6 ms·

Encouraging worse security practices (dumping SSO for password logins) for an ideological goal that helps no one's privacy.

elric 4y ago
* There is nothing wrong with password logins if they are used properly. * Google does not have a good track record of customer service, not putting all your eggs in their unreliable basket seems like a good idea from a security point of view. * The privacy argument is a bit of a hot take in this case, and is probably not as valid as a reason to dump Google SSO as eggs-in-unreliable-basket argument.
toomuchtodo 4y ago
Passkeys becoming prevalent makes dropping BigTech SSO for personal use more palatable. Google will still store and sync the keys for users of Android and Chrome, but their code won’t run on sites who opt out of Login with Google. It’s an evolution of the security model. This is arguably superior considering the ability to migrate passkeys elsewhere. You have improved sovereignty over your auth story (versus “haha google locked you out of everything and you have no recourse”). TLDR PKI > consumer federated identity
- jefftk 4y ago
  I use a hardware security token to log into my Google account and then use that to log in to several other services. If I were to lose my token, I would still have my backup tokens, and could update this account to use a new token and unenroll the old token. If instead, every site I had ever logged into kept track of my tokens I would need to visit each of them and do the same thing. (It's already messier than that because some accounts I have--GitHub and Facebook--don't accept SSO but are important enough to be worth protecting with hardware tokens. But I don't want to go farther in this direction!)
  - toomuchtodo 4y ago
    We’re not talking a loss of a hardware authenticator, we’re talking the loss of access to your Google account. Worst case with passkeys is you lose access to the cloud corpus of your keys due to loss of account access while still having them on your device (and/or a passkey manager).
    - jefftk 4y ago
      I think I'm much much more likely to lose a hardware authenticator than my Google account
      - sundarurfriend 4y ago
        And that's not necessarily universally true. * Securing hardware authenticators is much more within our control than the whims of Google are. * Most of us aren't ex-Googlers with contacts and reach (which are the only way to get reliable support when one's account does get borked), so that side of the risk is also much higher for normal people than for you.
      - toomuchtodo 4y ago
        https://news.ycombinator.com/item?id=33963269 https://news.ycombinator.com/item?id=33963269
        jefftk 4y ago
        What I'm advocating for above is that people get multiple hardware tokens, and keep them in separate safe places. What Doreen is running into is that if you use your phone as your only second factor you have a problem if your phone stops working. I don't see how these are in tension?
        toomuchtodo 4y ago
        I think our expectations are simply out of alignment. What you're advocating for is unreasonable if a loss of hardware tokens means a permanent loss of account access with no recourse, and I don't think that's a hard case to make to legislators and regulators.
- cmdli 4y ago
  For passkeys, I think allowing users to migrate their credentials wherever they want is key. I know Google/Apple/etc are working on a potential solution for that, but I think third-party solutions would be best from an "incentive alignment" perspective (Google and Apple don't want you moving away from their ecosystem). As an aside, I would like to plug my own passkey solution, Bulwark Passkey (https://bulwark.id https://bulwark.id) which is open source and allows credential exports. Whatever passkey solutions people end up using, managing credentials is going to be the key challenge (pun intended).
throwntoday 4y ago
The pervasiveness of any Google code running on webpages across the net has been a danger to everyone's privacy. I think this is a worthwhile tradeoff though I'm sure many like you will disagree.
- ilyt 4y ago
  I don't see why the page would be the one deciding that tradeoff for user. As long as you can pick plain old user/password there is no ham offering other options
simplotek 4y ago
> Encouraging worse security practices (dumping SSO for password logins) for an ideological goal that helps no one's privacy. It hardly seems reasonable or rational to attack the mere thought of handing out all auth responsibilities to a shady monopoly with a track record of dubious practices and government tie-ins for being "an ideological goal that helps no one's privacy".
deleted 4y ago
[deleted]
LightHugger 4y ago
password logins are better security than phone verification in many cases.
- IncRnd 4y ago
  Password logins are 1-factor, while password logins that use phone verification are 2-factor. In what cases does the security from 1-factor exceed the security from 2-factors?
  - eimrine 4y ago
    > In what cases does the security from 1-factor exceed the security from 2-factors? 1. If you consider the loss of a phone number to be a more likely event than a forgotten password (non-obvious example - if you have no extra money to keep the phone number working). 2. If some powerful contractors can capture the data coming to your phone. 3. Also, if there is some kind of banhammer (Google is famous for banning for no reason) in the "2-factor" and no banhammer in the 1-factor (Bitcoin has no third-parties who might steal or freeze your funds), then your chance of encountering a banhammer in your face is infinitely greater in the first case. More than 1 factor creates more problems than usefullness tbh if you are enough responsible for never lose your credentials.
    - IncRnd 4y ago
      > 1. If you consider the loss of a phone number to be a more likely event than a forgotten password (non-obvious example - if you have no extra money to keep the phone number working). That's silly. If you lost your phone number, why would you attempt to log into a service and have it text or call your lost phone number? The provider in question here (along with many others), Google, provides backup codes for this situation. Besides, if you are more likely to constantly lose phone numbers, it's best not to use those for authentication/authorization. > 2. If some powerful contractors can capture the data coming to your phone. That doesn't matter to 2-factor. That "powerful contractor" would be in possession of a time-bound pin that can only be used by the device and account that had just had the credentials entered. It is useless to anyone else. > 3. Also, if there is some kind of banhammer (Google is famous for banning for no reason) in the "2-factor" and no banhammer in the 1-factor (Bitcoin has no third-parties who might steal or freeze your funds), then your chance of encountering a banhammer in your face is infinitely greater in the first case. This also doesn't apply. Google provides backup codes that can be used in such a case. As do digital ocean and others... > More than 1 factor creates more problems than usefullness tbh if you are enough responsible for never lose your credentials. Except that isn't true. I noticed that you placed 2-factor in quotes, showing that you likely do not understand 2-factor is formed from any two out of the three possible security factors. There is also 1.5 factor authentication, which is acceptable to put in quotes, since it is pseudo-2factor. What you know. What you have. What you are. > (Bitcoin has no third-parties who might steal or freeze your funds) I'm not sure your comment was serious... Bitcoin and the entire crypto ecosystem are full of third-parties who steal or freeze funds.

