5 ms·

So, there are more and more murmurings about this in comments on posts like this one. I guess I'll kick this one off this time: Passwords make for terrible sec

So, there are more and more murmurings about this in comments on posts like this one. I guess I'll kick this one off this time: Passwords make for terrible security. Non-computer folk just don't want to devote the necessary headspace required to do it right. Hell, I handle this stuff for other people all the time, generate on average a few new random passwords of varying lengths every day, have memorized tons of the buggers -- including some rather ugly ones -- and I'm still not doing it right. No, I don't know what would be better than passwords. But I'm looking forward to it when it shows up.

eik3_de 15y ago
> No, I don't know what would be better than passwords. I'm quite happy with Google's Implementation of http://en.wikipedia.org/wiki/Two-factor_authentication http://en.wikipedia.org/wiki/Two-factor_authentication called "2-step verification".
- CodeMage 15y ago
  And if Mozilla's BrowserID proves as secure as it looks and becomes widespread, we can combine those two and breathe a lot easier.
deleted 15y ago
[deleted]
ig1 15y ago
Hardware tokens you can carry in your wallet or on your keyring. Yes it means you have to carry it around all the time, but you also have to carry your house keys around. And in reality your online accounts at this stage may well be worth more than the stuff in your house.
apgwoz 15y ago
What would be better than passwords? Public-key crypto. The password/phrase is only used to protect the private key, so there's only ever one password to remember. Of course, validation of the owner becomes the troublesome point here.
davidw 15y ago
I think phones might be an interesting possibility. Granted, you can lose one or have it stolen, but for most people that's probably less of a risk than using bad passwords that are the same over multiple sites. Of course, there are all kinds of things I'm not thinking of, because... it's not my area of expertise. It just seems like it might be something that's potentially doable and a decent compromise between security and usability.
- archgoon 15y ago
  If you have a smartphone, chances are your account to whatever is already compromised by the ability to reset via email, unless you are good about signing out of your email application. So a phone solution sounds like a pretty good solution, since it's not any worse than the current situation. However, a fair number of people still have a 10 cent/message SMS plan, and would be unhappy if they had to start paying $1+ a day to log into all their accounts, so using SMS seems less than ideal in that respect.
  - davidw 15y ago
    I'm thinking something a bit more high tech, like using NFC or Bluetooth so that you have to have the phone in range of the computer.
JonnieCache 15y ago
I predict that these problems will be finally solved when commodity webcams are good enough for secure retina/iris scanning.
- robtoo 15y ago
  Unfortunately, this doesn't solve the problem: To do iris-scanning security, there must be a back-end database with the characteristics ("fingerprint") of each user's iris. This database will be secured as strongly/effectively as a password database because it contains authentication credentials. Unfortunately, password databases get broken into, and similarly iris databases will also get broken into. The attacker then has to simply convert the iris fingerprint back into an image to replay to the authentication process. This is probably easier than reversing a password hash (because the fingerprinting algorithm is unlikely to be optimised against reversing), and certainly no harder. (This is assuming untrusted client-side hardware.)
  - jbri 15y ago
    Ideally, you wouldn't store the iris fingerprint itself - that's just as bad as storing a cleartext password today. Rather, a good solution would involve deriving a (site-specific) token from the fingerprint and handing it off to the remote service, which then deals with it in much the same way we expect sites to deal with passwords. This, of course, presupposes that we can retrieve a consistent and unique fingerprint from the same iris from various different images of it, and breaks down if all we can do is check an iris image to see if it matches a fingerprint.
    - robtoo 15y ago
      You appear to be suggesting that the real security benefit would come from off-loading the authentication process onto a third party, but we can already do that with password authentication by using OpenID / Facebook Connect / whatever. It's not clear how using iris fingerprints rather than passwords really adds anything other than to increase the risk of a false negative, and introducing a third party dependency. (I do take your point about storing a hash of the iris fingerprint, though. How this would intefere with the matching process is, I guess, outside of both our areas.)
DanHulton 15y ago
I don't have the solution, but I have part of it: http://www.emailambush.com http://www.emailambush.com I started this just a short while ago in response to all the Lulzsec email/password combo DB dumps that were released. In short, you keep an email in your inbox that looks tempting for hackers that - if any images are loaded or links are followed - sends a text message immediately to your phone, allowing you to quickly change your password and/or alert your administrator.
- eneveu 15y ago
  Reminds me of John Graham-Cumming's email canary: http://blog.jgc.org/2011/06/my-email-canary.html http://blog.jgc.org/2011/06/my-email-canary.html ( discussed at http://news.ycombinator.com/item?id=2636685 http://news.ycombinator.com/item?id=2636685 )
  - DanHulton 15y ago
    It was actually the inspiration. I'd been doing this myself for a while, but hadn't thought about making an actual product out of it. When I saw the incredible response from the HN community to email canary, I realized I should really take a swing at this.

eik3_de 15y ago

> No, I don't know what would be better than passwords. I'm quite happy with Google's Implementation of http://en.wikipedia.org/wiki/Two-factor_authentication http://en.wikipedia.org/wiki/Two-factor_authentication called "2-step verification".

