 20 characters long Passwords are fine, it's the differing standards that are nutty. Especially when you don't know them until after trying.

bhauer 8y ago
You can satisfy most entropy requirements without even trying by using a password manager's "create random password" feature. I feel the more important thing to attack is making password management more approachable to laypeople. To your point though: the most bothersome constraint put on passwords by applications and web sites are limits such as restricting certain special characters (To what end? You're going to hash it anyway, so why limit my special characters? You are going to hash it, right?) and limiting password length to something surprisingly short like 16 characters.
- creeble 8y ago
  Password manager? That's what I'm trying to eliminate because they are inconvenient. But I totally agree with your point about limiting special characters and length.
- TremendousJudge 8y ago
  my _bank_ requires passwords to be exactly 8 characters and is case insensitive. when I first realized I literally couldn't believe it, it's infuriating
  - ajford 8y ago
    Sounds like it might be time to switch banks....
    - TremendousJudge 8y ago
      I know, but it's one of those things that are much easier said than done sadly

rocqua 8y ago

From the article: > I'm referring to passwordless solutions that involves things like QR codes, pictorial representations, 3rd party mobile apps, dedicated hardware devices or "magic" links sent via email. I'm not entirely sure the argument holds for the magic links sent via email. To me, those feel like lower friction that entering a password. Because all of a sudden, users don't have to remember their password. For any company considering this, I'd suggest looking at how often the 'forgot my password please send me an email' feature is used. I know that, before I had a password manager, there were accounts where I simply never remembered my password. I had to use them like once every month, and it was easier to just get the password reset link. Now consider how much easier a 'click here and be logged in' link is than a password reset system. This only really gives friction for those few people who aren't always connected to their e-mail system. On account creation, this system is even better. All a user needs to enter is their e-mail address. No more needing to enter a password (twice!). No more dealing with password requirements. "magic" e-mail links feel like they really could be a password killer in terms of lower friction. However, it isn't clear at all that "magic" e-mail links are more secure than passwords. I'd guess that, given enough adoption, they'd develop some issues.

ryan-c 8y ago
There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link. So then you need to open the link in the same browser you want to use. But what if you want to log in on a desktop browser and only have your email on your phone? Maybe have the magic link show a couple letters you need to type into the browser?
- comma-ampersand 8y ago
  You might as well email them the letters.
- BillinghamJ 8y ago
  They are trivially solvable problems. PKCE and just displaying a QR code if you open it on the wrong device makes it pretty much foolproof. e.g.: https://magic.cuvva.com/auth-callback?code=authzcode_000000BUbZIHZJMzS8f4NLD7tmltY.fa5e2579d6693016765cf04d2c69b3a58785352591244b69c0e04f3c0e5411ce&state=Ijn8I4qQr6HqfG0kxh05rsLmF4IqB3JNchgpbSRR7HY https://magic.cuvva.com/auth-callback?code=authzcode_000000B... We're oriented around mobile use cases. Admittedly less ideal if you don't have your email on your desktop. But ultimately, if all else fails, you can always log into your webmail. For me the key thing is that it doesn't rely on users having any particular knowledge or understanding best practices - they just need to hit the big green button. Sure people are more used to passwords, but that doesn't mean the usability of magic links isn't still better despite them being much less common. Normal people are so bad at dealing with passwords. They reuse them, they forget them, they write them down on text files on their computer. Almost anything is better if your userbase isn't primarily technically adept people. And frankly most popular email providers are pretty good at keeping the accounts secure. Likely much better than anything homegrown we could do. Especially given the fact that you'll just end up having password resets via email anyway.

PhasmaFelis 8y ago

> The point of all this is that usability is an absolutely essential attribute of the auth discussion. What I often find when I have these discussions is a myopic focus on technical merits. This problem is ubiquitous to all of tech, pretty much. It's particularly iconic to FOSS grognards like Richard Stallman. Software that respects people's rights is fantastic, and we need more of it, but if you're not making that software usable then you're wasting your time.

PopeDotNinja 8y ago

One thing I like about passwords is they live in my head. No one can force to me give it up easily. But with a fingerprint or retina scan, anyone can push me up to a sensor and force me to supply the bodypart(s) needed to authenticate.

zyx321 8y ago

Passwords, if used correctly, are extremely secure. However 99% of my accounts are just not important enough to warrant that level of security. I don't worry about someone cutting off my finger in order to steal my Reddit account. My Github account doesn't have any projects that aren't forked elsewhere. Temporarily losing access to Steam for a day or two would not be the end of the world. I have two-factor authentication for email, cloud storage, and banking. For everything else just give me convenience over security, please.

sgustard 8y ago

This is an interesting argument, given that my phone over the past few years has moved from passcodes to Touch ID to Face ID. Most apps and sites on my phone that want to prompt me for a password are intercepted by the OS, which generates a one-time code and authenticates me via the same Touch/Face ID. The number of passwords I actually key in has been dropping steadily to near zero.

