3 ms·
10 years ago "use a strong password with all these symbols" Average person reluctantly moves from 123456 to P@55word! 8 years ago "no passwords such, use a pa
by ta1243 4y ago
10 years ago "use a strong password with all these symbols"
Average person reluctantly moves from 123456 to P@55word!
8 years ago "no passwords such, use a pass phrase"
Average person reluctantly moves from P@55word! to correct-horse-battery-staple
6 years ago "ok but you need to use different passwords on each site"
Average person reluctantly moves to different passwords per site
4 years ago "but you can be phished, you have to use 2FA"
Average person reluctantly moves to SMS
2 years ago "no in some countries it's easy to take over SMS, use TOTP"
Average person reluctantly moves to TOTP
Today "no TOTP is rubbish, you can be phished, use this hardware authenticator"
Normal people don't like new shiny ways of working every year or so. My house's front door lock is broadly the same interface as my great-grandparent's front door lock, but technologists think changing the way things work every couple of years is acceptable.
- sysihyk 4y ago[dead]
- kriops 4y agoWebAuthn is an UX improvement as well as a security improvement. I sympathize with your point, but in this case it’s easily sellable as the cure to the rest of your list … unless you somehow lose your key.
- criley2 4y agoNot a UX improvement. Most users need a yubikey for the computer unless they have a new Mac. Asking my 65 year old dad to keep up with a yubikey is not just bad UX, it's failing UX. It simply will not happen. I don't even think it's realistic to get him to use a smartphone for this, he hates the things. WebAuthn works great for your Web 3.0 startup but as soon as you're talking about the average user, who is likely decades older than the commenters here, and far less interested in keeping up with these things, and far less patient with the hassles... asking them to carry hardware is a nonstarter for so many.
- thatnerdyguy 4y agoI thought Windows machines just used the TPM to store WebAuthN keys? No yubikey necessary. Just a click on some popup dialog to select your credential for login.
- criley2 4y agoWindows has a service called "Windows Hello" which can work with WebAuthn (otherwise it's hardware keys). It requires your computer to have various biometric or camera technology built in, such as a finger print scanner. I'm sure windows laptops are more equipped for this, but desktops obviously are not, and I'm certainly not advising folks to leave some insecure cheap imported webcam hooked up 24/7 "for security purposes". I don't know anyone using "Hello" but I suppose it's an option. Most Windows users would likely have to use a hardware key though.
- Bluecobra 4y agoI would be weary of using this, I have been using Windows since Windows 95 and seen enough things go wrong that I wouldn't want to be locked out of my online accounts. For example one thing I noticed is that by simply updating my BIOS in Windows 11 causes havoc and everything gets signed out. A cross-platform hardware token sounds more appealing to me. I could see Hello being something to secure corporate laptops/accounts in an enterprise environment though.
- Arnavion 4y ago>For example one thing I noticed is that by simply updating my BIOS in Windows 11 causes havoc and everything gets signed out. That's surprising. As in, the fact that that happens is to be expected from the firmware's point of view - updating the firmware changes the measurements made to the TPM so any secrets can no longer be unlocked. But I would've expected Windows to update the expected measurements before applying the update to prevent that from happening.
- aledalgrande 4y ago
- tengwar2 4y agoThat is a "when" event rather than an "if" event.
- vkou 4y ago> My house's front door lock is broadly the same interface as my great-grandparent's front door lock, It can also be defeated by any idiot with a bump key in about 10 seconds.
- Gigachad 4y agoThe difference is that your door is exposed to the neighbourhood while computers are exposed to the whole planet. Notice how your plain old number password is still sufficient for unlocking your phone.
- hulitu 4y agoAnd what those "security" people do not understand: the user will choose the path of least resistance, making all those measures, useles.
- latexr 4y ago> Average person reluctantly moves from (…) A reluctant move is still a move, and thus beneficial. But we definitely have different ideas of the “average person”. I sincerely doubt the average has moved on from P@55word, and even then only because the website they’re trying to register an account with imposes the rule. I’d be happy to be proven wrong; do we have data on it?
