4 ms·
I agree with the author that passwords are poor solution from usability and security standpoint, and the reason they are used is because of easy implementation.
by codedokode 5y ago
I agree with the author that passwords are poor solution from usability and security standpoint, and the reason they are used is because of easy implementation.
Having to make a password is not a pleasant user experience. You type a password you used for another site only to get a message saying that you need to add digits and symbols. So annoying. Now you have to remember two passwords.
And if you try to follow the best security practices, everything becomes even more difficult. For example, it is recommended to use different passwords for different sites. But can an average human remember 20, 50 or 100 different passwords? Unlikely.
So instead users simply use same or similar passwords and save them in a browser. Which means, once their computer gets hacked or stolen all their passwords are leaked. And even if a user doesn't save passwords, they can be stolen with a keylogger.
Passwords can also be bruteforced or leaked when the server is hacked.
Here in Russia banks always require a SMS confirmation to login - which means that passwords are not considered secure by them.
Author suggests to use key files instead. They offer slightly better security if protected with a password, but still can be stolen by a malware and still have inconvenience of dealing with passwords. In legacy OS like Windows or Linux every application has access to all user files, so any of them could steal your keys.
Therefore I think that the solution to both usability and security issues would be a physical key. It could be optionally protected with a PIN code.
Imagine how easy it would be to login or register - you simply insert the key into a lock and press a button. It is better than passwords or key files in every aspect.
- ajsnigrutin 5y ago...until you get drunk and lose that key. Or until you leave it at home, and need to log in from work. Or until someone steals it. Or your kid flushes it. Or until police comes knocking at your door, and takes the key. I'll stay with passwords... a few important ones + a password manager for random forums and sites.
- usrbinbash 5y ago> But can an average human remember 20, 50 or 100 different passwords? Unlikely. Don't have to. That's my pwdmanager's job. I only have to remember the master key. Which can't get leaked if some webpage gets hacked, because its stored only on my machines. > And even if a user doesn't save passwords, they can be stolen with a keylogger. And physical keys can be stolen by a pickpocket. Or lost and found by someone. Or worse: The entity that issues them gets compromised (eg. forced into compliance by an authoritarian regime) and duplicates are issued. At least with my pwdmanager, I myself hold control (and responsibility) for the security of the system.