turc1656 8y ago

All valid points. But there two other main reasons I see as why (strong) passwords are essentially a superior choice to everything: 1) Using passwords properly is an exceptionally powerful way of protecting your account/data/etc. If you use strong, unique passwords and store in a password manager (with the PW database encrypted, of course), it's virtually impossible to break into anything on the user side of things. You might be able to gain access via the server/business side depending on the hack you are pulling off, but that's on the company rather than the user. For instance, I do personally have my passwords stored in a password manager with an encrypted database. They're all unique and strong, as is the password used to access the password database. That password exists only in my mind. It's not written down anywhere or stored in some file on any computer. It's not physically printed out on paper or anything like that. It literally only exists in my head. And given its complexity and length, there is effectively nothing that will be able to break it in any reasonable amount of time. The government also can't force it from me as they could with other methods like 2FA, QR codes, fingerprints, etc. due to 1st amendment issues. Basically, short of getting me to log in from a compromised (i.e. keylogged) device (highly unlikely) or torturing me for the info, there's no way of getting it. And if you're willing to torture me for it - ok, you win then. 2) From a technical point - basically every device we would use to log into anything has either a keyboard (whether physical or on-screen) or some sort of keypad (again, physical or on-screen). This makes for universal compatibility. If people need to have special QR-code scanning/creation software installed on a device, or fingerprint-reading hardware - that creates a non-trivial barrier to the device compatible with the login process.

krupan 8y ago
"If you use strong, unique passwords and store in a password manager (with the PW database encrypted, of course)" You aren't talking about passwords the same way everyone else here, especially TFA, is talking about passwords. You might as well be talking about RSA keys at this point.
- tialaramex 8y ago
  Perhaps more appropriately AES keys, as they are a shared secret (shared with the target site even if it's using a decent password hash) rather than a private key.

tzs 8y ago

> Netflix requiring... 4. But I'm hesitant to berate Netflix for what seems like an extremely low number because they're also dealing with the usability challenge that is people logging on to TVs with remote controls Amazon handled this great when I set up Prime Video streaming on my Sony Blu-Ray player. I don't remember the exact sequence because it was 8 years ago, but it was something like this: 1. Go to Amazon on my computer, log in, and tell them I'm trying to set up a new device for Prime Video streaming. They ask me for the make and model and serial number, which was available on the device in the Prime Video app. 2. Amazon gives me an integer. I don't remember the length, but I'm pretty sure it was in the 4-6 digit range. 3. On the Blu-Ray player, give that integer to the Amazon Prime Video app, and it completes the setup.

krupan 8y ago

Troy Hunt's whole career is basically based on the brokenness of passwords, but now he's defending them here, and then touting his own services that claim to make passwords better. Something is fishy here. It could be that passwords are terrible, but everything else is worse, but I'm not convinced. We have had a big push towards SSL (TLS, actually) everywhere lately. I don't have to ask Amazon for a password to verify that it's really Amazon that I'm transacting with. It really feels like we should be able to come up with a seamless way for that to work both ways in every web transaction.

mkane848 8y ago
>passwords are terrible, but everything else is worse I mean, isn't that a decent summary of a lot of things we rely on in the real world? Too late to stop, already out running in the wild, and everyone hates it but are used to using it, but what's the alternative? NJTRANSIT, I'm looking at you.
onion2k 8y ago
Troy Hunt's whole career is basically based on the brokenness of passwords... That's unfair. Troy's career is based on the brokenness of bad password implementations, not passwords themselves.
- krupan 8y ago
  If every implementation of an idea is bad, maybe the idea is bad
  - onion2k 8y ago
    They aren't all bad.
  - ranman 8y ago
    Is this a JavaScript joke?

MrStonedOne 8y ago

Passwords can always be used. You can forget a password, but you can't drop it down a storm drain, or have it all of the sudden fail to boot, or forget to bring it when you're at a friends house and now you can't answer your user's calls to fix the site that went down for some reason.

balibebas 8y ago

Did I just see a popover cross-selling products on my mobile? It covered about half the screen.

Anonymous4C54D6 8y ago

Has anybody made a list of [Insert Thing Here]s? I'm curious what kind of trade-offs they offer.

nickpsecurity 8y ago
Here's a great one from Pico project: http://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-password--oakland.pdf http://www.cl.cam.ac.uk/~fms27/papers/2012-BonneauHerOorSta-... Other publications that might interest you: http://pico.cl.cam.ac.uk/technical/ http://pico.cl.cam.ac.uk/technical/ Ross Anderson's blog, LightBlueTouchpaper, has writeups on this in authentication category.

beatgammit 8y ago

What about forcing some set of users to change their password if it shows up in a breach?

