5 ms·

The HN crowd hates passwordless sign ins but most of us actually know how to keep our passwords secure, at least relative to the average user. Non-techies have

The HN crowd hates passwordless sign ins but most of us actually know how to keep our passwords secure, at least relative to the average user. Non-techies have their passwords leaked and identities stolen time and time again. And get frustrated when they keep forgetting their password. Biometric passwords are incredibly useful for these people. Of course Apple, Google, Microsoft have to keep non-biometric password authentication. Otherwise a lot of people (including me) will have to simply stop using their products, not even because of privacy, just because I doubt a Linux computer without a camera or old iPhone model will work for them. Some argue that users without biometric authentication will be flagged suspicious and pressured to hand over biometric data. But honestly, I think so many people will stick to regular passwords, and more will be physically unable to use biometric passwords, so it won’t work. Overall I think having the option to use biometric authentication is a net positive. Companies want them to get user data, but non-technical people want them because (when done right) they’re a lot easier and more secure than passwords.

alaricus 5y ago
Your solution to insecure passwords is to hand the keys of the internet to a small number of companies? This is beyond ridiculous. Not only this creates single points of failure, it also entrenches the already existing monopolies out there. (not to mention forcing everyone to dox themselves by providing biometrics)
- H8crilA 5y ago
  Uhm, it's the public key, and yes pretty much anyone can have my public key. That's why it's called the "public" key. The private key never leaves the dongle, much like in a hardware cryptocurrency wallet. I really fail to understand the whole confusion about FIDO, the amount of misinformation in the threads here (like in the parent comment) is staggering. It is a fantastic invention for expanding privacy& security. Maybe a lot of people confuse it with "log-in with X"?
  - microtonal 5y ago
    Uhm, it's the public key, and yes pretty much anyone can have my public key. That's why it's called the "public" key. The private key never leaves the dongle, much like in a hardware cryptocurrency wallet. This is not true for passkey, which the linked article is about. If you set up passkey on a site on e.g. your Mac, the credentials will be synced through iCloud and you can also use your iPhone or iPad as an authenticator. This raises the questions of the grandparent comment: 1. What if a FAANG company nukes the account that you use for credential syncing? 2. What if a FAANG company has access to your private keys? In the case of Apple, I think (2) is covered. They use iCloud Keychain, which is already end-to-end encrypted. But I am not sure about other companies (Microsoft, Google), does the standard require end-to-end encryption of key material?
    - microtonal 5y ago
      Seems like they will leave up security to the OS vendors? From the white paper: We expect that FIDO authenticator vendors (in particular those of authenticators built into OS platforms) will adapt their authenticator implementations such that a FIDO credential can survive device loss. [...] Just like password managers do with passwords, the underlying OS platform will “sync” the cryptographic keys that belong to a FIDO credential from device to device. This means that the security and availability of a user’s synced credential depends on the security of the underlying OS platform’s (Google’s, Apple’s, Microsoft’s, etc.) authentication mechanism for their online accounts, and on the security method for reinstating access when all (old) devices were lost. https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho...
      - simondotau 5y ago
        > Seems like they will leave up security to the OS vendors? Is it possible to be otherwise?
  - alaricus 5y ago
    Tying logins to biometrics is a terrible idea. Forcing all online logins to comply with the wishes of 3 tech giants is even a worse one. This has nothing to do with privacy. It's about existing monopolies entrenching their monopolies and keeping competition out.
mrtksn 5y ago
Passwords are extremely counterintuitive and require understanding of the architecture of the systems to make any sense of it. Why do you need a password to your phone and then why do you need a password for the apps and websites? Why do you need an SMS and why do you need a code generator? Why do you sign in into your Google account to sign in into Stackexchange? None of that makes unless you understand the distinctions between systems and all that happens when we race to make the experience seamless as if there's no distinctions. It's getting so messy that phishing becomes hard to detect even for the more experienced people, you simply follow the instructions of typing codes and clicking links. It only makes sense to have a device that can identify you personally and then use that device to get identified to other systems. That's actually why anonymous accounts and fingerprinting are very effective in tracking people(remember that companies like FB can identify you without you ever creating an account with them). Passwords only use is account sharing IMHO. Once everyone goes passwords-less, sharing a Netflix account will be a thing of the past for example. Maybe this is one of the motivations of the big tech but overall I think it's for the greater good and sharing a service will be served better through explicit means of sharing the service.
- mschuster91 5y ago
  > It only makes sense to have a device that can identify you personally and then use that device to get identified to other systems. What to do then if the device gets lost, damaged, soft-bricked, or worst case seized by the police?
  - mrtksn 5y ago
    You get a replacement if lost or broken. Then re-authenticate and restore from a backup. That's how it's done with iPhones. And about the police, you destroy or lock your device. If that's not %100 secure, it's OK because that's part of the risks about going against the authority. Can you imagine revolutionaries not revolting because the police might hit back? The risk of being caught by the police is part of the outlaw experience and you will need to actively try to avoid it.
    - 5y ago
anilakar 5y ago
> most of us actually know how to keep our passwords secure, at least relative to the average user. I'm an IT professional and despite using a password manager, I still prefer a physical security solution to a cybersecurity one. An attacker might be able to dump unencrypted secrets from my password manager, but they'll have to pry that U2F token out of my cold dead hands. The password field in its current inlined form has to go in one way or another.
- V1ndaar 5y ago
  > but they'll have to pry that U2F token out of my cold dead hands. That is a trade off between attack surface and difficulty of the "hack" though. Depending on who and where you are, getting your physical token by force is trivial. If your token is important enough, there will be plenty of people that won't shy from using violence.
  - folago 5y ago
    https://xkcd.com/538/ https://xkcd.com/538/
  - anilakar 5y ago
    Getting a password or a PIN code to a smart card by force is trivial, too. Even if one's physical wellbeing is protected by law, they can still be jailed[1] for failing to provide a password, even if no such password exists. The previous guy who educated me about rubber hose threat modeling later turned out to be running a drug dealing operation[2]. [1] https://www.saunders.co.uk/news/prosecuted-for-your-password/ https://www.saunders.co.uk/news/prosecuted-for-your-password... [2] https://www.newsbtc.com/all/douppikauppa-darknet-drug-lord-arrested-in-finland/ https://www.newsbtc.com/all/douppikauppa-darknet-drug-lord-a...
_trampeltier 5y ago
I use for some websites a Yubikey. But for me it feels very "blackbox like". I did read about a lot of functions on the internet, but I'm affraid to play with it, because I won't break anything. Also in the end, there is allways a second password for emergency. So if your password list leaks, the emergency password leaks with it for most people I guess.
philistine 5y ago
> Some argue that users without biometric authentication will be flagged suspicious and pressured to hand over biometric data The distinction is about the usage of modern technologies, not handing over biometric data. There will come a time where you will need to use a device with a Secure Enclave or a TPM. That device will keep biometric data on device. You will not hand in the data, you will have to use the feature.
everdrive 5y ago
>Non-techies have their passwords leaked and identities stolen time and time again. And get frustrated when they keep forgetting their password. Biometric passwords are incredibly useful for these people. In other words, broad technology adoption will always dilute and degrade the quality of different technology solutions.
zozbot234 5y ago
People will get even more frustrated when their flimsy physical authenticators break down. Passwordless authentication is perfectly okay for a service like a physical bank, employer etc. that can always check your identity and re-enroll you via some other means if need be. It's a disaster in the making for something like Google, Facebook, MS etc. etc. that offer no such thing. Make no mistake, the same people who pick weak passwords today will neglect proper care about any kind of disaster recovery scenario. The best you could do is use a "software-based" or "virtual" authenticator that explicitly refuses to protect against a user cloning and subsequently restoring its identity, at least as a last resort. Not good enough for bank payments, ofc. but plenty usable for everything else.

