3 ms·

Embrace. Extend. Extinguish

jrockway 5y ago
Passwords are probably one of the worst things to happen to our field as a whole (phishing, password managers, etc. are the results of their ubiquity), so efforts to remove them are probably not part of some Microsoft plan to kill open source. This change is a good thing.
- HeckFeck 5y ago
  Indeed. I wish there was something like a token or key that was as ubiquitous as passwords. Though from a developer POV I can certainly see why passwords are so attractive: take a word, hash it, compare hash on subsequent logins. The alternatives are tricky, but not I suspect impossible, to do in a decentralised manner. I've often pondered that something like PGP servers with revocation certificates, but adapted to logins would be near the realm of a solution.
  - toiletaccount 5y ago
    Do you want to be the one to explain PGP and revcerts to somebody who has used the same password for everything their whole life?
    - HeckFeck 5y ago
      That's why I said 'something like'. An extension of the idea adapted for wider use. I'm certain such a person uses TCP/IP every day and doesn't need it explained. Yet twenty years ago, some knowledge of IP addresses and subnet masks etc was necessary to get connected.
      - jrockway 5y ago
        Yeah, I think WebAuthn is fairly seamless. Ordinary users do not have to worry about certificates or anything. They just log in with their face, fingerprint, or a computer-local PIN. I think what prevents wider adoption of WebAuthn is the fear that users are going to lose their phone and not have a backup authenticator. But, people probably lose their phone less often than they forget passwords, so I doubt it changes the support burden much.
  - tialaramex 5y ago
    Our best hope is WebAuthn. For the user this is extremely simple. For the programmers it's a bunch of new stuff to learn (or a new library to pull in) when implementing it, including things like you're going to want a whole new RDBMS table not just a wider "password" in the database - but for the user it's very simple and impossible to get wrong. I implemented it by hand for my vanity site, it was not a tremendous amount of work. GitHub - since they are the topic after all - offers it today. But beyond big hitters (e.g. Gmail, Facebook) I am disappointed by how few have bothered. It's a night and day difference in terms of security and in terms of ease of use but it seems most places aren't interested in doing more than the very bare minimum.
- 90211 5y ago
  Not everything needs perfect OpSec. sometimes convenience is more important. I don't care if my HN account gets hacked and if I was forced to use 2FA I would just stop using it. Passwords have security vulnerabilities, sure. But they're intuitive and usable. When you start trying to come up with alternatives there become dozens of edge-cases in which your system fails.
  - jrockway 5y ago
    Passwords are exceedingly inconvenient, and getting rid of them doesn't require adding a second factor. To use passwords, you have to constantly monitor the Internet to see if it's been leaked (in the case where you use a password and memorize it), or you have to subscribe to a third-party service to manage your passwords. To use WebAuthn, you just need the functionality built into your OS. Physical custody of your computer and the screen lock then protect your online accounts. Or in the case of Github, you generate an SSH key and put the public key in Github and keep the private key around. Both are much more convenient than passwords, but also more secure. It's a win/win.

Passwords are probably one of the worst things to happen to our field as a whole (phishing, password managers, etc. are the results of their ubiquity), so efforts to remove them are probably not part of some Microsoft plan to kill open source. This change is a good thing.

HeckFeck 5y ago
Indeed. I wish there was something like a token or key that was as ubiquitous as passwords. Though from a developer POV I can certainly see why passwords are so attractive: take a word, hash it, compare hash on subsequent logins. The alternatives are tricky, but not I suspect impossible, to do in a decentralised manner. I've often pondered that something like PGP servers with revocation certificates, but adapted to logins would be near the realm of a solution.
- toiletaccount 5y ago
  Do you want to be the one to explain PGP and revcerts to somebody who has used the same password for everything their whole life?
  - HeckFeck 5y ago
    That's why I said 'something like'. An extension of the idea adapted for wider use. I'm certain such a person uses TCP/IP every day and doesn't need it explained. Yet twenty years ago, some knowledge of IP addresses and subnet masks etc was necessary to get connected.
    - jrockway 5y ago
      Yeah, I think WebAuthn is fairly seamless. Ordinary users do not have to worry about certificates or anything. They just log in with their face, fingerprint, or a computer-local PIN. I think what prevents wider adoption of WebAuthn is the fear that users are going to lose their phone and not have a backup authenticator. But, people probably lose their phone less often than they forget passwords, so I doubt it changes the support burden much.
- tialaramex 5y ago
  Our best hope is WebAuthn. For the user this is extremely simple. For the programmers it's a bunch of new stuff to learn (or a new library to pull in) when implementing it, including things like you're going to want a whole new RDBMS table not just a wider "password" in the database - but for the user it's very simple and impossible to get wrong. I implemented it by hand for my vanity site, it was not a tremendous amount of work. GitHub - since they are the topic after all - offers it today. But beyond big hitters (e.g. Gmail, Facebook) I am disappointed by how few have bothered. It's a night and day difference in terms of security and in terms of ease of use but it seems most places aren't interested in doing more than the very bare minimum.
90211 5y ago
Not everything needs perfect OpSec. sometimes convenience is more important. I don't care if my HN account gets hacked and if I was forced to use 2FA I would just stop using it. Passwords have security vulnerabilities, sure. But they're intuitive and usable. When you start trying to come up with alternatives there become dozens of edge-cases in which your system fails.
- jrockway 5y ago
  Passwords are exceedingly inconvenient, and getting rid of them doesn't require adding a second factor. To use passwords, you have to constantly monitor the Internet to see if it's been leaked (in the case where you use a password and memorize it), or you have to subscribe to a third-party service to manage your passwords. To use WebAuthn, you just need the functionality built into your OS. Physical custody of your computer and the screen lock then protect your online accounts. Or in the case of Github, you generate an SSH key and put the public key in Github and keep the private key around. Both are much more convenient than passwords, but also more secure. It's a win/win.