5 ms·

Stop trying to make no passwords happen. It won't happen

papito 5y ago
"But people will never let their on-prem servers go into an obscure, shared Cloud".
ashwagary 5y ago
It can happen, I've seen many Lightning Network applications that do account creation/login and identity verification using LN wallets/nodes/etc. I wouldn't consider those solutions passwords in the traditional sense.
- bo1024 5y ago
  Public key authentication would be a great replacement for most passwords.
jbverschoor 5y ago
Email a login link or temp pw. Passwords gone.
- datavirtue 5y ago
  Ok...so on to more inconvenient methods? Medium tried it. A real drag.
- numpad0 5y ago
  Depends on how often you’ll be logging in and out though
- shoto_io 5y ago
  I share accounts (legally) with friends and my wife. How are we going to log in separately?
  - jbverschoor 5y ago
    Forward the email ;-) Or just add an extra email to the account
    - shoto_io 5y ago
      Forwarding the email is not a good solution. I don’t want to be checking emails at all times just because someone wants to login somewhere. Adding an extra email account is not always possible. The option is not provided.
- thanhhaimai 5y ago
  Maybe I'm missing something. You're just replacing the "password" by asking the user to login their email. It doesn't move us any closer to a "no password" world, unless there is also a proposal on how to make email password-less?
  - darkerside 5y ago
    https://www.google.com/amp/s/www.theverge.com/platform/amp/2021/9/15/22675175/microsoft-account-passwordless-no-password-security-feature https://www.google.com/amp/s/www.theverge.com/platform/amp/2...
- bananamerica 5y ago
  How do you login to your email?
  - martin_a 5y ago
    Magic text message with an 8-digit code. ;-) For anyone thinking about it: Please don't make it happen.
- lukebennett 5y ago
  What if you are logging into something on a device that doesn't have your email on it? So called magic links are an absolute nightmare.
johanneskanybal 5y ago
The only reason for (consumer) passwords you have to remember is lack of an accepted good universal id in general. Here in Sweden it's provided by the banks and has a 94% share of smartphone users, if you look east you have other bigger markets with similar stats. Most passwords already have disappeared or are disappearing, the laggard cases will catch up too, I'd love a similar one for my "work persona".
threeseed 5y ago
It sort of has happened for Apple users. For all sites whenever you signup for a website a random password is generated. And then when you re-visit the site you use FaceID/TouchID to automatically pre-populate the password. At that point it really isn't a password in the traditional sense. And for an increasing number of sites it bypasses this step entirely and just lets me use FaceID/TouchID.
- netizen-936824 5y ago
  Why single out apple? This is the experience for anyone who uses a modern password manager
  - daedalus_f 5y ago
    Most people don’t and won’t change if change requires effort. In contrast by making a password manager functionality the default on Mac/iOS, Apple carries the average user into better security.
- dotancohen 5y ago
  > really isn't a password in the traditional sense. Can it be sniffed out with XSS? Can it be sniffed out over the wire on the university Mitm'd network? Can it be stored on the server in plain text? The user experience might have changed, but many of the security aspects have not.
  - cmeacham98 5y ago
    I'm pretty sure that poor passwords ("password1!") and password reuse combined dwarf basically all other password-related security issues, thus getting users to use a randomly generated password on every website is a magnitude of order more secure. On top of that, in cases of XSS or a MiTM you've probably already lost and no password alternative will help you.
    - dotancohen 5y ago
      Webauthn is secure even in the case of XSS and Mitm, in the sense that the attackers still cannot access the credentials without user intervention. It tool a long time to convince me, too. https://webauthn.me/introduction https://webauthn.me/introduction
adolph 5y ago
Password reset is almost as good as no passwords but with the added benefit of MFA.

"But people will never let their on-prem servers go into an obscure, shared Cloud".

It can happen, I've seen many Lightning Network applications that do account creation/login and identity verification using LN wallets/nodes/etc. I wouldn't consider those solutions passwords in the traditional sense.

bo1024 5y ago
Public key authentication would be a great replacement for most passwords.

jbverschoor 5y ago

Email a login link or temp pw. Passwords gone.

datavirtue 5y ago
Ok...so on to more inconvenient methods? Medium tried it. A real drag.
numpad0 5y ago
Depends on how often you’ll be logging in and out though
shoto_io 5y ago
I share accounts (legally) with friends and my wife. How are we going to log in separately?
- jbverschoor 5y ago
  Forward the email ;-) Or just add an extra email to the account
  - shoto_io 5y ago
    Forwarding the email is not a good solution. I don’t want to be checking emails at all times just because someone wants to login somewhere. Adding an extra email account is not always possible. The option is not provided.
thanhhaimai 5y ago
Maybe I'm missing something. You're just replacing the "password" by asking the user to login their email. It doesn't move us any closer to a "no password" world, unless there is also a proposal on how to make email password-less?
- darkerside 5y ago
  https://www.google.com/amp/s/www.theverge.com/platform/amp/2021/9/15/22675175/microsoft-account-passwordless-no-password-security-feature https://www.google.com/amp/s/www.theverge.com/platform/amp/2...
bananamerica 5y ago
How do you login to your email?
- martin_a 5y ago
  Magic text message with an 8-digit code. ;-) For anyone thinking about it: Please don't make it happen.
lukebennett 5y ago
What if you are logging into something on a device that doesn't have your email on it? So called magic links are an absolute nightmare.

johanneskanybal 5y ago

The only reason for (consumer) passwords you have to remember is lack of an accepted good universal id in general. Here in Sweden it's provided by the banks and has a 94% share of smartphone users, if you look east you have other bigger markets with similar stats. Most passwords already have disappeared or are disappearing, the laggard cases will catch up too, I'd love a similar one for my "work persona".

threeseed 5y ago

It sort of has happened for Apple users. For all sites whenever you signup for a website a random password is generated. And then when you re-visit the site you use FaceID/TouchID to automatically pre-populate the password. At that point it really isn't a password in the traditional sense. And for an increasing number of sites it bypasses this step entirely and just lets me use FaceID/TouchID.

netizen-936824 5y ago
Why single out apple? This is the experience for anyone who uses a modern password manager
- daedalus_f 5y ago
  Most people don’t and won’t change if change requires effort. In contrast by making a password manager functionality the default on Mac/iOS, Apple carries the average user into better security.
dotancohen 5y ago
> really isn't a password in the traditional sense. Can it be sniffed out with XSS? Can it be sniffed out over the wire on the university Mitm'd network? Can it be stored on the server in plain text? The user experience might have changed, but many of the security aspects have not.
- cmeacham98 5y ago
  I'm pretty sure that poor passwords ("password1!") and password reuse combined dwarf basically all other password-related security issues, thus getting users to use a randomly generated password on every website is a magnitude of order more secure. On top of that, in cases of XSS or a MiTM you've probably already lost and no password alternative will help you.
  - dotancohen 5y ago
    Webauthn is secure even in the case of XSS and Mitm, in the sense that the attackers still cannot access the credentials without user intervention. It tool a long time to convince me, too. https://webauthn.me/introduction https://webauthn.me/introduction

adolph 5y ago

Password reset is almost as good as no passwords but with the added benefit of MFA.