alaricus 5y ago

Your solution to insecure passwords is to hand the keys of the internet to a small number of companies? This is beyond ridiculous. Not only this creates single points of failure, it also entrenches the already existing monopolies out there. (not to mention forcing everyone to dox themselves by providing biometrics)

H8crilA 5y ago
Uhm, it's the public key, and yes pretty much anyone can have my public key. That's why it's called the "public" key. The private key never leaves the dongle, much like in a hardware cryptocurrency wallet. I really fail to understand the whole confusion about FIDO, the amount of misinformation in the threads here (like in the parent comment) is staggering. It is a fantastic invention for expanding privacy& security. Maybe a lot of people confuse it with "log-in with X"?
- microtonal 5y ago
  Uhm, it's the public key, and yes pretty much anyone can have my public key. That's why it's called the "public" key. The private key never leaves the dongle, much like in a hardware cryptocurrency wallet. This is not true for passkey, which the linked article is about. If you set up passkey on a site on e.g. your Mac, the credentials will be synced through iCloud and you can also use your iPhone or iPad as an authenticator. This raises the questions of the grandparent comment: 1. What if a FAANG company nukes the account that you use for credential syncing? 2. What if a FAANG company has access to your private keys? In the case of Apple, I think (2) is covered. They use iCloud Keychain, which is already end-to-end encrypted. But I am not sure about other companies (Microsoft, Google), does the standard require end-to-end encryption of key material?
  - microtonal 5y ago
    Seems like they will leave up security to the OS vendors? From the white paper: We expect that FIDO authenticator vendors (in particular those of authenticators built into OS platforms) will adapt their authenticator implementations such that a FIDO credential can survive device loss. [...] Just like password managers do with passwords, the underlying OS platform will “sync” the cryptographic keys that belong to a FIDO credential from device to device. This means that the security and availability of a user’s synced credential depends on the security of the underlying OS platform’s (Google’s, Apple’s, Microsoft’s, etc.) authentication mechanism for their online accounts, and on the security method for reinstating access when all (old) devices were lost. https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho...
    - simondotau 5y ago
      > Seems like they will leave up security to the OS vendors? Is it possible to be otherwise?
- alaricus 5y ago
  Tying logins to biometrics is a terrible idea. Forcing all online logins to comply with the wishes of 3 tech giants is even a worse one. This has nothing to do with privacy. It's about existing monopolies entrenching their monopolies and keeping competition out.