- danaris 4y agoMore realistically: 8 years ago "no passwords, use a pass phrase" Average person reluctantly moves from "P@55word!" to "P@55word! P@55word! P@55word!" 6 years ago "different passwords on each set" Average person shrugs and changes nothing 2 years ago "use TOTP 2FA" Average person already using SMS changes nothing, and the sites allow this as a grandfathered exception effectively indefinitely
- sleepybrett 4y ago> Normal people don't like new shiny ways of working every year or so. My house's front door lock is broadly the same interface as my great-grandparent's front door lock, but technologists think changing the way things work every couple of years is acceptable. Your front door doesn't have thousands of anonymous bots a day trying to brute force it.
- xnorswap 4y agoI'm not sure what your point is, the recommendations improve and evolve over time.
- flangola7 4y agoThat's fine, but don't be a hypocrite who comes complaining when they get hacked. It's your personal responsibility to maintain your own security.
- bawolff 4y agoThis isn't really the way that advice played out: Nobody should ever suggest you use TOTP or SMS 2fa to prevent phishing. > 6 years ago "ok but you need to use different passwords on each site" Really the only one that matters in practise. TOTP is basically just a work around to get users to actually do this. Edit: i would also add this is a corporate environment where its reasonable to be more picky. And webauth really is the best (only?) Solution to phishing.
- Tepix 4y agoWell, if you use a compromised device temporarily and your password gets stolen and you have 2FA, it will sort of be ok once you stop using that device.
- bawolff 4y agoDepends how long your session cookie lasts for the site. Some high security sites are paranoid, but most of the time they last for like a year. It also depends on how sophisticated the attacker is. Do they fake log you out so they could capture a second 2fa token in order to change the totp token to a new device and change your email? And of course, for the most part damage can usually be done in minutes - copying confidential files does not need long term access.
- sushibowl 4y ago> My house's front door lock is broadly the same interface as my great-grandparent's front door lock True, but your house's front door lock is very likely to offer quite poor security. Most house locks are vulnerable to bumping attacks that are almost trivial to pull off. The only reason this is acceptable is the threat model you're dealing with when securing a physical house is very different from securing an internet-connected computer. Moreover, while the threats against your front door have remained marginally the same as those against your great-grandparent's door, computers and the network they are operating in change extremely frequently. All the security recommendations you're naming were quite reasonable for their time but rapidly became outdated.
- orra 4y agoAlso, people should definitely upgrade their front door locks! A three star euro cylinder will snap, instead of letting the intruder in. While surely nothing offers complete security, it massively increases the effort required to break in (from essentially zero).
- njarboe 4y agoWell constructed deadbolt on inside only. Much more concerned with a break in when I'm home than when I'm away and this will help dramatically.
- sleepybrett 4y agoVery few break-ins are accomplished via defeating a lock with something in the vein of a pick (bumping, pick gun, etc). Most break in are accomplished via a broken window/glass door.
- mjevans 4y agoIf someone _really_ wants in, the windows are an even weaker point. Obvious at a glance breakage probably not even necessary... (those latches seem awfully flimsy).
- pwython 4y ago
- stavros 4y agoTen years ago, everyone got hacked all the time. Today, basically the only way to get you hacked is to hack the actual site you're using. I'd say that's progress.
- wongarsu 4y agoFor applications where it really mattered, harware authenticators have long been established. Big companies use smart cards, and my bank has always offered the choice between the 2FA-du-jour (switching from pre-distributed TAN lists to SMS 2FA to various iterations of 2FA apps, currently push tan) or just getting a $20 reader for my existing bank card (which has a chip since forever in europe). The list you are describing could as well be seen as every service trying to implement the simplest and least disruptive technology, only to find out two years later that it was insufficient and switching to the next best thing, only for the cycle to repeat each time. Which of course from the users perspective doesn't make a difference, but it gives a different perspective on how to solve it for the future.
- simonh 4y agoThe Egyptians has wooden door lock mechanisms. It took thousands of years to develop modern door locks. We went from lever tumbler locks in 1778 to the modern Yale lock in 1861 (which fundamentally still operates on similar principles to the Egyptian wooden pin lock). I'm sure authentication technology will settle down in a decade or two.
- sh4rks 4y agoYet the time it takes to pick those locks hasn't changed for centuries
- the_duke 4y agoYou are talking about the average developer. Most regular users never moved beyond using 'P@55word!' everywhere.
- toxicFork 4y agoYeah, security is a cat and mouse game. You need to keep adapting.