5 ms·

Why require a password manager when you could require a hardware token instead.

by postalrat 5y ago

Tagbert 5y ago
How do I use that on my phone?
- lxgr 5y ago
  If it's running a reasonably modern version of iOS or Android, it has one built in.
latchkey 5y ago
I'll let you explain that to my 90 year old grandma. (not that a password manager is really any better in this case)
- Symbiote 5y ago
  Would it be that difficult? Leave a small one connected to her computer (I assume she always uses the same one). The web browser prompts "Now touch your security key", and the light is flashing. It's also a good defence againt phishing, as the key won't authenticate against a phishing site.
  - latchkey 5y ago
    You haven't met her, she's an utterly horrid racist bigot terrible human. I stopped talking to her years ago. Hence why I wouldn't wish anyone to ever have to explain a hardware token to her.
Someone1234 5y ago
One costs money and requires a physical item, the other is commonly free, and you can sign in from multiple locations/devices. Hardware tokens have only managed to prove that hardware tokens won't ever take off due to their inherent limitations and liabilities.
- postalrat 5y ago
  Make them required, they will take off. Most phones made in the past few years can operate as one.
  - fsflover 5y ago
    > Most phones Are you going to force people to use specific smartphones?
    - lxgr 5y ago
      How many smartphones these days are not running iOS or Android? Even then, nothing keeps the vendors of alternative smartphone OSes from implementing a FIDO platform authenticator.
      - fsflover 5y ago
        > How many smartphones these days are not running iOS or Android? Those that fight the duopoly and allow user freedom: Librem 5 and Pinephone. I really hope that it could use an open standard. Then, it's probably fine.
        lxgr 5y ago
        FIDO is an open standard! https://fidoalliance.org/fido2/ https://fidoalliance.org/fido2/ Nothing is preventing either OS from implementing it, either as a platform authenticator or via NFC, USB or Bluetooth support for external authenticators.
  - wruza 5y ago
    Do you mean like via NFC? That would be great, are there viable solutions for windows/etc?
tzs 5y ago
Personally, because I do not want a repeat of the great toilet paper escalation of 1984. I used to buy toilet paper in individual rolls. I'd buy a couple rolls, and when I was on the last roll I'd make a mental not to myself to buy a couple more rolls next time I went grocery shopping. One day, when I was on my last roll, I ate some bad fast food which left my digestive system in a state that one roll was not sufficient to handle. With much effort I was able to regain sufficient control for a very hasty trip to the convenience store. From then on, I bought my TP in four packs, and put "get more TP" on my list whenever I had finished two rolls from the current pack. Alas, another bad fast food experience managed to defeat even that, although I was again able to barely make an emergency trip to the store safely. So I upped it to buying two 4 packs--but it was too late. I felt nervous even with 8 rolls on hand, so I started making sure I had 12 rolls all the time. Then as soon as I opened a pack I'd get an urge to buy more TP. Every trip to the store I'd buy some TP. It took some effort but I managed to realize I had gone off the deep end and bring myself back to more normal TP acquisition habits. I'm afraid that the if I get a hardware token and a backup token, the first time something happens to the main token I'll end going down that same path I did with TP and end up with a couple dozen tokens.
- wruza 5y ago
  Well, that was quite a story. Have you considered water-washing? Not that it seemed possible to draw an analogy with hw tokens, but still. Another way to handle these rare events is to have an emergency-only 12-pack and then go with your regular a couple of rolls mode.

Why require a password manager when you could require a hardware token instead.

Tagbert 5y ago

How do I use that on my phone?

lxgr 5y ago
If it's running a reasonably modern version of iOS or Android, it has one built in.

latchkey 5y ago

I'll let you explain that to my 90 year old grandma. (not that a password manager is really any better in this case)

Symbiote 5y ago
Would it be that difficult? Leave a small one connected to her computer (I assume she always uses the same one). The web browser prompts "Now touch your security key", and the light is flashing. It's also a good defence againt phishing, as the key won't authenticate against a phishing site.
- latchkey 5y ago
  You haven't met her, she's an utterly horrid racist bigot terrible human. I stopped talking to her years ago. Hence why I wouldn't wish anyone to ever have to explain a hardware token to her.

Someone1234 5y ago

One costs money and requires a physical item, the other is commonly free, and you can sign in from multiple locations/devices. Hardware tokens have only managed to prove that hardware tokens won't ever take off due to their inherent limitations and liabilities.

postalrat 5y ago
Make them required, they will take off. Most phones made in the past few years can operate as one.
- fsflover 5y ago
  > Most phones Are you going to force people to use specific smartphones?
  - lxgr 5y ago
    How many smartphones these days are not running iOS or Android? Even then, nothing keeps the vendors of alternative smartphone OSes from implementing a FIDO platform authenticator.
    - fsflover 5y ago
      > How many smartphones these days are not running iOS or Android? Those that fight the duopoly and allow user freedom: Librem 5 and Pinephone. I really hope that it could use an open standard. Then, it's probably fine.
      - lxgr 5y ago
        FIDO is an open standard! https://fidoalliance.org/fido2/ https://fidoalliance.org/fido2/ Nothing is preventing either OS from implementing it, either as a platform authenticator or via NFC, USB or Bluetooth support for external authenticators.
- wruza 5y ago
  Do you mean like via NFC? That would be great, are there viable solutions for windows/etc?

tzs 5y ago

Personally, because I do not want a repeat of the great toilet paper escalation of 1984. I used to buy toilet paper in individual rolls. I'd buy a couple rolls, and when I was on the last roll I'd make a mental not to myself to buy a couple more rolls next time I went grocery shopping. One day, when I was on my last roll, I ate some bad fast food which left my digestive system in a state that one roll was not sufficient to handle. With much effort I was able to regain sufficient control for a very hasty trip to the convenience store. From then on, I bought my TP in four packs, and put "get more TP" on my list whenever I had finished two rolls from the current pack. Alas, another bad fast food experience managed to defeat even that, although I was again able to barely make an emergency trip to the store safely. So I upped it to buying two 4 packs--but it was too late. I felt nervous even with 8 rolls on hand, so I started making sure I had 12 rolls all the time. Then as soon as I opened a pack I'd get an urge to buy more TP. Every trip to the store I'd buy some TP. It took some effort but I managed to realize I had gone off the deep end and bring myself back to more normal TP acquisition habits. I'm afraid that the if I get a hardware token and a backup token, the first time something happens to the main token I'll end going down that same path I did with TP and end up with a couple dozen tokens.

wruza 5y ago
Well, that was quite a story. Have you considered water-washing? Not that it seemed possible to draw an analogy with hw tokens, but still. Another way to handle these rare events is to have an emergency-only 12-pack and then go with your regular a couple of rolls mode.