3 ms·
Today's security model is broken. And most people, included readers here at HN equate safety with a low probability of being hacked. I've signed up for at lea
by DevX101 15y ago
Today's security model is broken. And most people, included readers here at HN equate safety with a low probability of being hacked. I've signed up for at least 50 sites, probably more. The chances are good that not all of these sites have great security. And if anyone gets my password from that weak link, many of my other account are at risk.
Worse is if someone manages to get malicious software directly to my computer. At that point I'm screwed, and everything including email/bank accounts are an open book.
I don't know what the answer is but I sure hope someone would fix it.
- Simucal 15y agoI've started using two-factor authentication with my Google account and it isn't that bad. The mild pain of having to type in my authentiation number occasionally is offset by my increase peace of mind. It does require you to use an authenticator app on your smartphone though, so for some it might not be an option.
- graeme 15y agoTwo-factor authentication is nice. I know many of my different logins are vulnerable, but they're also for sites that aren't very important, even if comprimised. Gmail is a different story. Anyone with access to that gets access to most other things. So the inconvenience of inputing a text message code once a month pales in comparison to the hurdle it adds to accessing my account.
- dos1 15y agoI feel like I should turn in my nerd card, as I had no idea Google was currently offering two factor auth. Thanks for mentioning this!
- morsch 15y agoYou can use SMS notifications, so a smartphone isn't strictly required. Is the authenticator app experience much better? Using SMS is fairly painless, as far as possible with two-factor auth.
- sneak 15y agoA good cross-platform syncing password manager is the partial solution. I recommend https://agilebits.com/onepassword https://agilebits.com/onepassword . (I'm not affiliated, just a user. It works a charm.) Only downside is that the keychain file is not encrypted as a whole, only the passwords, so if someone steals your database file they've a list of all your usernames and sites that you have an account on (but not the passwords thereto). It's the same for the OSX keychain, e.g.: strings ~/Library/Keychains/login.keychain | egrep -i 'com|net|org'
- thret 15y agoOn PokerStars, all high-volume players get an RSA SecureID tag. That feels safe. SecureID were hacked but apparently Stars weren't compromised... anyway, they seem like a good idea. I wish my bank and email account each had one also.
- eli 15y agoGMail's two-factor authentication is close. Also, free.
- ballard 15y agoUsing passwords is like buying a regular lock, knowing full well it is both pickable, bumpable and impressionable. Most startups simply ignore security or figure they'll do it later, leaving their customers vulnerable. This is a really shitty externality. :( Users: 1) Use a unique password per service. 2) Don't store them nearby. 3) Enable all two-factor authentication mechanisms (AWS has a Gemalto fob, Google has mobile apps). Startups: 1) Support hybrid OpenID+OAuth (makes it someone else's problem, true.) 2) Audit early, both internal and external. 3) Set an example for your organization by practicing good security hygiene. Innovators: 1) Passwords suck. Let's get rid of them with an opt-in, non-profit identification provider (cross-platform USB fob, usable SDKs for A3E open standards) dedicated to providing independent, private, provable security (sans theater) for the benefit of everyone (even corporate). (Board members: security peeps, eff, etc.) Basically... make auth{entication|orization} easier and more secure (not mutex) for end users to signup/login to services and manage app-app permissions, increasing conversation rate.