4 ms·

What would you suggest as better options and what are some examples of the ones you've alluded to? The way I see it, any shift away from the current common sche

by shii 15y ago

What would you suggest as better options and what are some examples of the ones you've alluded to? The way I see it, any shift away from the current common scheme would cause problems with either of both compatability and ease of use. It'd be awesome if everyone had a pgp key or something, but that's unrealistic. Some new voodoo scheme gets concocted and I worry for security rigor and whether it'll fit within existing systems. Maybe the two-step auth method by Google (and by banks before) recently or a tweak of it is the way to go?

CamperBob 15y ago
You know what I want? I want a small, cheap USB dongle that I just plug into the PC, that magically makes all logins and passwords go away. I don't care how it works. Just make it work, because this is stupid. Whoever does that, and manages to get the major players behind it, is going to be the next Mark Shuttleworth, if not Mark Zuckerberg.
- adambyrtek 15y ago
  YubiKey[1] serves a similar purpose. I use it as the second factor of authentication for my LastPass account, which stores completely random passwords for individual sites. Of course the biggest problem is always adoption, but Yubico were smart enough to make both the protocol and the server component open. http://www.yubico.com/yubikey http://www.yubico.com/yubikey
- thwarted 15y ago
  Until you lose it.
  - CamperBob 15y ago
    At which point I call the company that makes the dongle and request another one. At the same time, they log into every site I use and create a new random password for that site. The hardware key is just a token... it doesn't even need to be hardware. There just needs to be some trusted third party who can vouch that user U is at machine M at time T, and field all login requests on U's behalf without a lot of manual labor or memory work on U's part. For those cases where I don't want persistent representation, the service could be configured to ask me to enter a password when I first try to access any of the sites they handle for me, and every half-hour thereafter, or whatever. Facebook will be in a good position to do something like this before long, if they aren't already. I don't want to use Facebook logins for this because the company has far too much baggage in other areas. It needs to be a Verisign-type company that does nothing but logins and stores nothing but username/password pairs.
    - bigiain 15y ago
      This is _so_ close to existing already - if I could hook Google's Authenticator app into 1Password with it's Dropbox integration, I'd have pretty much exactly what you're describing. Having said that, 1Password and Dropbox sync running on my phone, iPad, laptop, and desktop is actually a _very_ useable "single strong passphrase" multiple password management solution. Does anyone know how secure my iPassword database is when stored on the key-shared-with-anyone-Dropbox-allows encrypted S3 buckets? (or in my not-all-that-unlikely-to-get-lost-or-stolen phone/ipad/laptop.) Their page says they use openssl with 128bit keys, and I use an 18 character password (upper & lower case, spaces and punctuation, but with 3 dictionary words separated with punc/spaces). I'm reasonably happy that's "secure enough" for me - if anyone's going to get my passwords it'll most likely be by court order (or rubber hose cryptography) Of course, it's a closed-source app, so it'd take a fair bit of work to _prove_ to yourself that they're actually "doing the right thing" with the password database crypto.
    - bartl 15y ago
      >At the same time, they log into every site I use and create a new random password for that site. Uh, wait. This means they can log in into every account of yours. How secure you think that is?
      - CamperBob 15y ago
        It had better be very damned secure, obviously. There should be a process in place for ensuring (not to mention insuring) that. If not, well, that's part of the problem to be solved, isn't it?
    - billybob 15y ago
      Call the company? Why can't you just log into their site and request a new one? :) Maybe you have to actually show up physically and give a DNA sample. Oh dang, you have an evil identical twin?
    - CamperBob 15y ago
      Curious for the reason behind the downvotes. Questions: - Do you guys actually think the current situation is OK, with respect to the way Joe Sixpack and Jane Boxwine manage their security credentials? - Do you think the situation will magically get better on its own without some significant centralization? - Do you think social networking companies like Facebook or advertising companies like Google -- neither of whom consider end users to be their actual customers -- are the right ones to assume such a role?
- troyhunt 15y ago
  That's great, now what about my iPad? And iPhone? And Android device? And etc. and etc.
- punnie 15y ago
  what about public computers and malware? stealing the auth tokens stored on this usb dongle idea seems somewhat trivial to me.
  - haberman 15y ago
    The key wouldn't have to ever leave the dongle. The computer could send it a payload to sign, and the dongle sends back the signature.

