4 ms·

I was trying to remember wtf the name of the new MFA standard that Chrome supports was, and it took me 10 minutes of Googling to find it (U2F[1]). If a security

I was trying to remember wtf the name of the new MFA standard that Chrome supports was, and it took me 10 minutes of Googling to find it (U2F[1]). If a security nerd can't even remember the name of the thing that's supposed to replace passwords, regular users will never figure it out. You want to get rid of passwords? Stop allowing users to manage them. Make a browser plug-in support U2F, make it auto-generate passwords for sites, make it manage them internally. When you go to login to Chase, the browser will fill in the login details, after it has verified this is the Actual Real Site and not a phishing site. All access to this auth data will be based on a master password entered into the user's browser at start-up. To reset an individual site's auth creds, the site can send a re-auth e-mail to the user. When the user clicks through, they can use the site's preferred verification process to show they are the real user. The browser can then generate and save new auth details for the site. At no time did the user ever enter a password, but strong authentication data is still being managed independently per-site, the user can still reset any given site's auth details, and the user only has to manage one strong password on their client machine at start-up time. They can also use U2F with a second device for MFA. [1] https://en.wikipedia.org/wiki/Universal_2nd_Factor https://en.wikipedia.org/wiki/Universal_2nd_Factor

laken 7y ago
> Make a browser plug-in support U2F https://krypt.co/ https://krypt.co/
Avamander 7y ago
Or countries could solve the issue for their citizens instead of making everyone invent their own, like Estonia and quite a few other european countries have. By providing a physical card (or SIM) that allows people to log in where they want.
- JoshTriplett 7y ago
  Many people will not want "help" from a government to authenticate and logging in to a non-government site.
  - Avamander 7y ago
    Many people don't like passwords either. The point being that sometimes we have to go with things we don't find perfect, just tremendously better than what we have now.
- dredmorbius 7y ago
  That could be very good. Or catastrophically bad.
- peterwwillis 7y ago
  So we can either: (1) wait for 200 countries to properly implement secure hardware tokens for every citizen (population of estonia: 1.3 million, population of the world: 7.6 billion) and wait for all apps and sites to properly support 200 different cards, or (2) implement a universal http standard to abstract logins away into authentication managers. The former requires bureaucracy, logistics, physical production and transportation costs, hardware adapters, and countless unknown considerations to get everyone in the world to be able to use it and get support for it. The latter requires a browser plugin, and for web apps to implement an HTTP extension similar to a content security policy.
  - Avamander 7y ago
    Or (3) implement an universal TLS standard to abstract logins away into hardware tokens... but that's exactly what we have but don't use super-widespread. Estonia has demonstrated the solution scales easily into millions, Latvia is working on it, Finland as well and a few other countries, but they're 15 years behind from Estonia, rest of the world is at least two decades behind. I've always wanted to make wild predictions, now I can try, I think such personal hardware tokens will become wildly mainstream in 25 years, totally replacing passwords.

laken 7y ago

> Make a browser plug-in support U2F https://krypt.co/ https://krypt.co/

Avamander 7y ago

Or countries could solve the issue for their citizens instead of making everyone invent their own, like Estonia and quite a few other european countries have. By providing a physical card (or SIM) that allows people to log in where they want.

JoshTriplett 7y ago
Many people will not want "help" from a government to authenticate and logging in to a non-government site.
- Avamander 7y ago
  Many people don't like passwords either. The point being that sometimes we have to go with things we don't find perfect, just tremendously better than what we have now.
dredmorbius 7y ago
That could be very good. Or catastrophically bad.
peterwwillis 7y ago
So we can either: (1) wait for 200 countries to properly implement secure hardware tokens for every citizen (population of estonia: 1.3 million, population of the world: 7.6 billion) and wait for all apps and sites to properly support 200 different cards, or (2) implement a universal http standard to abstract logins away into authentication managers. The former requires bureaucracy, logistics, physical production and transportation costs, hardware adapters, and countless unknown considerations to get everyone in the world to be able to use it and get support for it. The latter requires a browser plugin, and for web apps to implement an HTTP extension similar to a content security policy.
- Avamander 7y ago
  Or (3) implement an universal TLS standard to abstract logins away into hardware tokens... but that's exactly what we have but don't use super-widespread. Estonia has demonstrated the solution scales easily into millions, Latvia is working on it, Finland as well and a few other countries, but they're 15 years behind from Estonia, rest of the world is at least two decades behind. I've always wanted to make wild predictions, now I can try, I think such personal hardware tokens will become wildly mainstream in 25 years, totally replacing passwords.