5 ms·

Requiring users to create passwords continues to be an engineering failure in our industry. There are some promising alternatives, but we need to realize that u

by thurn 15y ago

Requiring users to create passwords continues to be an engineering failure in our industry. There are some promising alternatives, but we need to realize that users are not at fault for picking poor passwords. We are at fault for not giving them better options.

shii 15y ago
What would you suggest as better options and what are some examples of the ones you've alluded to? The way I see it, any shift away from the current common scheme would cause problems with either of both compatability and ease of use. It'd be awesome if everyone had a pgp key or something, but that's unrealistic. Some new voodoo scheme gets concocted and I worry for security rigor and whether it'll fit within existing systems. Maybe the two-step auth method by Google (and by banks before) recently or a tweak of it is the way to go?
- CamperBob 15y ago
  You know what I want? I want a small, cheap USB dongle that I just plug into the PC, that magically makes all logins and passwords go away. I don't care how it works. Just make it work, because this is stupid. Whoever does that, and manages to get the major players behind it, is going to be the next Mark Shuttleworth, if not Mark Zuckerberg.
  - adambyrtek 15y ago
    YubiKey[1] serves a similar purpose. I use it as the second factor of authentication for my LastPass account, which stores completely random passwords for individual sites. Of course the biggest problem is always adoption, but Yubico were smart enough to make both the protocol and the server component open. http://www.yubico.com/yubikey http://www.yubico.com/yubikey
  - thwarted 15y ago
    Until you lose it.
    - CamperBob 15y ago
      At which point I call the company that makes the dongle and request another one. At the same time, they log into every site I use and create a new random password for that site. The hardware key is just a token... it doesn't even need to be hardware. There just needs to be some trusted third party who can vouch that user U is at machine M at time T, and field all login requests on U's behalf without a lot of manual labor or memory work on U's part. For those cases where I don't want persistent representation, the service could be configured to ask me to enter a password when I first try to access any of the sites they handle for me, and every half-hour thereafter, or whatever. Facebook will be in a good position to do something like this before long, if they aren't already. I don't want to use Facebook logins for this because the company has far too much baggage in other areas. It needs to be a Verisign-type company that does nothing but logins and stores nothing but username/password pairs.
      - bigiain 15y ago
        This is _so_ close to existing already - if I could hook Google's Authenticator app into 1Password with it's Dropbox integration, I'd have pretty much exactly what you're describing. Having said that, 1Password and Dropbox sync running on my phone, iPad, laptop, and desktop is actually a _very_ useable "single strong passphrase" multiple password management solution. Does anyone know how secure my iPassword database is when stored on the key-shared-with-anyone-Dropbox-allows encrypted S3 buckets? (or in my not-all-that-unlikely-to-get-lost-or-stolen phone/ipad/laptop.) Their page says they use openssl with 128bit keys, and I use an 18 character password (upper & lower case, spaces and punctuation, but with 3 dictionary words separated with punc/spaces). I'm reasonably happy that's "secure enough" for me - if anyone's going to get my passwords it'll most likely be by court order (or rubber hose cryptography) Of course, it's a closed-source app, so it'd take a fair bit of work to _prove_ to yourself that they're actually "doing the right thing" with the password database crypto.
      - bartl 15y ago
        >At the same time, they log into every site I use and create a new random password for that site. Uh, wait. This means they can log in into every account of yours. How secure you think that is?
  - troyhunt 15y ago
    That's great, now what about my iPad? And iPhone? And Android device? And etc. and etc.
  - punnie 15y ago
    what about public computers and malware? stealing the auth tokens stored on this usb dongle idea seems somewhat trivial to me.
    - haberman 15y ago
      The key wouldn't have to ever leave the dongle. The computer could send it a payload to sign, and the dongle sends back the signature.
thwarted 15y ago
We did, and they didn't want it. SSL client certs, maybe. There's Login with twitter, Login with Facebook. Login with Random Site X. Oh, don't like centralized third-party authentication? The only thing you know about security is that there needs to be a lock icon? Try something else, here's OpenID: distributed, federated, customizable. Oh, too hard to understand? Confused because the address bar changes? Why are you asserting your identity on site X when you want to access to site Y? Don't even know, or want to take the time to, understand what "asserting your identity" means? Well then we'll just let you log in with a username and password. Oh, did you forget your username? Is your caps lock key on? Even (edit: fake) celebrities known for crazy beards and drunken movies have an opinion on login security: http://twitter.com/GALIFlANAKIS/status/77372216957861888 http://twitter.com/GALIFlANAKIS/status/77372216957861888
- citricsquid 15y ago
  that isn't his real account, some of "his" latest tweets: http://twitter.com/#!/GALIFlANAKIS/status/77450156102004736 http://twitter.com/#!/GALIFlANAKIS/status/77450156102004736 http://twitter.com/#!/GALIFlANAKIS/status/77620921766129664 http://twitter.com/#!/GALIFlANAKIS/status/77620921766129664 real account: http://twitter.com/#!/GALIFIANAKISZ http://twitter.com/#!/GALIFIANAKISZ they're using different letters and case. I = l, i = L
  - thwarted 15y ago
    Good point. I forgot to check for the "verified" icon (since twitter refuses to consider me worth "verifying"). I'll edit to reflect that.
tomjen3 15y ago
Maybe we should just send them the password in the "welcome to random service X you just signed up for" that new users always seem to get.
- tomjen3 15y ago
  Okay that came out wrong - what I wanted to say was that we should generate a password for the user and send it in the email the welcome email.
  - CodeMage 15y ago
    Wait, that's not an attempt at humor? Okay, how do you solve the chicken-and-egg problem with the fact that your e-mail service also uses a password? Not to mention that e-mail generally travels in plain text.
    - tomjen3 15y ago
      I wouldn't use this for an email service, but otherwise it would remove the issue of dublicated passwords and mean that the advantage to hacking the service was very low.
kmfrk 15y ago
I can attest that entering a ~32-character-long ~base64 password on PSN is a real pain in the ass. :)
- orofino 15y ago
  This. The problem with secure passwords that I use (I switched to mainly unique passwords after the gawker incident) is that they are pain to type on things like xbox, android, etc. Not only that, but some sites won't accept special characters in the password... now what do I do? I break out some crappy password that I have a chance in hell remembering.
  - lukejduncan 15y ago
    Case in point, Discover Bank doesn't allow special characters in the password. Really now?
    - mestudent 15y ago
      A bunch of banks don't allow special characters, some people have said it is so you can enter it over the phone (something I've never come across but I kind of doubt that. If that really is the case, they are probably throwing out whether each character is upper or lowercase as well :/
- ilikepi 15y ago
  You could just plug in any standard USB keyboard...

