3 ms·
I think 1password is great and use it myself. I tried to have a family member set it up and it was really hard for them. What do people think about a simpler
by sytse 7y ago
I think 1password is great and use it myself.
I tried to have a family member set it up and it was really hard for them.
What do people think about a simpler service that relies on SaaS and you owning your primary email address. The service is called nopassword and you log in via a link that is sent to your primary email address. When you log in you see a hashed email address that ends in @nopassword.com. to add a new account.
To add a new account you change your email at that account to the hashed email address that ends in @nopassword.com. The nopassword service will automatically detect this, confirm the email address change, and reset your password. From now on you can find your password in the nopassword website or client.
Because every service uses a new unique email address you have the privacy and spam filtering advantages of Apple ID. Since almost every web service lets you register by email and reset your password by email it is compatible with almost everything.
After you log into a service nopassword will reset your password 16 hours later. This way intercepted passwords can never be used for long. And if a webservice has a breach nopassword will proactively reset your password.
The nopassword service will have clients for iphone/android/chrome/firefox/safari that word with native authentication (FaceID, etc.) to get in the client after validating with your primary email on install.
Would you use this?
- JonathonW 7y agoNo. If a SaaS service can automatically set/reset my password without any intervention on my part, that means I have passwords, in unencrypted form, sitting on a third-party server I don't control. What happens when (and it is when, not if) "nopassword" is breached?
- sytse 7y agoSome services are more secure than others, 1password and Okta never saw a large breach as far as I know. If a breach would occur the race would be on to reset the password before the hackers would change the email address. You can imagine having 1% of canary accounts that give a big alert if their email is every changed leading to a race to see who can reset accounts first.
- macNchz 7y agoThey key difference around the risk of security breaches between this proposed service and 1password is that user data in the 1password cloud is encrypted client-side with a key derived from the user's master password, so there is no way for anyone who gains server access to see the passwords. In the proposed nopassword service, the server would have to maintain passwords in a less secure way, since it would need access to them in plain text to automate setting/resetting/filling them.
- sytse 7y agoI agree it is less secure in that way.
- rkagerer 7y agoI like the disposable email portion of the idea. I'd very much like to sign up for every service with a unique email address, so I can trace the source of my spam. But I share JonathanW's concerns on the security side of your proposal.