3 ms·

Passwords are extremely counterintuitive and require understanding of the architecture of the systems to make any sense of it. Why do you need a password to you

by mrtksn 5y ago

Passwords are extremely counterintuitive and require understanding of the architecture of the systems to make any sense of it. Why do you need a password to your phone and then why do you need a password for the apps and websites? Why do you need an SMS and why do you need a code generator? Why do you sign in into your Google account to sign in into Stackexchange? None of that makes unless you understand the distinctions between systems and all that happens when we race to make the experience seamless as if there's no distinctions. It's getting so messy that phishing becomes hard to detect even for the more experienced people, you simply follow the instructions of typing codes and clicking links. It only makes sense to have a device that can identify you personally and then use that device to get identified to other systems. That's actually why anonymous accounts and fingerprinting are very effective in tracking people(remember that companies like FB can identify you without you ever creating an account with them). Passwords only use is account sharing IMHO. Once everyone goes passwords-less, sharing a Netflix account will be a thing of the past for example. Maybe this is one of the motivations of the big tech but overall I think it's for the greater good and sharing a service will be served better through explicit means of sharing the service.

mschuster91 5y ago
> It only makes sense to have a device that can identify you personally and then use that device to get identified to other systems. What to do then if the device gets lost, damaged, soft-bricked, or worst case seized by the police?
- mrtksn 5y ago
  You get a replacement if lost or broken. Then re-authenticate and restore from a backup. That's how it's done with iPhones. And about the police, you destroy or lock your device. If that's not %100 secure, it's OK because that's part of the risks about going against the authority. Can you imagine revolutionaries not revolting because the police might hit back? The risk of being caught by the police is part of the outlaw experience and you will need to actively try to avoid it.
  - account-5 5y ago
    Who's providing the back up? How do you re-authenticate if you lost the thing you use to authenticate with? It's easy saying it but I don't understand how you do those things. If the answer is you need a password to access the backup and to access an account to re-authenticate, I'm not enjoying the irony. If the answer is to trust a company like Apple, Google, Microsoft with the literal keys to my kingdom then this thing misses the point. Currently I'm in control of my authentication, why would I hand that to some company and hope I don't annoy them enough to ban me, or just randomly cone up against their AI guardians.
    - mrtksn 5y ago
      On iPhone's case it's Apple and it is accessed by a password but in this hypothetical scenario it could be your own infrastructure or another device you own and that one can be password-less of that's your thing. Having one password to activate your authentication device is not a gin deal, it can be something like mnemonic seed etc. The hazard is not one password but endless ways to authenticate through endless passwords.
  - mschuster91 5y ago
    > If that's not %100 secure, it's OK because that's part of the risks about going against the authority. I was more talking about border control, which has been known especially in the US to believe that non-US citizens have no rights at all and even the rights of US citizens and permanent residents have limited rights. And for what it's worth you can end up having your devices seized or being executed by police simply for the "crime" of being at the wrong place at the wrong time because the cops managed to fuck up the warrant or its execution by blowing up the door at the wrong address. Police going rogue are a threat model everyone should be aware of these days.
    - mrtksn 5y ago
      I guess the US has its problems. If that's an issue, don't go there and if you choose to go, don't bring a device with you that you can't tolerate being investigated by the authorities. It's unreasonable to say that all your problems in life must be solved by this one tech or it's not worth having it.
alaricus 5y ago
This sounds dystopian and also really bad engineering. First, I don't want a single login for everywhere. For obvious privacy reasons, using multiple disjoint accounts is preferable. Second, using a device to identify someone creates a single point of failure. That device will get stolen or will break at the most inconvenient time. The battery will run out. Or something else will happen. This is far from theoretical. My phone died on a business trip. It turned into a nightmare because almost everything needs two factor authentication. It's really bad not being able to spend money you have. That is when I learned the value of cash. The obsession with passwordless logins and 2FA is anti-consumer. It needs to stop.
- mrtksn 5y ago
  > For obvious privacy reasons, using multiple disjoint accounts is preferable. Actually, the reasons are not as obvious as one might think and not as preferable as assumed. Disjoint anonymous accounts are one of the core reason for all the problems we have on the internet(there are much more spammers and manipulators than there are whistleblowers). I'm sure you are exposing corruption all the time or you are doing gay stuff in Iran but the majority of the anonymous activity is spamming, trolling or political manipulation. If you say why you need anonymous account we might work out a solution for you.
  - alaricus 5y ago
    Is this serious or a bad attempt at sarcasm?
    - mrtksn 5y ago
      I don't know why you think I'm not serious because trolls spam and political manipulation is a thing on the internet these days, Google it! Care to answer and further explain your arguments?
      - alaricus 5y ago
        It's really serious? Wow! Not even Microsoft TPMs write such nonsense. Forcing people to have a single ID across the web is a terrible idea. Having multiple disjoint accounts makes it much more difficult to track your activity online. It's not worth killing privacy just to stop a couple of annoying spammers. Of course Google/Facebook/Microsoft love the idea because it makes tracking user behaviour much more easier.

