11 ms·
This is an extremely bad take. Instead of standing up a hypothetical strawman, let's look at what Microsoft has actually replaced the password with. There are q
by Godel_unicode 5y ago
This is an extremely bad take. Instead of standing up a hypothetical strawman, let's look at what Microsoft has actually replaced the password with. There are quite a few, ahem, choices.
From the blog post the article cites, those options are: Microsoft Authenticator app, Windows Hello, a security key, or a verification code sent to your phone or email. Note that Windows hello is also carrying a lot of water here, as that's facial recognition, pin, pattern, or fingerprint.
The biggest place that the password argument falls apart is, these choices are not exclusive. You can use any combination of them that you want. You can use multiple of the same option i.e. security keys or fingerprints.
- kortex 5y ago> From the blog post the article cites, those options are: Microsoft Authenticator app, Windows Hello, a security key, or a verification code sent to your phone or email. Mmm, yup that all sounds terrible. I agree with GP, I like the ability to decide how to manage logging in. Passwords are a "least worst" kind of system.
- Spivak 5y agoPasswords are a lowest common denominator kind of system. They're an unstructured primitive that people can add structure to in order to create a system. Everyone ad-hoc creates their own and most people are really bad at it. Whether it's memorization, deriving them from some other key, storing them in a HSM, or in a password manager.
- kortex 5y agoExactly, they are the primitives of security systems. If passwords are broken, then every other security system is suspect. If users can't be trusted with passwords because most people are really bad at it, and people are bad at it because they are human, why should I trust MS's human developers to do any better? Why should I trust anyone to do better? Exploitable software has resulted in far more economic damage than bad passwords. It seems like a massive XY problem where somehow many people have come to the Y "let's get rid of passwords" as the solution, when the X is a mixture of solved problems: - "people are bad at entropy" (password gens, sensible entropy rules) - "people are bad at memorizing orthogonal unique strings" (password management schemes and systems) - "passwords leak" (detect wild passwords and facilitate rotation) The humble "secure string" allows the implementation gamut from "hunter2" to kilobits of noise, stored in a browser, chip, or post-it. Just prevent the worst incarnations. Passwords are not broken.
- Causality1 5y agoIndeed. Shit, just this year Microsoft signed a kernel driver containing a rootkit and didn't notice until third parties alerted them three months later. Those are the people you want in control of all your online accounts?
- tialaramex 5y agoBut if you're worried about Microsoft, you shouldn't want a shared secret such as a password. The whole problem with shared secrets is that the other party might lose it. For WebAuthn, even if Microsoft literally makes a web site "Get tialaramex's authentication credentials here" solely to reveal the credentials they have for me, it doesn't help bad guys at all. Completely useless. The credentials only help Microsoft, and only to verify me. That's the "scary" passwordless future, authentication that actually works and can't be weaponised against you, terrifying...
- notriddle 5y ago> Exactly, they are the primitives of security systems. If passwords are broken, then every other security system is suspect. If users can't be trusted with passwords because most people are really bad at it, and people are bad at it because they are human, why should I trust MS's human developers to do any better? Passwords that are managed by hand are broken. If you’re already using an automated password manager, then you’re probably fine. Humans can build tools that do stuff better than unassisted humans can do it. Cars are faster than humans, even though humans built them. Dice are better at generating random numbers than unassisted humans, and they’re literally just marked cubes. Of course, the Windows end-users could build software-based password managers instead of doing it by hand, and some have. But it’s not the default, so many don’t. > Why should I trust anyone to do better? Exploitable software has resulted in far more economic damage than bad passwords. You seem to be underestimating the amount of economic damage caused by phishing and password reuse, both of which can be largely chalked up to manual password management. But am willing to be corrected on this. [citation needed]
- kortex 5y ago
- deleted 5y ago[deleted]
- ryanlol 5y agoHow is TOTP terrible? How are security keys terrible?
- dijksterhuis 5y agoParent could be talking more about vendor lock-in rather than protocols. At least that's my bug bear with this. I know 2FA SMS is less secure, but I'm sticking with it as long as MS require a MS app (or I'm forced off SMS 2FA).
- ryanlol 5y agoMS doesn’t require a MS app unless they’ve changed something recently.
- dijksterhuis 5y agoOh FFS! It's a hidden menu option when you go to [1]. Have to click Configure App Without Notifications once you click Setup Authenticator App. Two years of misery and stubbornness. One hidden menu option. [1]: https://account.activedirectory.windowsazure.com/proofup.aspx?proofup=1 https://account.activedirectory.windowsazure.com/proofup.asp...
- soundnote 5y agoAny TOTP works fine, they just advertise their own obviously, and it has extra conveniences for their own accounts.
- kortex 5y agoAh, ok. They make it sound like it _has_ to be their flavor of OTP. That's...slightly better, I guess. I still want passwords though as the base level.