TheDong 8y ago
Troy hunt created a service for this. He provides an API where you can securely check if a user's password is pwned without revealing the password to his server. He's written about it several times, here's one of the posts: https://www.troyhunt.com/enhancing-pwned-passwords-privacy-by-exclusively-supporting-anonymity/ https://www.troyhunt.com/enhancing-pwned-passwords-privacy-b...

xte 8y ago

Why I like passwords (and various key locked/unlocked with passwords? Simply because I can change them, I control them. Biometrics is unsafe by design because our body can change outside our control and our body is public enough and unchangeable enough to be a REALLY unsafe authentication system for anything but human being interacting together. External other-factor auths like OTP, side verification, port-knocking, ... are good, but they still need a password somewhere in the chain. So no, it's not only a matter of reactionary users not willing to change but also a matter of rational safety reasoning.

danielrm26 8y ago
When current bio-related credentials are stolen, they're not stealing your hand or your iris or your face. They're stealing destructive hashes of those things. It'd be like having someone sketch a stick figure version of you, and then you claim your identity was stolen. No, it wasn't. Stick figure drawings only work in stick figure readers.
- xte 8y ago
  Take a look at some "sophisticated" retinal scan, they are in the end cameras, a special kind one. Fingerprint readers? Another kind of scanner. It doesn't matter that today's only few simpler model can be cracked with a single strip of scotch, it's only a matter of time. And we can go up, even imaging quick DNA scanner, quick enough and smart, it does not change that much, your DNA can be grabbed around you in many way. The essential point is simple: using your body means using an exposed key, using a password means using your brain that it's far harder to "expose". Also passwords are trivial enough, you can even check your keyboard for builtin keylogger, protect your environment from camera, microphone (phone/audio analyze to determine key's you press) etc. Try to hw check a biometric system and well... Good luck.

elwell 8y ago

At ClearCoin, we use a stored private key in the user's browser extension to sign every authenticated request. The signature is verified on the server, checking that it matches the Ethereum wallet address listed in the payload.

comma-ampersand 8y ago

What is wrong with magic links exactly? Email already is the single point of failure, password resets. People are already used to looking at their email, account verification etc. People are already used to looking at their email after signing in, 2nd factor with email exists on some sites. Downsides are that they might be scanned by security software and visited, but surely that's also a problem for verification links? I can't imagine that people would appreciate accounts being automatically verified... All other reasons I can think of indicate a problem with password resets as well, which also gives access to the account anyway.

BillinghamJ 8y ago
On a properly implemented magic link system, automatic visiting wouldn't be an issue at all. Should only work within the same originating session, and ideally should use PKCE too.

Svoka 8y ago

In my humble opinion, very few know how to use a password. Most of the people still believe that their cat name starting with a capital letter and with 1 in the end is a good password. Or that once you have a good password it is enough to use it everywhere. Same passwords everywhere is not a security, it's a vision of security. It may surprise author that main reason to provide authentication is to give some security, and in case of every single non-it person I know their passwords are just an illusion. So, I would argue, while anyone can type in some staff, how to make it secure is rare knowledge almost no one has. So, is it, really "everyone knows how it works"? Or just everyone repeating their not quite secure passwords to make machine happy without any understanding of consequences

dgzl 8y ago
You could argue that few people use passwords in a properly secure manner, and you'd likely be right, but the real question is what will replace passwords? The truth you describe doesn't mean that we should convince people to use passwords correctly, rather that passwords aren't the best security medium for humans. It's unreasonable for people to be expected to craft highly secure, brand new passwords each time they need one, and also expect it to be stored in long-term memory. That process is simply out of scope for most humans. So then, how do we make this easier without compromising security?

codedokode 8y ago

I don't agree with the author. Passwords are difficult to remember and easy to steal. Example I saw: old people write their card's PIN code on it because they cannot remember it. Everyone knows how to use it, you say? I think that for an average, not computer-loving type of person, a hardware key is the best solution. You don't need to remember anything: just insert the key and press the button. Why aren't they popular? I think because they are not a standard and are not built in. You don't get a free key when buying a laptop or a smartphone and that's the main reason why nobody is using them. But there already are applications that don't use passwords. For example, Telegram (IM application): when you install it you only have to enter your phone number, it sends the code in SMS, the app reads the code without user's interaction, and authenticates the device. No passwords, no need to remember anything. I don't like this (it is not convenient for those who use a burner phone number for registration), but for a more typical user it is convenient and doesn't require them to remember anything. I think we will see more passwordsless authentication in the future.

Leace 8y ago
When using hardware keys remember to register at least two. In case one stops working or is lost/stolen you're locked out of your account. Backup codes help but they're another barrier one have to remember.

_pdp_ 8y ago

czei002 8y ago

If done right, passwords are a very powerful and universal auth method, i.e. all credentials can be remembered and no third party or auth device are needed (e.g. you are still able to login even when you lost all your belongings while traveling). However, there are problems when reusing passwords and passwords are usually leaked to the remote party when authenticating, e.g. its trivial for a web service to learn what password or password pattern you are using. I am working on an open source project called FejoaAuth where we are working on a secure authentication solution that does not leak the password during login. This allows to reuse a password, e.g. to use a password for authentication and for data encryption. This makes true one password solutions possible. Its an open source project so please get in contact :) https://fejoa.org/fejoapage/auth.html https://fejoa.org/fejoapage/auth.html