7 ms·
It is well past time to stop using passwords. We should be using TLS client certs (as in mutual TLS aka mTLS) or WebAuthn passkeys already. I prefer certs becau
by pabs3 4y ago
It is well past time to stop using passwords. We should be using TLS client certs (as in mutual TLS aka mTLS) or WebAuthn passkeys already. I prefer certs because they don't require support in the web application, but they have a terrible UI and browsers seem to be making that worse, so WebAuthn it is, I just wish WebAuthn would have a standardised HTTP header or TLS extension so it would be usable without JavaScript, currently every website has to implement their own login protocol in JavaScript.
https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/ https://www.cloudflare.com/learning/access-management/what-i...
https://github.com/w3c/webauthn/issues/1255 https://github.com/w3c/webauthn/issues/1255
https://github.com/w3c/webauthn/issues/1616 https://github.com/w3c/webauthn/issues/1616
- deleted 4y ago[deleted]
- teddyh 4y agoWe should stop manually entered passwords. Using a password manager (like the one built into your web browser) with unique secure passwords is fine.
- Wowfunhappy 4y agoHow do you authenticate the password manager?
- SketchySeaBeast 4y agoWith Keepass you can use a yubikey or key file.
- teddyh 4y agoThe context was to stop entering passwords into web sites. The password manager is run locally.
- layer8 4y agoPasswords for websites are (hopefully) hashed locally. And more importantly, how does it make a difference whether you or the password manager types in the password into the web form?
- Wowfunhappy 4y ago> And how does it make a difference whether you or the password manager types in the password into the web form? Well, because a hidden camera can observe a human typing their password, whereas a password manager does not need to press any physical keys. However, a camera can observe a human typing a master password into their password manager, which is where I was originally going with the question.
- layer8 4y agoI meant regarding local vs. nonlocal, what the GP objected to.
- wongarsu 4y agoThat's probably better. But moving entirely from "things I know" to "things I own" comes with its own set of security disasters waiting to happen. We are better off using those to augment the password than to replace it.
- bheadmaster 4y agoI don't think "things I own" is a bad security model in itself. The ideal of authentication (to me) seems to be some kind of USB dongle with your private key baked in the hardware, that you can use to create digital signatures proving your identity. Short of stealing the dongle, there is no way anyone can steal your identity.
- alistairSH 4y agoUsing your dongle example, how do you access important services away from home? Carry the dongle everywhere? If so, you risk losing the dongle. Same with your phone as the "thing I own". That's great, until the phone dies/breaks/gets lost. Hopefully you have a tablet as backup, or the paper copy of your one-time codes in your wallet. I don't have a good answer. I just hate the idea of needing to access banking services when traveling should my phone become unavailable.
- bheadmaster 4y ago> Carry the dongle everywhere? If so, you risk losing the dongle. To be fair, we also carry our IDs everywhere and risk losing them all the time, yet it works pretty fine in most cases. Losing your ID is painful, and so would be losing the dongle, but the security of it outweighs the risk, IMHO. Even more if we create dongles that are shaped like cards, so we can keep them in our wallets like IDs.
- AstralStorm 4y agoNormally you do not use the ID in day to day operations. A better example would be a credit card, which combines a password (or pin) with a cryptographic chip. The card itself is too easy to steal, hence the backup password. The other possibility is biometrics, but these come with their own problems.