5 ms·

Honestly I'm surprised we're still using user names and passwords for authentication and identification in 2022. We have come up with many better ways to do thi

Honestly I'm surprised we're still using user names and passwords for authentication and identification in 2022. We have come up with many better ways to do this, and just completely failed to adopt any of them as the new normal. The closest we get is when we can use Google or Facebook to log into Joe Blow's Bullshit site instead of a bespoke account.

taeric 4y ago
I'm afraid to ask what you think are the better ways? My assertion is that most risk of online fraud is a social, not a technical problem. As such, it will require law to make safe.
- noahtallen 4y ago
  Passkeys, which are getting closer and closer to prime time. If you think about it, key-based auth is already highly recommended and utilized in many scenarios (like SSH, signing data, certificates, token authentication for use between servers, etc.)… this just makes that accessible to users. The vast majority of people don’t even use a password manager, and use variations of the same password everywhere. That’s really unsafe. Passkeys are always unique. Another thing is phishing. The big issue with phishing is how easy it is to make a website or popup look identical to a different service. And if it’s believable enough and the domain is hidden, you’ll put in your real password. Passkeys fix that because they only work on the site in question. No danger of leaking it to someone else! So this will make some huge improvements in security. Basically taking care of the very basic things most people don’t do. Password managers solve many of the same problems, but are potentially less convenient in some scenarios. (Obtuse password requirements, password field not working with paste, etc. it’s just a 3rd party workaround.) But like you said, the social aspect is still a huge problem.
  - josephcsible 4y ago
    > if [...] the domain is hidden When is that?
  - taeric 4y ago
    Passkeys aren't immune to phishing. And they are susceptible to being lost. I say that as someone with two. Worse, they aren't accepted everywhere. And often places only let you have one registered. :( So, yes, I agree that they are a solution. I don't know that I feel much safer using one, though. And, at large, I can see how they are not much different to passwords. Just ones that you can't speak others easily.
    - sdfhbdf 4y ago
      Are you sure you’re referring to passkeys like passkeys.dev? The new Web standard? It builds upon WebAuthn and physical keys but is slightly different and on track to be supported by major platforms. Sounds like you’re referring to something like YubiKey, it’s hard to lose device associated passkeys. How would you phish it? The challenge response mechanism contains the requesting origin so it’s berry difficult to phish it out given up to date browser.
      - taeric 4y ago
        You are correct I meant yubikeys. I'll have to look a bit more at this new thing. I confess right now it isn't impressing me. Is sounding too magical in a "it just works" way. With no real explanation of how. It hurts that it sounds tied to a device. I stopped using some authenticator apps after I lost access to a ton of stuff when my phone broke. As for phishing, this seems like a mitm would still work better than you'd expect. Folks get really good at ignoring warnings and such. Especially under duress.
- Avamander 4y ago
  Some countries solved it with physical security keys, now large vendors are pushing Passkeys. Both work for this purpose, albeit the first one also has an identity behind it.
- AnIdiotOnTheNet 4y ago
  For example, asymmetric key pairs. Give sites a public key and auth by signing something with your private key. You can use the same key on as many sites as you want, but you can also use different keys for different sites. No need for a third party even.
  - taeric 4y ago
    This is, essentially, harder to remember passwords. Probably more secure, provided you don't make a mistake. But also easier to mistake and then lock yourself out. Auditing is also harder, now
    - AnIdiotOnTheNet 4y ago
      No it isn't, because unlike passwords you can reuse a key pair indefinitely without suffering any greater risk. If we only ever had to remember a handful of passwords you would be right about them being easier, but we have hundreds of them which necessitates a password manager anyway which has all the same manageability problems of the asymmetric key pair without any of the benefits. > Auditing is also harder, now Care to elaborate?
      - taeric 4y ago
        You still have to remember what it is that you signed. Unless you are saying it is a challenge/response thing. In which case you have to know what public key they have. And if it is challenge/response, you need to have different public keys, or a compromised private key is complete game over, just like a shared password. Thinking on it more, I'm not sure why I think auditing is harder. Is hard regardless, but I don't think this makes it tougher. If you are reusing public keys on N sites, it is now N places to check for use per key. Though, you always had N places to audit. They could be independent without reuse, but still not easy.
        AnIdiotOnTheNet 4y ago
        > You still have to remember what it is that you signed. Unless you are saying it is a challenge/response thing. In which case you have to know what public key they have. You say that like it is a problem? Like I said, you could easily and securely get away with a single private key, so there isn't really any guesswork here. Certainly remembering usernames for hundreds of sites would be worse. And if you want a different key pair for your porn, you can do that and it is on you to remember which one to use, same as usernames and passwords. > a compromised private key is complete game over Yeah, just like a compromised password manager is. Can't really do much about that.