elric 4y ago

* There is nothing wrong with password logins if they are used properly. * Google does not have a good track record of customer service, not putting all your eggs in their unreliable basket seems like a good idea from a security point of view. * The privacy argument is a bit of a hot take in this case, and is probably not as valid as a reason to dump Google SSO as eggs-in-unreliable-basket argument.

toomuchtodo 4y ago

Passkeys becoming prevalent makes dropping BigTech SSO for personal use more palatable. Google will still store and sync the keys for users of Android and Chrome, but their code won’t run on sites who opt out of Login with Google. It’s an evolution of the security model. This is arguably superior considering the ability to migrate passkeys elsewhere. You have improved sovereignty over your auth story (versus “haha google locked you out of everything and you have no recourse”). TLDR PKI > consumer federated identity

jefftk 4y ago
I use a hardware security token to log into my Google account and then use that to log in to several other services. If I were to lose my token, I would still have my backup tokens, and could update this account to use a new token and unenroll the old token. If instead, every site I had ever logged into kept track of my tokens I would need to visit each of them and do the same thing. (It's already messier than that because some accounts I have--GitHub and Facebook--don't accept SSO but are important enough to be worth protecting with hardware tokens. But I don't want to go farther in this direction!)
- toomuchtodo 4y ago
  We’re not talking a loss of a hardware authenticator, we’re talking the loss of access to your Google account. Worst case with passkeys is you lose access to the cloud corpus of your keys due to loss of account access while still having them on your device (and/or a passkey manager).
  - jefftk 4y ago
    I think I'm much much more likely to lose a hardware authenticator than my Google account
    - sundarurfriend 4y ago
      And that's not necessarily universally true. * Securing hardware authenticators is much more within our control than the whims of Google are. * Most of us aren't ex-Googlers with contacts and reach (which are the only way to get reliable support when one's account does get borked), so that side of the risk is also much higher for normal people than for you.
    - toomuchtodo 4y ago
      https://news.ycombinator.com/item?id=33963269 https://news.ycombinator.com/item?id=33963269
      - jefftk 4y ago
        What I'm advocating for above is that people get multiple hardware tokens, and keep them in separate safe places. What Doreen is running into is that if you use your phone as your only second factor you have a problem if your phone stops working. I don't see how these are in tension?
        toomuchtodo 4y ago
        I think our expectations are simply out of alignment. What you're advocating for is unreasonable if a loss of hardware tokens means a permanent loss of account access with no recourse, and I don't think that's a hard case to make to legislators and regulators.
cmdli 4y ago
For passkeys, I think allowing users to migrate their credentials wherever they want is key. I know Google/Apple/etc are working on a potential solution for that, but I think third-party solutions would be best from an "incentive alignment" perspective (Google and Apple don't want you moving away from their ecosystem). As an aside, I would like to plug my own passkey solution, Bulwark Passkey (https://bulwark.id https://bulwark.id) which is open source and allows credential exports. Whatever passkey solutions people end up using, managing credentials is going to be the key challenge (pun intended).

