3 ms·

If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all? What if the password manager we

If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all? What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? How could that _possibly_ be more friction? It would be strictly less. Hell, it could be done without even informing the user that this new feature was being rolled out, and they sure as hell wouldn't complain about inconvenience because of a step removed from the login process. Asking people to deal with more and more and longer and longer passwords is a usability nightmare. It's a absurdity.

nathantotten 8y ago
I wouldn’t say 2FA or password managers have “taken off”. I don’t have numbers, but just from my small sample of friends/family, only people who are technically advanced or who I have forced (my wife ;) use password managers.
- orblivion 8y ago
  Well hey, it's a start. They've got more adoption than Troy claims any of the niche experimental password replacers do.
kiriakasis 8y ago
For one 2FA is (often) an addition to password and almost always it is required only at registration time (e.g. email confirmation)
bspammer 8y ago
The claim wasn't that nobody understands anything other than passwords, it was that everyone understands passwords.
- orblivion 8y ago
  The claim was that nothing else will take off. 2FA and password maangers at least are used out there beyond a niche thing nobody ever heard of (which is how he described the viability of other schemes he didn't bother naming)
  - salvar 8y ago
    The claim was that nothing else will take off to the point of becoming a password killer. 2FA doesn't try to replace passwords.
screye 8y ago
> Asking people to deal with more and more and longer and longer passwords is a usability nightmare. It's a absurdity. I fully agree with you, but an anecdote. I find long password to be easy to remember if they are just long lower case strings instead of having wierd symbol-number combinations.
creeble 8y ago
Where does 2fa replace passwords? It's two FA after all. And I'd assert that password managers haven't exactly taken off; I'd be curious about their numbers, but the dozen or so people I know who use one are all software engineers. Also, they don't really replace passwords - they're based on them!
- orblivion 8y ago
  2fa doesn't replace passwords but it is added friction that people willingly take on for added security. Password managers are a separate program that (some) people are willing to use as part of their login process. Perhaps whatever adoption it has is based on the fact that people understand passwords. But once they're used to using a program to log them in, I'd argue that's a potential hook into something more secure. Even something as simple as the API I described would mitigate (I'll stop short of saying eliminate) phishing attacks.
  - hirsin 8y ago
    Only people on this site have willingly enabled 2fa (to a decent first order estimate). The remainder are forced to by tenant administrators or the occasional application owner who understands they gate important data (eg NuGet requires 2fa for some package owners). "2fa" as traditionally thought of is a bit of a detour though - what's more important is strong authentication, with passwords being worst and a UAF key being best for now. Authenticator apps satisfy 2FA with a single authentication, but that freaks out plenty of smart people (phone PIN lock + device bound cert = something you know/are + you have) - purely due to years of training that 2FA means 2 authentication.
Ajedi32 8y ago
> What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? FYI, this is exactly what WebAuthn is. The standard was just finalized in August. All we need now is some implementations.

nathantotten 8y ago

I wouldn’t say 2FA or password managers have “taken off”. I don’t have numbers, but just from my small sample of friends/family, only people who are technically advanced or who I have forced (my wife ;) use password managers.

orblivion 8y ago
Well hey, it's a start. They've got more adoption than Troy claims any of the niche experimental password replacers do.

kiriakasis 8y ago

For one 2FA is (often) an addition to password and almost always it is required only at registration time (e.g. email confirmation)

bspammer 8y ago

The claim wasn't that nobody understands anything other than passwords, it was that everyone understands passwords.

orblivion 8y ago
The claim was that nothing else will take off. 2FA and password maangers at least are used out there beyond a niche thing nobody ever heard of (which is how he described the viability of other schemes he didn't bother naming)
- salvar 8y ago
  The claim was that nothing else will take off to the point of becoming a password killer. 2FA doesn't try to replace passwords.

screye 8y ago

> Asking people to deal with more and more and longer and longer passwords is a usability nightmare. It's a absurdity. I fully agree with you, but an anecdote. I find long password to be easy to remember if they are just long lower case strings instead of having wierd symbol-number combinations.

creeble 8y ago

Where does 2fa replace passwords? It's two FA after all. And I'd assert that password managers haven't exactly taken off; I'd be curious about their numbers, but the dozen or so people I know who use one are all software engineers. Also, they don't really replace passwords - they're based on them!

orblivion 8y ago
2fa doesn't replace passwords but it is added friction that people willingly take on for added security. Password managers are a separate program that (some) people are willing to use as part of their login process. Perhaps whatever adoption it has is based on the fact that people understand passwords. But once they're used to using a program to log them in, I'd argue that's a potential hook into something more secure. Even something as simple as the API I described would mitigate (I'll stop short of saying eliminate) phishing attacks.
- hirsin 8y ago
  Only people on this site have willingly enabled 2fa (to a decent first order estimate). The remainder are forced to by tenant administrators or the occasional application owner who understands they gate important data (eg NuGet requires 2fa for some package owners). "2fa" as traditionally thought of is a bit of a detour though - what's more important is strong authentication, with passwords being worst and a UAF key being best for now. Authenticator apps satisfy 2FA with a single authentication, but that freaks out plenty of smart people (phone PIN lock + device bound cert = something you know/are + you have) - purely due to years of training that 2FA means 2 authentication.

Ajedi32 8y ago

> What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? FYI, this is exactly what WebAuthn is. The standard was just finalized in August. All we need now is some implementations.