4 ms·

The article is correct, most password policies are dumb. But it's arguing about one tree while standing in a forest. The real problem with passwords is not ind

The article is correct, most password policies are dumb. But it's arguing about one tree while standing in a forest. The real problem with passwords is not individual policies, but rather their shere volume. In my password manager I noticed I have got literally hundreds of the things. Clearly reusing a password on multiple systems is bad. Clearly memorizing more than a handful is impossible. Since I therefore am using a password manager anyway, I simply get it to generate long, random, strings. Which inevitably contain enough to satisfy most daft policies. There are some I still type. Basically the ones I use everyday, like machine login, but 99% are generated. I get the article, and for those everyday passwords I advocate the same - make it long, make it easy to type, don't change it. But if a Web-site wanted to be really secure, require a password manager. (how? I've no idea...)

toomuchtodo 4y ago
> But if a Web-site wanted to be really secure, require a password manager. (how? I've no idea...) https://passkeys.dev/ https://passkeys.dev/
nigerianbrince 4y ago
Our computers should have a specific port for a physical key which we would carry around in our keychain.
- taeric 4y ago
  And what do you do when your key is broken or lost? Because that will happen.
  - quickthrower2 4y ago
    Backups! Copy of key at friends house.
    - mr_mitm 4y ago
      So that the friend, or someone who steals from the friend can impersonate me? Proving your identity when you lost your proof of identity is still an unsolved problem if you ask me. At least in general, it seems that there is no one solution that works for everyone.
      - quickthrower2 4y ago
        Only if that key is the only factor.
      - upofadown 4y ago
        Put a PIN on it... You can remove the PIN later. The hardware key can be set up to wipe the device after, say, 10 incorrect guesses.
        taeric 4y ago
        If it can be wiped on incorrect pin usage, you can be maliciously locked out of accounts relatively easily.
        upofadown 4y ago
        Then you are going to know that the friend was messing with your hardware key. Better that than finding out they are willing to betray you by stealing from you.
    - taeric 4y ago
      If it is copiable, how would you know if it had been compromised? My understanding is that backup keys should not be identical for that reason. Let's you revoke and audit use. As such, having a backup has to be accessible so that you can register it places. There are tricks, but they only work in certain scenarios. Mostly not in the fido use cases.
- dwaite 4y ago
  Something like https://www.yubico.com/product/security-key-c-nfc-by-yubico/ https://www.yubico.com/product/security-key-c-nfc-by-yubico/ ?
AnIdiotOnTheNet 4y ago
Honestly I'm surprised we're still using user names and passwords for authentication and identification in 2022. We have come up with many better ways to do this, and just completely failed to adopt any of them as the new normal. The closest we get is when we can use Google or Facebook to log into Joe Blow's Bullshit site instead of a bespoke account.
- taeric 4y ago
  I'm afraid to ask what you think are the better ways? My assertion is that most risk of online fraud is a social, not a technical problem. As such, it will require law to make safe.
  - noahtallen 4y ago
    Passkeys, which are getting closer and closer to prime time. If you think about it, key-based auth is already highly recommended and utilized in many scenarios (like SSH, signing data, certificates, token authentication for use between servers, etc.)… this just makes that accessible to users. The vast majority of people don’t even use a password manager, and use variations of the same password everywhere. That’s really unsafe. Passkeys are always unique. Another thing is phishing. The big issue with phishing is how easy it is to make a website or popup look identical to a different service. And if it’s believable enough and the domain is hidden, you’ll put in your real password. Passkeys fix that because they only work on the site in question. No danger of leaking it to someone else! So this will make some huge improvements in security. Basically taking care of the very basic things most people don’t do. Password managers solve many of the same problems, but are potentially less convenient in some scenarios. (Obtuse password requirements, password field not working with paste, etc. it’s just a 3rd party workaround.) But like you said, the social aspect is still a huge problem.
    - josephcsible 4y ago
      > if [...] the domain is hidden When is that?
    - 4y ago
alanfranz 4y ago
Author here. As you can see in the closing lines: > I really hope that passwordless login will make some steps forward in the next years But, in the meantime I wouldn't despise passwords THAT much, if the policies were not stupid. Using any kind of SSO (e.g. login via Google or MS or Apple) puts multiple accounts under the umbrella of some internet giants; if at any time they revoke your account, you risk losing access to multiple other unrelated sites (not to mention the fact they'll know even more usage patterns).

