6 ms·
The need for MFA is an admission that all the education about passwords has completely failed. Even after decades of pleading, users still reuse passwords, choo
by orev 5y ago
The need for MFA is an admission that all the education about passwords has completely failed. Even after decades of pleading, users still reuse passwords, choose pet names, and do other dumb things. Forcing MFA it essentially telling users, “We tried to be friendly about this, and you didn’t listen.”
When accounts get hacked, the company is almost always blamed (in both the user’s and the public’s mind), even if they had nothing to do with it (the user was reusing a password from another site that got hacked). So there’s almost no choice but to require it, else they face a large reputational risk.
I find it odd you need to enter it so many times every day. Most sites allow you to “trust this browser” for some period of time. Are you clearing cookies all the time? Sounds like you might be making it worse due to some other habits.
- marklar423 5y agoHopefully one day we'll all stop using memorized passwords and switch to hardware authentication. So much of this will go away.
- smilespray 5y agoIt's already happening.
- TeddyDD 5y agoNo until hardware tokens are so expansive. They need to be dirt cheap.
- teknopaul 5y agoPoint is people have to choose a password and supply an email (for the company to spam) just to comment on a news article or submit a bug report. Of course passwords are reused for all that type of website. 2FA is a PITA when you don't even care if your account is hacked. If money or reputation is concerned people take more care. It is trivial to set a long random cookie on a machine that provides 2FA for all repeated use of a service until the user deletes tokens or changes device. No need for bad UX.
- smilespray 5y agoIt's not fair to blame users on this, because it's impossible to "teach" people to come up with and remember 100+ hard passwords and recall which service which password belongs to. Passwords were the problem to begin with. Easy to implement, but extremely hard to remember and use correctly. MFA is part of the solution to this problem.
- freddex 5y agoBut is it just a question of education, or also a question of usability? A nice, random sequence of alphanumerical characters that can not be connected to the user at all is, unsurprisingly, hard to remember for the user. Dumb stuff like reusing passwords and choosing pet names is a mistake from a security perspective of course, but also a mitigation of the poor usability of passwords. Don't expect the user to remember dozens and hundreds of strong passwords. Rather, I would advocate password managers. For me personally, the simple usability of Firefox's integrated password manager (auto-suggests a strong password on account creation, auto-saves the credentials and syncs them across devices) has done more to improve my passwords than all education. I guess I am lazy, but many people are.
- smilespray 5y agoOf course you're not lazy. You're just human. Our brain isn't designed to store and recall this kind of information.
- jimbokun 5y agoLaziness is one of the cardinal programmer virtues: https://wiki.c2.com/?LazinessImpatienceHubris https://wiki.c2.com/?LazinessImpatienceHubris
- rekabis 5y ago> hard to remember for the user If the user has to remember any password aside from a single unique password used in only one place, they’re doing passwords horrendously wrong. We have had at least twenty years of password managers by now (KeePass), a good ten of them with browser integrations of various degrees of effectiveness, and almost as long with some form of mobile phone support. At this point, not using a password manager to save totally-random passwords that don’t need remembering is no different than not using a seatbelt. It’s stupidity and ignorance in action.
- hotpotamus 5y agoI just looked at my password manager and it has 421 entries plus a few secure notes and other things. I don't believe I have the capacity to remember that many 12 character random passwords with symbols, numbers, capitals, etc...
- MattGaiser 5y agoThe symbols, numbers, and capitals are part of the problem. We should have been using passphrases all along. https://xkcd.com/936/ https://xkcd.com/936/ I still remember the XKCD password.
- ThePowerOfFuet 5y ago> I still remember the XKCD password. Now try remembering 436 different ones.
- RhetoricX 5y agoExactly. And also remember which of those 436 easily-remembered passphrases go with which accounts.
- u801e 5y agoCorrect <url> horse battery staple
- pllbnk 5y agoI have to disagree with the perceived security with this approach because it fails the requirement of not reusing your passwords. In case you have this clever scheme and use it on some malicious or insecure website, your scheme could be leaked and then it's only marginally harder to break into your other accounts. Randomly generated passwords don't have this weakness.
- u801e 5y ago
- teknopaul 5y agoOf course the real reason for 2fa over sms, is that companies want your phone number as well as your email address.
- smilespray 5y agoIt's because just about everybody has a phone.
- texasbigdata 5y agoIt's because, unlike email, phones are approximately 1:1 to humans.
- toast0 5y agoSure, they may have nefarious purposes. But it's also because most people have a working recovery path when they drop their phone in the river. 2FA without a recovery path that people will actually prepare for is a recipie for locked out users, and that's going to mean your customer service gets all the sad stories and hopefully has no ability to do anything about them.
- AnIdiotOnTheNet 5y agoI think that's evidence that we just haven't done a good job when it comes to accounts and account security. Users choose simple passwords and reuse passwords because otherwise they need to remember a different complex password for every single goddamned thing they interact with, a number that has skyrocketed in the past decade or two. I can't honestly say I know of a better way, though. Something involving identification using asymmetric keys would be a good start to replace username/password, but that doesn't really solve the problem of losing or compromised private key in a way that's any better than we have currently for passwords.
- GoodJokes 5y ago
- u801e 5y agoMFA could have largely been unnoticed had there been large scale adoption of client side SSL/TLS certificates. This would have required a better UX on the browser side and an account creation process that made creating a CSR locally, transmitting it, receiving the cert and storing it transparent. Then as long as both the username/password and certificate authentication were required, then password reuse wouldn't matter.
- throwaway581294 5y agoYou could go one step further and just put a pin in with the cert or no pin at all and just have seamless logins everywhere. Assuming you are using a physical cert token.
- u801e 5y agoThen you lose one factor which is the username/password. If someone managed to get your hardware token and was able to brute force the PIN (if there was a PIN set), then they could log into any of your accounts. By requiring both, an adversary would not be able to log in unless they had the certificate and the username/password. Using one of the two would not be sufficient.
- deleted 5y ago[deleted]
- freitasm 5y agoThat's how passwordless works with Yubikeys on Office 365 and Microsoft Accounts.