3 ms·

I think fundamentally most users don't understand anything more complicated than passwords. Passwords are easy. They make sense. A kindergartener understands th

I think fundamentally most users don't understand anything more complicated than passwords. Passwords are easy. They make sense. A kindergartener understands the idea of a secret word that only they know. Tokens, certificates, FIDO -- it's black magic. Therefore people don't trust it. It has to be as easy and intuitive as passwords or it's a non-starter. That's why the SMS codes (though insecure) are so popular. People understand "enter this number that I just texted to you"

deleted 8y ago
[deleted]
lackingporpoise 8y ago
> I think fundamentally most users don't understand anything more complicated than passwords. Passwords are easy. They make sense. A kindergartener understands the idea of a secret word that only they know. I don't think it's that conceptually difficult to understand even for a layman. The bare minimum understanding of web security is that authentication is the process of proving who you are (your identity). You can do it one of three ways (or a combination of them): 1. "Something you know" - Password, Background questions, etc. 2. "Something you have" - Yubikey, Smartcard, TOTP, SMS, email, etc. 3. "Something you are" - Biometrics
Ajedi32 8y ago
Passwords are only easy if you're using them in an insecure fashion (sharing common passwords across multiple sites). Doing passwords right is actually really, really hard without the assistance of an external tool (password manager). I get what you're saying though. Users are used to passwords, so moving to an alternative means of authentication will introduce a bit of friction. That said, I think that done right WebAuthn will actually be way easier to use than passwords. Users will just be able to sign in to their browser once, then use what is effectively single-sign-on for every site thereafter. We're still quite a ways away from that point, but that's where we're headed.
fyfy18 8y ago
OpenID Connect is probably the most popular alternative to having a password for every single site. Especially on mobile, most apps usually have an option to sign up/login with your Google or Facebook account. I'm still a bit bummed that OpenID (the original version) got lost to history. It's not really 'open' if you are handing over the keys to Facebook or Google.
rkeene2 8y ago
Millions of US Government users have no passwords.

deleted 8y ago

[deleted]

lackingporpoise 8y ago

> I think fundamentally most users don't understand anything more complicated than passwords. Passwords are easy. They make sense. A kindergartener understands the idea of a secret word that only they know. I don't think it's that conceptually difficult to understand even for a layman. The bare minimum understanding of web security is that authentication is the process of proving who you are (your identity). You can do it one of three ways (or a combination of them): 1. "Something you know" - Password, Background questions, etc. 2. "Something you have" - Yubikey, Smartcard, TOTP, SMS, email, etc. 3. "Something you are" - Biometrics

Ajedi32 8y ago

Passwords are only easy if you're using them in an insecure fashion (sharing common passwords across multiple sites). Doing passwords right is actually really, really hard without the assistance of an external tool (password manager). I get what you're saying though. Users are used to passwords, so moving to an alternative means of authentication will introduce a bit of friction. That said, I think that done right WebAuthn will actually be way easier to use than passwords. Users will just be able to sign in to their browser once, then use what is effectively single-sign-on for every site thereafter. We're still quite a ways away from that point, but that's where we're headed.

fyfy18 8y ago

OpenID Connect is probably the most popular alternative to having a password for every single site. Especially on mobile, most apps usually have an option to sign up/login with your Google or Facebook account. I'm still a bit bummed that OpenID (the original version) got lost to history. It's not really 'open' if you are handing over the keys to Facebook or Google.

rkeene2 8y ago

Millions of US Government users have no passwords.