toomuchtodo 4y ago

> But if a Web-site wanted to be really secure, require a password manager. (how? I've no idea...) https://passkeys.dev/ https://passkeys.dev/

nigerianbrince 4y ago

Our computers should have a specific port for a physical key which we would carry around in our keychain.

taeric 4y ago
And what do you do when your key is broken or lost? Because that will happen.
- quickthrower2 4y ago
  Backups! Copy of key at friends house.
  - mr_mitm 4y ago
    So that the friend, or someone who steals from the friend can impersonate me? Proving your identity when you lost your proof of identity is still an unsolved problem if you ask me. At least in general, it seems that there is no one solution that works for everyone.
    - quickthrower2 4y ago
      Only if that key is the only factor.
    - upofadown 4y ago
      Put a PIN on it... You can remove the PIN later. The hardware key can be set up to wipe the device after, say, 10 incorrect guesses.
      - taeric 4y ago
        If it can be wiped on incorrect pin usage, you can be maliciously locked out of accounts relatively easily.
        upofadown 4y ago
        Then you are going to know that the friend was messing with your hardware key. Better that than finding out they are willing to betray you by stealing from you.
  - taeric 4y ago
    If it is copiable, how would you know if it had been compromised? My understanding is that backup keys should not be identical for that reason. Let's you revoke and audit use. As such, having a backup has to be accessible so that you can register it places. There are tricks, but they only work in certain scenarios. Mostly not in the fido use cases.
dwaite 4y ago
Something like https://www.yubico.com/product/security-key-c-nfc-by-yubico/ https://www.yubico.com/product/security-key-c-nfc-by-yubico/ ?

AnIdiotOnTheNet 4y ago

Honestly I'm surprised we're still using user names and passwords for authentication and identification in 2022. We have come up with many better ways to do this, and just completely failed to adopt any of them as the new normal. The closest we get is when we can use Google or Facebook to log into Joe Blow's Bullshit site instead of a bespoke account.

taeric 4y ago
I'm afraid to ask what you think are the better ways? My assertion is that most risk of online fraud is a social, not a technical problem. As such, it will require law to make safe.
- noahtallen 4y ago
  Passkeys, which are getting closer and closer to prime time. If you think about it, key-based auth is already highly recommended and utilized in many scenarios (like SSH, signing data, certificates, token authentication for use between servers, etc.)… this just makes that accessible to users. The vast majority of people don’t even use a password manager, and use variations of the same password everywhere. That’s really unsafe. Passkeys are always unique. Another thing is phishing. The big issue with phishing is how easy it is to make a website or popup look identical to a different service. And if it’s believable enough and the domain is hidden, you’ll put in your real password. Passkeys fix that because they only work on the site in question. No danger of leaking it to someone else! So this will make some huge improvements in security. Basically taking care of the very basic things most people don’t do. Password managers solve many of the same problems, but are potentially less convenient in some scenarios. (Obtuse password requirements, password field not working with paste, etc. it’s just a 3rd party workaround.) But like you said, the social aspect is still a huge problem.
  - josephcsible 4y ago
    > if [...] the domain is hidden When is that?
  - 4y ago

alanfranz 4y ago

Author here. As you can see in the closing lines: > I really hope that passwordless login will make some steps forward in the next years But, in the meantime I wouldn't despise passwords THAT much, if the policies were not stupid. Using any kind of SSO (e.g. login via Google or MS or Apple) puts multiple accounts under the umbrella of some internet giants; if at any time they revoke your account, you risk losing access to multiple other unrelated sites (not to mention the fact they'll know even more usage patterns).