by thurn 15y ago

shii 15y ago

What would you suggest as better options and what are some examples of the ones you've alluded to? The way I see it, any shift away from the current common scheme would cause problems with either of both compatability and ease of use. It'd be awesome if everyone had a pgp key or something, but that's unrealistic. Some new voodoo scheme gets concocted and I worry for security rigor and whether it'll fit within existing systems. Maybe the two-step auth method by Google (and by banks before) recently or a tweak of it is the way to go?

CamperBob 15y ago
You know what I want? I want a small, cheap USB dongle that I just plug into the PC, that magically makes all logins and passwords go away. I don't care how it works. Just make it work, because this is stupid. Whoever does that, and manages to get the major players behind it, is going to be the next Mark Shuttleworth, if not Mark Zuckerberg.
- adambyrtek 15y ago
  YubiKey[1] serves a similar purpose. I use it as the second factor of authentication for my LastPass account, which stores completely random passwords for individual sites. Of course the biggest problem is always adoption, but Yubico were smart enough to make both the protocol and the server component open. http://www.yubico.com/yubikey http://www.yubico.com/yubikey
- thwarted 15y ago
  Until you lose it.
  - CamperBob 15y ago
    At which point I call the company that makes the dongle and request another one. At the same time, they log into every site I use and create a new random password for that site. The hardware key is just a token... it doesn't even need to be hardware. There just needs to be some trusted third party who can vouch that user U is at machine M at time T, and field all login requests on U's behalf without a lot of manual labor or memory work on U's part. For those cases where I don't want persistent representation, the service could be configured to ask me to enter a password when I first try to access any of the sites they handle for me, and every half-hour thereafter, or whatever. Facebook will be in a good position to do something like this before long, if they aren't already. I don't want to use Facebook logins for this because the company has far too much baggage in other areas. It needs to be a Verisign-type company that does nothing but logins and stores nothing but username/password pairs.
    - bigiain 15y ago
      This is _so_ close to existing already - if I could hook Google's Authenticator app into 1Password with it's Dropbox integration, I'd have pretty much exactly what you're describing. Having said that, 1Password and Dropbox sync running on my phone, iPad, laptop, and desktop is actually a _very_ useable "single strong passphrase" multiple password management solution. Does anyone know how secure my iPassword database is when stored on the key-shared-with-anyone-Dropbox-allows encrypted S3 buckets? (or in my not-all-that-unlikely-to-get-lost-or-stolen phone/ipad/laptop.) Their page says they use openssl with 128bit keys, and I use an 18 character password (upper & lower case, spaces and punctuation, but with 3 dictionary words separated with punc/spaces). I'm reasonably happy that's "secure enough" for me - if anyone's going to get my passwords it'll most likely be by court order (or rubber hose cryptography) Of course, it's a closed-source app, so it'd take a fair bit of work to _prove_ to yourself that they're actually "doing the right thing" with the password database crypto.
    - bartl 15y ago
      >At the same time, they log into every site I use and create a new random password for that site. Uh, wait. This means they can log in into every account of yours. How secure you think that is?
- troyhunt 15y ago
  That's great, now what about my iPad? And iPhone? And Android device? And etc. and etc.
- punnie 15y ago
  what about public computers and malware? stealing the auth tokens stored on this usb dongle idea seems somewhat trivial to me.
  - haberman 15y ago
    The key wouldn't have to ever leave the dongle. The computer could send it a payload to sign, and the dongle sends back the signature.

