5 ms·

Indeed. I wish there was something like a token or key that was as ubiquitous as passwords. Though from a developer POV I can certainly see why passwords are s

Indeed. I wish there was something like a token or key that was as ubiquitous as passwords. Though from a developer POV I can certainly see why passwords are so attractive: take a word, hash it, compare hash on subsequent logins. The alternatives are tricky, but not I suspect impossible, to do in a decentralised manner. I've often pondered that something like PGP servers with revocation certificates, but adapted to logins would be near the realm of a solution.

toiletaccount 5y ago
Do you want to be the one to explain PGP and revcerts to somebody who has used the same password for everything their whole life?
- HeckFeck 5y ago
  That's why I said 'something like'. An extension of the idea adapted for wider use. I'm certain such a person uses TCP/IP every day and doesn't need it explained. Yet twenty years ago, some knowledge of IP addresses and subnet masks etc was necessary to get connected.
  - jrockway 5y ago
    Yeah, I think WebAuthn is fairly seamless. Ordinary users do not have to worry about certificates or anything. They just log in with their face, fingerprint, or a computer-local PIN. I think what prevents wider adoption of WebAuthn is the fear that users are going to lose their phone and not have a backup authenticator. But, people probably lose their phone less often than they forget passwords, so I doubt it changes the support burden much.
tialaramex 5y ago
Our best hope is WebAuthn. For the user this is extremely simple. For the programmers it's a bunch of new stuff to learn (or a new library to pull in) when implementing it, including things like you're going to want a whole new RDBMS table not just a wider "password" in the database - but for the user it's very simple and impossible to get wrong. I implemented it by hand for my vanity site, it was not a tremendous amount of work. GitHub - since they are the topic after all - offers it today. But beyond big hitters (e.g. Gmail, Facebook) I am disappointed by how few have bothered. It's a night and day difference in terms of security and in terms of ease of use but it seems most places aren't interested in doing more than the very bare minimum.

toiletaccount 5y ago

Do you want to be the one to explain PGP and revcerts to somebody who has used the same password for everything their whole life?

HeckFeck 5y ago
That's why I said 'something like'. An extension of the idea adapted for wider use. I'm certain such a person uses TCP/IP every day and doesn't need it explained. Yet twenty years ago, some knowledge of IP addresses and subnet masks etc was necessary to get connected.
- jrockway 5y ago
  Yeah, I think WebAuthn is fairly seamless. Ordinary users do not have to worry about certificates or anything. They just log in with their face, fingerprint, or a computer-local PIN. I think what prevents wider adoption of WebAuthn is the fear that users are going to lose their phone and not have a backup authenticator. But, people probably lose their phone less often than they forget passwords, so I doubt it changes the support burden much.

tialaramex 5y ago

Our best hope is WebAuthn. For the user this is extremely simple. For the programmers it's a bunch of new stuff to learn (or a new library to pull in) when implementing it, including things like you're going to want a whole new RDBMS table not just a wider "password" in the database - but for the user it's very simple and impossible to get wrong. I implemented it by hand for my vanity site, it was not a tremendous amount of work. GitHub - since they are the topic after all - offers it today. But beyond big hitters (e.g. Gmail, Facebook) I am disappointed by how few have bothered. It's a night and day difference in terms of security and in terms of ease of use but it seems most places aren't interested in doing more than the very bare minimum.