5 ms·

This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be

This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be less secure overall. Because people simply wouldn't use the annoying password manager. Using a password manager without a master password is way more secure than not using a password manager at all. If you are a business and you want your employees to be secure, forget about anything to do with passwords. You need hardware second factor tokens. Which I notice the article doesn't mention at all. An article about login security in 2022 that doesn't even mention hardware tokens for two factor authentication is not worth anyone's time.

hn_throwaway_99 4y ago
> You need hardware second factor tokens. The recent targeted phishing attacks against Twilio and Cloudflare made this abundantly clear. Twilio didn't use hardware tokens and was hacked. Cloudflare reported they had 3 users who entered their username and password into the phishing site, but since all of their employees use hardware keys, they weren't hacked.
politelemon 4y ago
> You need hardware second factor tokens. Be careful what you wish for. It's happening but not in the way you're envisioning. A lot of logins now require a phone app. That's the hardware offloading, and reduces overhead of having to manage dedicated hardware. Instead, users manage it themselves and the business piggybacks off it.
- EGreg 4y ago
  That’s great! Why not let the USERS have a choice of how to manage their own identity?
- Double_a_92 4y ago
  What would the alternative even be? Having the users keep a buch of different RSA keys?
  - Symbiote 4y ago
    You can use a single key (e.g. YubiKey), or the security key in a[n Android?] phone.
tomxor 4y ago
> Using a password manager without a master password is way more secure than not using a password manager at all. I disagree, diceware AND hardware security keys, is stronger, no password manager needed at all. However I agree the article is overblown. For most people, browser based password managers are probably a vast improvement, since most will likely never educate themselves on such things or accept the solutions as personally viable. The browser is right there and even prompts them into using it.
- zokier 4y ago
  How does diceware reduce the need for password managers at all?
  - tomxor 4y ago
    Because they are significantly more memorable than pw made from individually random chars without significantly reducing their strength. I have a handful of diceware passwords for important accounts i need to remember, and find that pretty easy... the rest are throwaway level unimportant or I leave to email based login. However I dictate password and security policies where I work, and don't have to adhere to stupid "change your pw every week" rules - so i realise this is not a solution for everyone working under different (stupid) conditions. https://xkcd.com/936/ https://xkcd.com/936/
    - zokier 4y ago
      I have about 200ish passwords in my password manager. No matter how memorable any of those is individually, remembering 200 secure secrets is not practical. Nevermind the fact that many of those are used extremely rarely, good luck rembering diceware password that you use once in couple of years
      - tomxor 4y ago
        That's fair, but I'd ask yourself: of those 200 how many are important enough to warrant a strong password? and of those how many are important and frequently used enough to need to be independent of email based authentication? Perhaps you don't need to remember as many as you think.
avree 4y ago
That's because this is low-effort blog spam to advertise their security consulting business.
olliej 4y ago
Safari already gates password autofill on the secure element (or enclave, I can never remember the difference) when such is available, which is what you're suggesting :D That said you're absolutely correct, making autofill harder to use would mean people wouldn't use it, and would revert to predictable and reused passwords, and if you're a business you should be using token based authentication be they dongles or phone and PC's secure elements.
- denton-scratch 4y ago
  > you should be using token based authentication be they dongles or phone and PC's secure elements. Phone? Really? I regard my smartphone as the least-secure piece of computing equipment in my posession. I certainly don't trust it to secure anything. A phone isn't a token; it happens to be "something you own", so some sites treat a phone as if it were a security token. This is a problem I encounter mainly on UK government sites (sites that I more-or-less have to use). These sites don't offer support for alternative hardware "tokens", nor for people who don't own a smartphone.
  - olliej 4y ago
    I had assumed that at this point all android phones have got some equivalent to the secure element present in all apple products produced in the last 5+ years, if they don't that's bananas. Assuming that, a phone is likely one of the most secure devices that you own.
    - denton-scratch 4y ago
      Having a "secure element", enclave or whatever, doesn't mean that some rando TPA app is using it. I'm not qualified to inspect the source-code of Android apps. As far as I'm conceerned, these enclaves aren't for my protection; they're there to protect the interests of the device's owners (which isn't me). A smartphone OS runs under the supervision of another OS, which is proprietary - source-code not supplied. A lot of the hardware is also proprietary, each component having its own (opaque) firmware blob. The device has telephony and internet connectivity. The connectivity providers behave as if they own the device, install software without warning, and surreptitiously inject content. If I'm not competent to analyse the device myself (and I'm not), then I'm dependent on third-parties to confirm the device is secure. How many smartphone reviews have you read recently that focused on security, rather than how shiny the device is, how good the cameras are, or how good the screen is? I don't recall ever seeing a review that paid any attention to security. These are opaque devices, with a huge attack surface. It makes no sense to me to describe it as "one of the most secure devices that you own".