thwarted 15y ago

We did, and they didn't want it. SSL client certs, maybe. There's Login with twitter, Login with Facebook. Login with Random Site X. Oh, don't like centralized third-party authentication? The only thing you know about security is that there needs to be a lock icon? Try something else, here's OpenID: distributed, federated, customizable. Oh, too hard to understand? Confused because the address bar changes? Why are you asserting your identity on site X when you want to access to site Y? Don't even know, or want to take the time to, understand what "asserting your identity" means? Well then we'll just let you log in with a username and password. Oh, did you forget your username? Is your caps lock key on? Even (edit: fake) celebrities known for crazy beards and drunken movies have an opinion on login security: http://twitter.com/GALIFlANAKIS/status/77372216957861888 http://twitter.com/GALIFlANAKIS/status/77372216957861888

citricsquid 15y ago
that isn't his real account, some of "his" latest tweets: http://twitter.com/#!/GALIFlANAKIS/status/77450156102004736 http://twitter.com/#!/GALIFlANAKIS/status/77450156102004736 http://twitter.com/#!/GALIFlANAKIS/status/77620921766129664 http://twitter.com/#!/GALIFlANAKIS/status/77620921766129664 real account: http://twitter.com/#!/GALIFIANAKISZ http://twitter.com/#!/GALIFIANAKISZ they're using different letters and case. I = l, i = L
- thwarted 15y ago
  Good point. I forgot to check for the "verified" icon (since twitter refuses to consider me worth "verifying"). I'll edit to reflect that.

tomjen3 15y ago

Maybe we should just send them the password in the "welcome to random service X you just signed up for" that new users always seem to get.

tomjen3 15y ago
Okay that came out wrong - what I wanted to say was that we should generate a password for the user and send it in the email the welcome email.
- CodeMage 15y ago
  Wait, that's not an attempt at humor? Okay, how do you solve the chicken-and-egg problem with the fact that your e-mail service also uses a password? Not to mention that e-mail generally travels in plain text.
  - tomjen3 15y ago
    I wouldn't use this for an email service, but otherwise it would remove the issue of dublicated passwords and mean that the advantage to hacking the service was very low.

kmfrk 15y ago

I can attest that entering a ~32-character-long ~base64 password on PSN is a real pain in the ass. :)

orofino 15y ago
This. The problem with secure passwords that I use (I switched to mainly unique passwords after the gawker incident) is that they are pain to type on things like xbox, android, etc. Not only that, but some sites won't accept special characters in the password... now what do I do? I break out some crappy password that I have a chance in hell remembering.
- lukejduncan 15y ago
  Case in point, Discover Bank doesn't allow special characters in the password. Really now?
  - mestudent 15y ago
    A bunch of banks don't allow special characters, some people have said it is so you can enter it over the phone (something I've never come across but I kind of doubt that. If that really is the case, they are probably throwing out whether each character is upper or lowercase as well :/
ilikepi 15y ago
You could just plug in any standard USB keyboard...