by shii 15y ago

CamperBob 15y ago

You know what I want? I want a small, cheap USB dongle that I just plug into the PC, that magically makes all logins and passwords go away. I don't care how it works. Just make it work, because this is stupid. Whoever does that, and manages to get the major players behind it, is going to be the next Mark Shuttleworth, if not Mark Zuckerberg.

adambyrtek 15y ago
YubiKey[1] serves a similar purpose. I use it as the second factor of authentication for my LastPass account, which stores completely random passwords for individual sites. Of course the biggest problem is always adoption, but Yubico were smart enough to make both the protocol and the server component open. http://www.yubico.com/yubikey http://www.yubico.com/yubikey
thwarted 15y ago
Until you lose it.
- CamperBob 15y ago
  At which point I call the company that makes the dongle and request another one. At the same time, they log into every site I use and create a new random password for that site. The hardware key is just a token... it doesn't even need to be hardware. There just needs to be some trusted third party who can vouch that user U is at machine M at time T, and field all login requests on U's behalf without a lot of manual labor or memory work on U's part. For those cases where I don't want persistent representation, the service could be configured to ask me to enter a password when I first try to access any of the sites they handle for me, and every half-hour thereafter, or whatever. Facebook will be in a good position to do something like this before long, if they aren't already. I don't want to use Facebook logins for this because the company has far too much baggage in other areas. It needs to be a Verisign-type company that does nothing but logins and stores nothing but username/password pairs.
  - bigiain 15y ago
    This is _so_ close to existing already - if I could hook Google's Authenticator app into 1Password with it's Dropbox integration, I'd have pretty much exactly what you're describing. Having said that, 1Password and Dropbox sync running on my phone, iPad, laptop, and desktop is actually a _very_ useable "single strong passphrase" multiple password management solution. Does anyone know how secure my iPassword database is when stored on the key-shared-with-anyone-Dropbox-allows encrypted S3 buckets? (or in my not-all-that-unlikely-to-get-lost-or-stolen phone/ipad/laptop.) Their page says they use openssl with 128bit keys, and I use an 18 character password (upper & lower case, spaces and punctuation, but with 3 dictionary words separated with punc/spaces). I'm reasonably happy that's "secure enough" for me - if anyone's going to get my passwords it'll most likely be by court order (or rubber hose cryptography) Of course, it's a closed-source app, so it'd take a fair bit of work to _prove_ to yourself that they're actually "doing the right thing" with the password database crypto.
  - bartl 15y ago
    >At the same time, they log into every site I use and create a new random password for that site. Uh, wait. This means they can log in into every account of yours. How secure you think that is?
    - CamperBob 15y ago
      It had better be very damned secure, obviously. There should be a process in place for ensuring (not to mention insuring) that. If not, well, that's part of the problem to be solved, isn't it?
  - billybob 15y ago
    Call the company? Why can't you just log into their site and request a new one? :) Maybe you have to actually show up physically and give a DNA sample. Oh dang, you have an evil identical twin?
  - CamperBob 15y ago
    Curious for the reason behind the downvotes. Questions: - Do you guys actually think the current situation is OK, with respect to the way Joe Sixpack and Jane Boxwine manage their security credentials? - Do you think the situation will magically get better on its own without some significant centralization? - Do you think social networking companies like Facebook or advertising companies like Google -- neither of whom consider end users to be their actual customers -- are the right ones to assume such a role?
troyhunt 15y ago
That's great, now what about my iPad? And iPhone? And Android device? And etc. and etc.
punnie 15y ago
what about public computers and malware? stealing the auth tokens stored on this usb dongle idea seems somewhat trivial to me.
- haberman 15y ago
  The key wouldn't have to ever leave the dongle. The computer could send it a payload to sign, and the dongle sends back the signature.