7 ms·
When will we stop using passwords?! They are an elementary school kid “secret club” game taken way, way too far. They are totally broken. Nobody can come up w
by krupan 5y ago
When will we stop using passwords?! They are an elementary school kid “secret club” game taken way, way too far. They are totally broken. Nobody can come up with and remember good passwords. Nobody can store passwords securely. 100% busted.
Instead of continuing to debate what makes a good password, we need to put our energy into better techniques altogether! No more shared secrets! Let’s talk about one-time codes, asymmetric key cryptography, hardware tokens, anything but passwords!!
- rkeene2 5y agoThe US Government thought they were bad, and got rid of them. In 2004 (Thanks George W. Bush!)
- mojuba 5y agoIn one of my current web-based projects I decided to experiment with magic links sent via email. They are pretty convenient (and secure enough) but turns out there's a problem with mobile email clients: they tend to open links in isolated embedded browsers and then forget the cookies. For most non-technical people this is a show stopper unfortunately. I then went with one-time 6-digit sign in codes that are emailed to the user. These are secure enough if done right, but now I'm wondering if they will feel secure to the users. P.S. I might change it to a one-time alphanumeric code, which should feel more secure.
- voiper1 5y agoSometimes the magic links or codes expires in X minutes. That helps them feel secure. But like password resets, you're hosed if your email is hacked (unless you have 2FA).
- mojuba 5y agoNot only expiration, you also limit the number of attempts, the IP address, you verify an additional nonce token generated for the specific request, etc. The security of your email is typically taken care of by a more sophisticated system like GMail, that will do captcha, they remember your geographic region, your habits, etc. Given the above, I'd say alphanumeric one-time codes are better in terms of entropy and feel. They look like passwords but you don't need to remember them.
- krupan 5y agoSo, no worse than passwords at all
- GoblinSlayer 5y agoYou know that the opened token is linked to the initial client session. You can unblock that session and the user can proceed in the non-isolated browser. You have this workflow with codes anyway: the user must open an email then go back to the browser and type in the code. With the link you will save on the typing.
- deleted 5y ago[deleted]
- mojuba 5y agoInteresting! (I searched, even asked on SO, couldn't find any solution for this). So to elaborate: I first store a nonce in cookies as a login session token. Once the code is validated somehow, I unblock it on the backend, and on a first chance also set my main JWT cookie if not yet set. Excellent, that solves it! P.S. Unless there are some security implications - need to think about it a bit more. Thanks!
- kevincox 5y agoI find this way less convienent because my password manager automatically fills in my username and password. So I can log in with 1 click. With "magic links" I need to enter my email (which may be autocompleted, but it is much less reliable) and then wait for the email to show up. (Assuming I have my email available.) Also email is never going to be reliably "instant" spam techniques include bouncing an email and waiting for a retry which is going to frustrate users and slow down login. Additionally my security is now tried to the email I use which may be undesirable. So I see why this exists, but please consider also supporting username+password at least until something else browser-integrated comes along.
- mojuba 5y agoI know but it comes at a price of some users who don't use a password manager setting silly weak passwords. In one of my mobile apps that manages KeyChain user/passwords correctly, I still see a lot of password reset requests. I can't even think of a reason why people would ignore autofill so often. The result is, although I haven't checked, but wouldn't be surprized if there were still a lot of "password123"'s in the DB. So neither are passwords a good option, it seems.
- nybble41 5y agoDon't let the user set the password, just assign them something random. If you let users pick their own passwords some of them are guaranteed to pick insecure ones (i.e. anything which isn't random and unique to that site). Though frankly we should be able to do far better than one-off shared secrets for each account. WebAuthn, for example, with the browser as the authenticator, protected by either a client-side master password or biometrics. That would be at least as good as a password stored in a password manager, with the advantage that the user doesn't need to store (and sync) unique passwords for every site. To log in from a new device just enroll a second authenticator.
- krupan 5y agoMy experience with password managers is that it works that well on about 10% of websites/apps, and I have to resort to copy and paste from the password manager everywhere else. It's not that great
- BeFlatXIII 5y agoHaving to check my e-mail for each login is a major annoyance. Perhaps something like SQRL[0] may help. [0]: https://sqrl.grc.com/pages/what_is_sqrl/ https://sqrl.grc.com/pages/what_is_sqrl/
- jsmith99 5y agoHow is this better than oauth (assuming you use a provider who doesn't have or doesnt share your real name).
- krupan 5y agoMore annoying than passwords?
- perryizgr8 5y agoOf course. I can type a password from memory, or it can be auto-filled by the browser/password-mgr. No interruptions before signing in. Having to open email inbox means switching tabs/context.
- krupan 5y agoYou never forget a password and/or your password manager generates passwords and auto fills them with no hiccup for every website and app out there? Also changing passwords when a site policy requires it or when (not if) a breach happens? Because that is NOT my experience.
- perryizgr8 5y agoYes, occasionally there is a hiccup with the password system. But email link or code is disruptive and irritating 100% of the time.