CodeMage 15y ago
And if Mozilla's BrowserID proves as secure as it looks and becomes widespread, we can combine those two and breathe a lot easier.

deleted 15y ago

[deleted]

ig1 15y ago

Hardware tokens you can carry in your wallet or on your keyring. Yes it means you have to carry it around all the time, but you also have to carry your house keys around. And in reality your online accounts at this stage may well be worth more than the stuff in your house.

apgwoz 15y ago

What would be better than passwords? Public-key crypto. The password/phrase is only used to protect the private key, so there's only ever one password to remember. Of course, validation of the owner becomes the troublesome point here.

davidw 15y ago

I think phones might be an interesting possibility. Granted, you can lose one or have it stolen, but for most people that's probably less of a risk than using bad passwords that are the same over multiple sites. Of course, there are all kinds of things I'm not thinking of, because... it's not my area of expertise. It just seems like it might be something that's potentially doable and a decent compromise between security and usability.

archgoon 15y ago
If you have a smartphone, chances are your account to whatever is already compromised by the ability to reset via email, unless you are good about signing out of your email application. So a phone solution sounds like a pretty good solution, since it's not any worse than the current situation. However, a fair number of people still have a 10 cent/message SMS plan, and would be unhappy if they had to start paying $1+ a day to log into all their accounts, so using SMS seems less than ideal in that respect.
- davidw 15y ago
  I'm thinking something a bit more high tech, like using NFC or Bluetooth so that you have to have the phone in range of the computer.

JonnieCache 15y ago

I predict that these problems will be finally solved when commodity webcams are good enough for secure retina/iris scanning.

robtoo 15y ago
Unfortunately, this doesn't solve the problem: To do iris-scanning security, there must be a back-end database with the characteristics ("fingerprint") of each user's iris. This database will be secured as strongly/effectively as a password database because it contains authentication credentials. Unfortunately, password databases get broken into, and similarly iris databases will also get broken into. The attacker then has to simply convert the iris fingerprint back into an image to replay to the authentication process. This is probably easier than reversing a password hash (because the fingerprinting algorithm is unlikely to be optimised against reversing), and certainly no harder. (This is assuming untrusted client-side hardware.)
- jbri 15y ago
  Ideally, you wouldn't store the iris fingerprint itself - that's just as bad as storing a cleartext password today. Rather, a good solution would involve deriving a (site-specific) token from the fingerprint and handing it off to the remote service, which then deals with it in much the same way we expect sites to deal with passwords. This, of course, presupposes that we can retrieve a consistent and unique fingerprint from the same iris from various different images of it, and breaks down if all we can do is check an iris image to see if it matches a fingerprint.
  - robtoo 15y ago
    You appear to be suggesting that the real security benefit would come from off-loading the authentication process onto a third party, but we can already do that with password authentication by using OpenID / Facebook Connect / whatever. It's not clear how using iris fingerprints rather than passwords really adds anything other than to increase the risk of a false negative, and introducing a third party dependency. (I do take your point about storing a hash of the iris fingerprint, though. How this would intefere with the matching process is, I guess, outside of both our areas.)

DanHulton 15y ago

I don't have the solution, but I have part of it: http://www.emailambush.com http://www.emailambush.com I started this just a short while ago in response to all the Lulzsec email/password combo DB dumps that were released. In short, you keep an email in your inbox that looks tempting for hackers that - if any images are loaded or links are followed - sends a text message immediately to your phone, allowing you to quickly change your password and/or alert your administrator.

eneveu 15y ago
Reminds me of John Graham-Cumming's email canary: http://blog.jgc.org/2011/06/my-email-canary.html http://blog.jgc.org/2011/06/my-email-canary.html ( discussed at http://news.ycombinator.com/item?id=2636685 http://news.ycombinator.com/item?id=2636685 )
- DanHulton 15y ago
  It was actually the inspiration. I'd been doing this myself for a while, but hadn't thought about making an actual product out of it. When I saw the incredible response from the HN community to email canary, I realized I should really take a swing at this.