taeric 4y ago

I'm afraid to ask what you think are the better ways? My assertion is that most risk of online fraud is a social, not a technical problem. As such, it will require law to make safe.

noahtallen 4y ago
Passkeys, which are getting closer and closer to prime time. If you think about it, key-based auth is already highly recommended and utilized in many scenarios (like SSH, signing data, certificates, token authentication for use between servers, etc.)… this just makes that accessible to users. The vast majority of people don’t even use a password manager, and use variations of the same password everywhere. That’s really unsafe. Passkeys are always unique. Another thing is phishing. The big issue with phishing is how easy it is to make a website or popup look identical to a different service. And if it’s believable enough and the domain is hidden, you’ll put in your real password. Passkeys fix that because they only work on the site in question. No danger of leaking it to someone else! So this will make some huge improvements in security. Basically taking care of the very basic things most people don’t do. Password managers solve many of the same problems, but are potentially less convenient in some scenarios. (Obtuse password requirements, password field not working with paste, etc. it’s just a 3rd party workaround.) But like you said, the social aspect is still a huge problem.
- josephcsible 4y ago
  > if [...] the domain is hidden When is that?
- taeric 4y ago
  Passkeys aren't immune to phishing. And they are susceptible to being lost. I say that as someone with two. Worse, they aren't accepted everywhere. And often places only let you have one registered. :( So, yes, I agree that they are a solution. I don't know that I feel much safer using one, though. And, at large, I can see how they are not much different to passwords. Just ones that you can't speak others easily.
  - sdfhbdf 4y ago
    Are you sure you’re referring to passkeys like passkeys.dev? The new Web standard? It builds upon WebAuthn and physical keys but is slightly different and on track to be supported by major platforms. Sounds like you’re referring to something like YubiKey, it’s hard to lose device associated passkeys. How would you phish it? The challenge response mechanism contains the requesting origin so it’s berry difficult to phish it out given up to date browser.
    - taeric 4y ago
      You are correct I meant yubikeys. I'll have to look a bit more at this new thing. I confess right now it isn't impressing me. Is sounding too magical in a "it just works" way. With no real explanation of how. It hurts that it sounds tied to a device. I stopped using some authenticator apps after I lost access to a ton of stuff when my phone broke. As for phishing, this seems like a mitm would still work better than you'd expect. Folks get really good at ignoring warnings and such. Especially under duress.
Avamander 4y ago
Some countries solved it with physical security keys, now large vendors are pushing Passkeys. Both work for this purpose, albeit the first one also has an identity behind it.
AnIdiotOnTheNet 4y ago
For example, asymmetric key pairs. Give sites a public key and auth by signing something with your private key. You can use the same key on as many sites as you want, but you can also use different keys for different sites. No need for a third party even.
- taeric 4y ago
  This is, essentially, harder to remember passwords. Probably more secure, provided you don't make a mistake. But also easier to mistake and then lock yourself out. Auditing is also harder, now
  - AnIdiotOnTheNet 4y ago
    No it isn't, because unlike passwords you can reuse a key pair indefinitely without suffering any greater risk. If we only ever had to remember a handful of passwords you would be right about them being easier, but we have hundreds of them which necessitates a password manager anyway which has all the same manageability problems of the asymmetric key pair without any of the benefits. > Auditing is also harder, now Care to elaborate?
    - taeric 4y ago
      You still have to remember what it is that you signed. Unless you are saying it is a challenge/response thing. In which case you have to know what public key they have. And if it is challenge/response, you need to have different public keys, or a compromised private key is complete game over, just like a shared password. Thinking on it more, I'm not sure why I think auditing is harder. Is hard regardless, but I don't think this makes it tougher. If you are reusing public keys on N sites, it is now N places to check for use per key. Though, you always had N places to audit. They could be independent without reuse, but still not easy.
      - AnIdiotOnTheNet 4y ago
        > You still have to remember what it is that you signed. Unless you are saying it is a challenge/response thing. In which case you have to know what public key they have. You say that like it is a problem? Like I said, you could easily and securely get away with a single private key, so there isn't really any guesswork here. Certainly remembering usernames for hundreds of sites would be worse. And if you want a different key pair for your porn, you can do that and it is on you to remember which one to use, same as usernames and passwords. > a compromised private key is complete game over Yeah, just like a compromised password manager is. Can't really do much about that.