by mrtksn 5y ago

mschuster91 5y ago

> It only makes sense to have a device that can identify you personally and then use that device to get identified to other systems. What to do then if the device gets lost, damaged, soft-bricked, or worst case seized by the police?

mrtksn 5y ago
You get a replacement if lost or broken. Then re-authenticate and restore from a backup. That's how it's done with iPhones. And about the police, you destroy or lock your device. If that's not %100 secure, it's OK because that's part of the risks about going against the authority. Can you imagine revolutionaries not revolting because the police might hit back? The risk of being caught by the police is part of the outlaw experience and you will need to actively try to avoid it.
- account-5 5y ago
  Who's providing the back up? How do you re-authenticate if you lost the thing you use to authenticate with? It's easy saying it but I don't understand how you do those things. If the answer is you need a password to access the backup and to access an account to re-authenticate, I'm not enjoying the irony. If the answer is to trust a company like Apple, Google, Microsoft with the literal keys to my kingdom then this thing misses the point. Currently I'm in control of my authentication, why would I hand that to some company and hope I don't annoy them enough to ban me, or just randomly cone up against their AI guardians.
  - mrtksn 5y ago
    On iPhone's case it's Apple and it is accessed by a password but in this hypothetical scenario it could be your own infrastructure or another device you own and that one can be password-less of that's your thing. Having one password to activate your authentication device is not a gin deal, it can be something like mnemonic seed etc. The hazard is not one password but endless ways to authenticate through endless passwords.
- mschuster91 5y ago
  > If that's not %100 secure, it's OK because that's part of the risks about going against the authority. I was more talking about border control, which has been known especially in the US to believe that non-US citizens have no rights at all and even the rights of US citizens and permanent residents have limited rights. And for what it's worth you can end up having your devices seized or being executed by police simply for the "crime" of being at the wrong place at the wrong time because the cops managed to fuck up the warrant or its execution by blowing up the door at the wrong address. Police going rogue are a threat model everyone should be aware of these days.
  - mrtksn 5y ago
    I guess the US has its problems. If that's an issue, don't go there and if you choose to go, don't bring a device with you that you can't tolerate being investigated by the authorities. It's unreasonable to say that all your problems in life must be solved by this one tech or it's not worth having it.

alaricus 5y ago

This sounds dystopian and also really bad engineering. First, I don't want a single login for everywhere. For obvious privacy reasons, using multiple disjoint accounts is preferable. Second, using a device to identify someone creates a single point of failure. That device will get stolen or will break at the most inconvenient time. The battery will run out. Or something else will happen. This is far from theoretical. My phone died on a business trip. It turned into a nightmare because almost everything needs two factor authentication. It's really bad not being able to spend money you have. That is when I learned the value of cash. The obsession with passwordless logins and 2FA is anti-consumer. It needs to stop.

mrtksn 5y ago
> For obvious privacy reasons, using multiple disjoint accounts is preferable. Actually, the reasons are not as obvious as one might think and not as preferable as assumed. Disjoint anonymous accounts are one of the core reason for all the problems we have on the internet(there are much more spammers and manipulators than there are whistleblowers). I'm sure you are exposing corruption all the time or you are doing gay stuff in Iran but the majority of the anonymous activity is spamming, trolling or political manipulation. If you say why you need anonymous account we might work out a solution for you.
- alaricus 5y ago
  Is this serious or a bad attempt at sarcasm?
  - mrtksn 5y ago
    I don't know why you think I'm not serious because trolls spam and political manipulation is a thing on the internet these days, Google it! Care to answer and further explain your arguments?
    - alaricus 5y ago
      It's really serious? Wow! Not even Microsoft TPMs write such nonsense. Forcing people to have a single ID across the web is a terrible idea. Having multiple disjoint accounts makes it much more difficult to track your activity online. It's not worth killing privacy just to stop a couple of annoying spammers. Of course Google/Facebook/Microsoft love the idea because it makes tracking user behaviour much more easier.