- kortex 5y agoUgh. I just spent the whole day screwing around trying to debug SAML SSO for setting up a VPN on AWS. Brain is fried and I feel no closer to my goal. I realize that's somewhat unrelated to passwords, but my point is "Identify management is _hard_". Passwords just kinda work. That's the _opposite_ of broken. We just need to train out the bad habits (storing plaintext, allowing dictionary words, etc).
- arsome 5y agoOkay, and I don't want to install an app, don't want "Windows Hello" to have my face, don't have a "security key" and don't want to give Microsoft my phone number. All of these options seem to have a damning tendency to compromise your privacy in one way or another. Passwords remain the best option for privacy, especially when a company refuses to implement TOTP.
- tallanvor 5y agoWindows Hello is basically the same thing as how you unlock your phone with Apple or Android. --Your biometric data doesn't leave your device, instead it's used to unlock a certificate in a TPM. I'm not sure how that's supposed to compromise your privacy.
- Talanes 5y agoThough it can easily fall prey to the same problem as the security key: my machine doesn't have any biometric inputs, so I'm at least back to "buy something."
- Godel_unicode 5y agoPIN, pattern, phone app.
- scoutt 5y agoIf those are three different things, and I can choose one of those, why a four number PIN code would be safer than a password?
- tremon 5y agoMicrosoft's "PIN" is not a four-number digit code, it's an arbitrary-length device passphrase that can include all symbols found on your keyboard. The only reason they don't call it a password is because you already have a (global) account password, and the PIN only serves to unlock that device. If you have two devices, you can have a different PIN for both, that will still log you into the same account.
- gorwell 5y agoIt's actually a good take. They pointed out that you don't need an extra piece of software or device.
- Godel_unicode 5y agoPIN.
- robertlagrant 5y agoIn two years: PIN deprecated.
- Godel_unicode 5y agoMicrosoft still supports SMBv1 released in 2003. For the love of God don't use it, but you could.
- robertlagrant 5y agoThat's true. But also, how's your Kin/Windows 8 RT device/Windows Phone/Surface Neo/Microsoft eBooks/PlaysForSure music collection? :-)
- makeitdouble 5y agoTo me a weird part where these hit hard is on shared access to common resources. The two options I see are either: - Have shared access baked in the service and each user has its own account, with its own auth means - Go through elaborate schemes to somewhat share a single account's credentials. Shared access with multiple accounts is currently a PITA in most services. Apple for instance still doesn't really understand how families work. Google is also suboptimal, even for cases like common photo libraries (not albums, whole libraries), and their weird separation of standard accounts getting access to all services under the sun, and GSuite/Workplace "second class" accounts doesn't help at all. I don't see Microsoft being better on most of its services, but I don't use them enough to have a strong opinion. So the remaining way to handle these fairly common issues is to have a master account shared among two or more people, and most of these auth options rely on biometrics or fairly personal services. If that's the path forward, I wish they'd clear the surrounding issues first.
- Godel_unicode 5y agoYou can enroll multiple fingers, you can enroll multiple security keys, you can enroll multiple phone numbers, and you can create and share an account PIN. Choose any combination of these authenticators. Microsoft also has very mature permissions for all of their web properties like OneDrive and SharePoint/Teams. So you can also give people their own logins and then share stuff between them.
- Justin_K 5y agoSo if you lose your phone or are unconscious, say goodbye to your accounts.
- Godel_unicode 5y agoHuh? Did you miss the part where you can have multiple options setup at the same time, and use whichever you want whenever you want?
- raxxorrax 5y agoCan I use a password?
- y4mi 5y agoThis comment reminds me of all the people that open PR in php projects to replace various hashing algorithm with md5, because that one is built-in and obviously superior Especially in web context the new authentication APIs such as webauthn are long overdue and I'm looking forward to the next generation of password managers that will hopefully keep these generated keys synchronized between devices
- raxxorrax 5y agoMD5 is relatively secure for many applications. You can substitute a few bytes without changing the hash so that leaves some applications for manipulation. It is correct to not use it anymore, but you should know about the specific pitfalls. There is nothing like this for passwords or do you want to elaborate further? A password can even offer superior security in some cases. You can gladly use webauthn if the service supports it. I just want to keep options. I also dislike synchronizing devices in some cases because that can be a security problem. I also like to compartmentalize some things.
- y4mi 5y ago> MD5 is relatively secure for many applications This is pure gold.
- raxxorrax 5y agoFinding m' from m with the same hash even with an old md5 is not trivial. It has been memed as such, but it is not the case. Don't use it anyway for any application because there are problems and you would need to talk to walls to explain why it can be safe for certain applications. There is a theoretical solution preimage attacks too, but I don't think it was ever demonstrated. I know this is a lost discussion, but it is technically correct. End of comment.
- ptx 5y agoWhat are my choices for accessing a service that uses Microsoft's "identity platform" / "modern authentication" / (whatever they're calling it now) from a cross-platform desktop client application? From what I can tell from their ADAL/MSAL documentation, the choices seem to be 1) using Windows with Windows Integrated Authentication (i.e., not cross-platform) or 2) building a web app that redirects to their web-based authentication flow (i.e, not a desktop app).