throwntoday 4y ago

The pervasiveness of any Google code running on webpages across the net has been a danger to everyone's privacy. I think this is a worthwhile tradeoff though I'm sure many like you will disagree.

ilyt 4y ago
I don't see why the page would be the one deciding that tradeoff for user. As long as you can pick plain old user/password there is no ham offering other options

simplotek 4y ago

> Encouraging worse security practices (dumping SSO for password logins) for an ideological goal that helps no one's privacy. It hardly seems reasonable or rational to attack the mere thought of handing out all auth responsibilities to a shady monopoly with a track record of dubious practices and government tie-ins for being "an ideological goal that helps no one's privacy".

deleted 4y ago

[deleted]

LightHugger 4y ago

password logins are better security than phone verification in many cases.

IncRnd 4y ago
Password logins are 1-factor, while password logins that use phone verification are 2-factor. In what cases does the security from 1-factor exceed the security from 2-factors?
- eimrine 4y ago
  > In what cases does the security from 1-factor exceed the security from 2-factors? 1. If you consider the loss of a phone number to be a more likely event than a forgotten password (non-obvious example - if you have no extra money to keep the phone number working). 2. If some powerful contractors can capture the data coming to your phone. 3. Also, if there is some kind of banhammer (Google is famous for banning for no reason) in the "2-factor" and no banhammer in the 1-factor (Bitcoin has no third-parties who might steal or freeze your funds), then your chance of encountering a banhammer in your face is infinitely greater in the first case. More than 1 factor creates more problems than usefullness tbh if you are enough responsible for never lose your credentials.
  - IncRnd 4y ago
    > 1. If you consider the loss of a phone number to be a more likely event than a forgotten password (non-obvious example - if you have no extra money to keep the phone number working). That's silly. If you lost your phone number, why would you attempt to log into a service and have it text or call your lost phone number? The provider in question here (along with many others), Google, provides backup codes for this situation. Besides, if you are more likely to constantly lose phone numbers, it's best not to use those for authentication/authorization. > 2. If some powerful contractors can capture the data coming to your phone. That doesn't matter to 2-factor. That "powerful contractor" would be in possession of a time-bound pin that can only be used by the device and account that had just had the credentials entered. It is useless to anyone else. > 3. Also, if there is some kind of banhammer (Google is famous for banning for no reason) in the "2-factor" and no banhammer in the 1-factor (Bitcoin has no third-parties who might steal or freeze your funds), then your chance of encountering a banhammer in your face is infinitely greater in the first case. This also doesn't apply. Google provides backup codes that can be used in such a case. As do digital ocean and others... > More than 1 factor creates more problems than usefullness tbh if you are enough responsible for never lose your credentials. Except that isn't true. I noticed that you placed 2-factor in quotes, showing that you likely do not understand 2-factor is formed from any two out of the three possible security factors. There is also 1.5 factor authentication, which is acceptable to put in quotes, since it is pseudo-2factor. What you know. What you have. What you are. > (Bitcoin has no third-parties who might steal or freeze your funds) I'm not sure your comment was serious... Bitcoin and the entire crypto ecosystem are full of third-parties who steal or freeze funds.