- BeFlatXIII 5y agoMy password manager fills them in for me. E-mail means switching tabs and remembering which account I used to sign up for the service to know where to check.
- saltyfamiliar 5y agoI don't use a password manager and my email account is by far one of my most secure accounts so I actually love signing in to things like this. It beats having to remember another battery-horse-stapler type password. For more paranoid users you could add a 2FA option.
- perryizgr8 5y ago> one-time 6-digit sign in codes that are emailed to the user > I'm wondering if they will feel secure to the users I don't know about secure, but most users will feel extremely irritated for sure.
- Aerroon 5y agoHopefully never. Or at least not in the near future. Almost every other method is going to have privacy implications because they will rely on something you have or something you are. You can't compel passwords in a similar way that you can compel people to give physical tokens or fingerprints or retina scans.
- throwawayffffas 5y agoI agree and go even further that "something you have" is equivalent to a password. Even though "something you have" tends to be a public-secret key pair.
- krupan 5y agoFingerprints and retinal scans are not something I proposed. Your point is valid for those. Your point is not valid for hardware tokens vs. passwords. Especially when you consider that passwords used for authentication have to be written down somewhere and shared with a third party for them to work at all.
- taeric 5y agoI'm curious how you think these other items work. They ultimately boil down to a shared secret that is beyond what you can remember. Which... isn't the best thing, necessarily. Consider, if I leave my hardware token at home when I go on vacation, I'm basically locked out of all of my accounts. This is fine, as I typically plan for this to be the case. But it is an attack vector. I can't even audit my protected assets while away.
- Zamicol 5y agoThe point of public key cryptography is that there isn't a shared secret.
- yosamino 5y agoWhile technically correct, a private key will usually need to be encrypted to provide adequate security. From the user point of view, they will still need to remember the password to unlock this private key.
- taeric 5y agoFurther to this point, the shared item is moved to a public key and the infrastructure to facilitate communication. Such that it is not a panacea. Getting away from trust in the system is... Likely you will envision a system to register your key. And then you have to have a bootstrap to authenticate to this system. Probably a password.
- krupan 5y agoRight, if it’s not a panacea then we should definitely not pursue it.
- taeric 5y agoNot my point. Just not clear that the alternatives actually are better. Again, I use hardware tokens. Not seeing my family join me on that anytime soon. List of problems with every approach always falls back to, "what happens if you lose it?" And the resolution to that is always outside of the technical chain.
- yosamino 5y ago> Nobody can store passwords securely. 100% busted. [...] Let’s talk about > one-time codes One-time codes rely on a password: either it is stored in your 2FA App, or they rely on your email password, or they rely you storing a password somewhere else. OTP rely on stored secrets. You can make these secrets be much larger than the humble password and call them "private keys" : > asymmetric key cryptography, hardware tokens If these are not protected by a passphrase they can be stolen. Which seems like a variation of "nobody can store passwords securely". To mitigate the effects of them being stolen, you need to protect them with a password. I sympathize with your desire, but it's not that easy, although I do think that we can reduce password usage. But fundamentally a password is a trust anchor in your brain. I have yet to find a way around this limitation.
- smaudet 5y agoI don't actually think passwords are broken at all - I mostly used to see this from people pushing biometrics or hardware tokens (people selling stuff). How we use them, is very much broken. What is the point of a password that a bit of social engineering can bypass? Why are passwords required to get info on my ice cream rewards? Shouldn't I just get a coupon instead? You should only use passwords that mean something and they should not be resetable, otherwise you have something closer to a one time token with a replay attack. Forget the password? Tough luck. Either it should not have needed one, or it should have some tangible effect which causes the user to highly value forgetting or getting it stolen. We have engineered a state where we can't remember passwords because we are actively encouraged to ignore them, passwords are fine, how and when we use them is not.
- krupan 5y agoI feel like this whole argument is saying, "these other solutions have problems that somewhat resemble problems that passwords have, so just keep using passwords." Sorry I'm not convinced.
- krupan 5y ago“ fundamentally a password is a trust anchor in your brain.” In other words, something you have (until you forget it). But also something you have to give to someone else after which all security bets are off. A private key is also something you have (until you lose it). It is not something you ever have to give to anyone else. If you protect it with a password you don’t have to give that password to anyone else. Big difference!
- MattPalmer1086 5y agoTheres some nice research on a framework to assess different authentication schemes, e.g. security, usability, etc. Turns out passwords aren't great at most things but the alternatives often have big downsides. https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/QuestToReplacePasswords.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/...
- dredmorbius 5y agoPKI and physical tokens, preferably not involving plugging into any ports (NFC devices) have been my suggestion for most of a decade now. Passwords were adopted when comuting was something that occurred at a specific facility and the goal was to keep the people, largely the users one already knew of, out of one-another's accounts and data. The persistence of passwords in a world of global access and billions of devices is ... ludicrous. And the failure of both enterprises and governments to identify better standards and practices is criminal.