mrtksn 5y ago

Passwords are extremely counterintuitive and require understanding of the architecture of the systems to make any sense of it. Why do you need a password to your phone and then why do you need a password for the apps and websites? Why do you need an SMS and why do you need a code generator? Why do you sign in into your Google account to sign in into Stackexchange? None of that makes unless you understand the distinctions between systems and all that happens when we race to make the experience seamless as if there's no distinctions. It's getting so messy that phishing becomes hard to detect even for the more experienced people, you simply follow the instructions of typing codes and clicking links. It only makes sense to have a device that can identify you personally and then use that device to get identified to other systems. That's actually why anonymous accounts and fingerprinting are very effective in tracking people(remember that companies like FB can identify you without you ever creating an account with them). Passwords only use is account sharing IMHO. Once everyone goes passwords-less, sharing a Netflix account will be a thing of the past for example. Maybe this is one of the motivations of the big tech but overall I think it's for the greater good and sharing a service will be served better through explicit means of sharing the service.

mschuster91 5y ago
> It only makes sense to have a device that can identify you personally and then use that device to get identified to other systems. What to do then if the device gets lost, damaged, soft-bricked, or worst case seized by the police?
- mrtksn 5y ago
  You get a replacement if lost or broken. Then re-authenticate and restore from a backup. That's how it's done with iPhones. And about the police, you destroy or lock your device. If that's not %100 secure, it's OK because that's part of the risks about going against the authority. Can you imagine revolutionaries not revolting because the police might hit back? The risk of being caught by the police is part of the outlaw experience and you will need to actively try to avoid it.
  - 5y ago

anilakar 5y ago

> most of us actually know how to keep our passwords secure, at least relative to the average user. I'm an IT professional and despite using a password manager, I still prefer a physical security solution to a cybersecurity one. An attacker might be able to dump unencrypted secrets from my password manager, but they'll have to pry that U2F token out of my cold dead hands. The password field in its current inlined form has to go in one way or another.

V1ndaar 5y ago
> but they'll have to pry that U2F token out of my cold dead hands. That is a trade off between attack surface and difficulty of the "hack" though. Depending on who and where you are, getting your physical token by force is trivial. If your token is important enough, there will be plenty of people that won't shy from using violence.
- folago 5y ago
  https://xkcd.com/538/ https://xkcd.com/538/
- anilakar 5y ago
  Getting a password or a PIN code to a smart card by force is trivial, too. Even if one's physical wellbeing is protected by law, they can still be jailed[1] for failing to provide a password, even if no such password exists. The previous guy who educated me about rubber hose threat modeling later turned out to be running a drug dealing operation[2]. [1] https://www.saunders.co.uk/news/prosecuted-for-your-password/ https://www.saunders.co.uk/news/prosecuted-for-your-password... [2] https://www.newsbtc.com/all/douppikauppa-darknet-drug-lord-arrested-in-finland/ https://www.newsbtc.com/all/douppikauppa-darknet-drug-lord-a...

_trampeltier 5y ago

I use for some websites a Yubikey. But for me it feels very "blackbox like". I did read about a lot of functions on the internet, but I'm affraid to play with it, because I won't break anything. Also in the end, there is allways a second password for emergency. So if your password list leaks, the emergency password leaks with it for most people I guess.

philistine 5y ago

> Some argue that users without biometric authentication will be flagged suspicious and pressured to hand over biometric data The distinction is about the usage of modern technologies, not handing over biometric data. There will come a time where you will need to use a device with a Secure Enclave or a TPM. That device will keep biometric data on device. You will not hand in the data, you will have to use the feature.

everdrive 5y ago

>Non-techies have their passwords leaked and identities stolen time and time again. And get frustrated when they keep forgetting their password. Biometric passwords are incredibly useful for these people. In other words, broad technology adoption will always dilute and degrade the quality of different technology solutions.

zozbot234 5y ago

People will get even more frustrated when their flimsy physical authenticators break down. Passwordless authentication is perfectly okay for a service like a physical bank, employer etc. that can always check your identity and re-enroll you via some other means if need be. It's a disaster in the making for something like Google, Facebook, MS etc. etc. that offer no such thing. Make no mistake, the same people who pick weak passwords today will neglect proper care about any kind of disaster recovery scenario. The best you could do is use a "software-based" or "virtual" authenticator that explicitly refuses to protect against a user cloning and subsequently restoring its identity, at least as a last resort. Not good enough for bank payments, ofc. but plenty usable for everything else.