hn_throwaway_99 4y ago

> You need hardware second factor tokens. The recent targeted phishing attacks against Twilio and Cloudflare made this abundantly clear. Twilio didn't use hardware tokens and was hacked. Cloudflare reported they had 3 users who entered their username and password into the phishing site, but since all of their employees use hardware keys, they weren't hacked.

politelemon 4y ago

> You need hardware second factor tokens. Be careful what you wish for. It's happening but not in the way you're envisioning. A lot of logins now require a phone app. That's the hardware offloading, and reduces overhead of having to manage dedicated hardware. Instead, users manage it themselves and the business piggybacks off it.

EGreg 4y ago
That’s great! Why not let the USERS have a choice of how to manage their own identity?
Double_a_92 4y ago
What would the alternative even be? Having the users keep a buch of different RSA keys?
- Symbiote 4y ago
  You can use a single key (e.g. YubiKey), or the security key in a[n Android?] phone.

tomxor 4y ago

> Using a password manager without a master password is way more secure than not using a password manager at all. I disagree, diceware AND hardware security keys, is stronger, no password manager needed at all. However I agree the article is overblown. For most people, browser based password managers are probably a vast improvement, since most will likely never educate themselves on such things or accept the solutions as personally viable. The browser is right there and even prompts them into using it.

zokier 4y ago
How does diceware reduce the need for password managers at all?
- tomxor 4y ago
  Because they are significantly more memorable than pw made from individually random chars without significantly reducing their strength. I have a handful of diceware passwords for important accounts i need to remember, and find that pretty easy... the rest are throwaway level unimportant or I leave to email based login. However I dictate password and security policies where I work, and don't have to adhere to stupid "change your pw every week" rules - so i realise this is not a solution for everyone working under different (stupid) conditions. https://xkcd.com/936/ https://xkcd.com/936/
  - zokier 4y ago
    I have about 200ish passwords in my password manager. No matter how memorable any of those is individually, remembering 200 secure secrets is not practical. Nevermind the fact that many of those are used extremely rarely, good luck rembering diceware password that you use once in couple of years
    - tomxor 4y ago
      That's fair, but I'd ask yourself: of those 200 how many are important enough to warrant a strong password? and of those how many are important and frequently used enough to need to be independent of email based authentication? Perhaps you don't need to remember as many as you think.

avree 4y ago

That's because this is low-effort blog spam to advertise their security consulting business.

olliej 4y ago

Safari already gates password autofill on the secure element (or enclave, I can never remember the difference) when such is available, which is what you're suggesting :D That said you're absolutely correct, making autofill harder to use would mean people wouldn't use it, and would revert to predictable and reused passwords, and if you're a business you should be using token based authentication be they dongles or phone and PC's secure elements.

denton-scratch 4y ago
> you should be using token based authentication be they dongles or phone and PC's secure elements. Phone? Really? I regard my smartphone as the least-secure piece of computing equipment in my posession. I certainly don't trust it to secure anything. A phone isn't a token; it happens to be "something you own", so some sites treat a phone as if it were a security token. This is a problem I encounter mainly on UK government sites (sites that I more-or-less have to use). These sites don't offer support for alternative hardware "tokens", nor for people who don't own a smartphone.
- olliej 4y ago
  I had assumed that at this point all android phones have got some equivalent to the secure element present in all apple products produced in the last 5+ years, if they don't that's bananas. Assuming that, a phone is likely one of the most secure devices that you own.
  - denton-scratch 4y ago
    Having a "secure element", enclave or whatever, doesn't mean that some rando TPA app is using it. I'm not qualified to inspect the source-code of Android apps. As far as I'm conceerned, these enclaves aren't for my protection; they're there to protect the interests of the device's owners (which isn't me). A smartphone OS runs under the supervision of another OS, which is proprietary - source-code not supplied. A lot of the hardware is also proprietary, each component having its own (opaque) firmware blob. The device has telephony and internet connectivity. The connectivity providers behave as if they own the device, install software without warning, and surreptitiously inject content. If I'm not competent to analyse the device myself (and I'm not), then I'm dependent on third-parties to confirm the device is secure. How many smartphone reviews have you read recently that focused on security, rather than how shiny the device is, how good the cameras are, or how good the screen is? I don't recall ever seeing a review that paid any attention to security. These are opaque devices, with a huge attack surface. It makes no sense to me to describe it as "one of the most secure devices that you own".