4 ms·

> Another cancer that is begining to spread:"passwordless". I have got to hear your problems with it! As I see it passwordless will eliminate whole families of

> Another cancer that is begining to spread:"passwordless". I have got to hear your problems with it! As I see it passwordless will eliminate whole families of attack methods. Lookalike credential phishing pages made obsolete. I wish we had started using it years ago. What are the downsides?

NoZebra120vClip 4y ago
For one thing, a password is a string of characters that you and I carry around in our heads. At least they were, until complexity requirements, forced expiration, and proliferation of accounts caused us to rely more on password managers than our memories. However, the platonic ideal of a password is one that you remember: "Something You Know". Therefore, it is usable at the library, it is usable in the hospital after your ambulance transport, it is usable when you're stranded in Portugal and borrowing someone's phone at the U.S. Embassy in Lisbon. Passwords are not something that can just drop out of your pocket, or be "stolen" from you, in the sense of depriving you of that knowledge. "Passwordless auth" comes to rely on devices. MFA did this to us first, of course, where SMS codes come through our phone, which is now mandatory, or come off our Yubikeys or Google Authenticator, which in turn depend on a computing device. "Passwordless auth" is always tied to a device of some kind. Therefore, passwordless auth is something that can easily fail or be taken away from us. How easy is it to lose your phone? What are the chances you'll need to sign in to, say, Apple, to retrieve a contact's phone number, and all you have is your brain connected to your fingers? Your passwordless auth is now useless. So yeah, it's great from a technerd perspective, where we have lots of devices, always a backup, plenty of cash to replace them, disaster plans in place, etc. Passwordless auth (and MFA along with it) isn't so attractive when you're addicted to heroin, mentally ill, homeless and living on the streets, and you're trying to sign in at a library computer so that you can apply for SNAP benefits, Medicaid, and Section 8 housing assistance.
_8j50 4y ago
It is inferior to multi-factor authentication. It sounds fancy but you are removing a layer of security for no reason other than it's trendy and hyped up! Good security is application of layers of defenses in a disciplined and consistent way. I should not be able to steal a yubikey or find one flaw in your passwordless credential reset method or abuse the next and greatest phishing method like in-browser vnc with webusb and that's all I need to take over an account. Let me clarify: the problem is removal of "what you know" as a layer of defense and a factor of authentication. I don't care if it is a password, passphrase, pin, puzzle, picture or whatever, without it having only one factor of authentication is remarkably inferior to MFA. And this is detrimental to 10-15+ years of security culture improvements all because vendors and clueless c-suite execs prefer to follow trends instead of listening to actual security professionals.
- 1101010010 4y ago
  Passwordless authentication means removing the most critical failure factor from authentication: the human. > I should not be able to steal a yubikey This type of attack is not based in reality; most attacks are done remotely from a location with limited jurisdiction and practically no repercussions. When there is no credential to phish because it's a hardware-backed cryptographic assertion, security is drastically improved. WebAuthN literally provides credential phishing immunity, which is by far the most prevalent source of account compromise today (see: annual Verizon threat report). It is so superior, I would even go so far as to share my password to, say, my Google account provided it is protected exclusively with a hardware authentication factor.
  - _8j50 4y ago
    > Passwordless authentication means removing the most critical failure factor from authentication: the human. Yes it is but you are removing a layer of defense not a link in a chain. You think this is better based on a fundamentally flawed understanding of defensive security. > This type of attack is not based in reality; most attacks are done remotely from a location with limited jurisdiction and practically no repercussions Of course the threat landscape never changes right? And the process you have to issue new yubikeys is flawless too right? And threat actors never adapt right? WebUSB and in browser vnc can't possibly be abused? So many things can go wrong. Look, here is the fundamental thing you people that jump on these hype trains don't understand about security: it is that after half a century, what we've learned is that it is a cat and mouse game and there are no long lasting silver bullets and even if there were, you still do security in layers because mistakes happen and you could screw up something that makes your silver bullet ineffective. So you add multiple layers of preventive and detection focused security. You don't remove an entire layer of security and somehow twist that to sound like you improved something. It's legitimately fraudulent and harmful.
    - 1101010010 4y ago
      Passwords are bearer credentials and as such, they are not a meaningful layer of defense when in the custody of even a modestly competent system administrator. As I'd said, you need to look no further than annual threat reports to see that credential theft is the most common avenue of abuse - by a lot. Hardware assertions, on the other hand, which in WebAuthN standards are also bound to domain origins, simply remove this risk entirely. Let me repeat: you cannot phish a WebAuthN assertion. Yes, you can pull off a physical attack, but at this point of the game, it is over because the adversary could just implant a bootkit, keylogger or backdoor on your valuable system. The threat landscape certainly changes but the economics of computer fraud and abuse remains largely the same: attack the most vulnerable link in the chain for maximum profit for the least amount of cost - the human and her portable password (and other forms of exportable factors, roughly in order of security: SMS-based, HOTP/TOTP apps, email magic links, Duo-style "confirmations").

NoZebra120vClip 4y ago

For one thing, a password is a string of characters that you and I carry around in our heads. At least they were, until complexity requirements, forced expiration, and proliferation of accounts caused us to rely more on password managers than our memories. However, the platonic ideal of a password is one that you remember: "Something You Know". Therefore, it is usable at the library, it is usable in the hospital after your ambulance transport, it is usable when you're stranded in Portugal and borrowing someone's phone at the U.S. Embassy in Lisbon. Passwords are not something that can just drop out of your pocket, or be "stolen" from you, in the sense of depriving you of that knowledge. "Passwordless auth" comes to rely on devices. MFA did this to us first, of course, where SMS codes come through our phone, which is now mandatory, or come off our Yubikeys or Google Authenticator, which in turn depend on a computing device. "Passwordless auth" is always tied to a device of some kind. Therefore, passwordless auth is something that can easily fail or be taken away from us. How easy is it to lose your phone? What are the chances you'll need to sign in to, say, Apple, to retrieve a contact's phone number, and all you have is your brain connected to your fingers? Your passwordless auth is now useless. So yeah, it's great from a technerd perspective, where we have lots of devices, always a backup, plenty of cash to replace them, disaster plans in place, etc. Passwordless auth (and MFA along with it) isn't so attractive when you're addicted to heroin, mentally ill, homeless and living on the streets, and you're trying to sign in at a library computer so that you can apply for SNAP benefits, Medicaid, and Section 8 housing assistance.

_8j50 4y ago

It is inferior to multi-factor authentication. It sounds fancy but you are removing a layer of security for no reason other than it's trendy and hyped up! Good security is application of layers of defenses in a disciplined and consistent way. I should not be able to steal a yubikey or find one flaw in your passwordless credential reset method or abuse the next and greatest phishing method like in-browser vnc with webusb and that's all I need to take over an account. Let me clarify: the problem is removal of "what you know" as a layer of defense and a factor of authentication. I don't care if it is a password, passphrase, pin, puzzle, picture or whatever, without it having only one factor of authentication is remarkably inferior to MFA. And this is detrimental to 10-15+ years of security culture improvements all because vendors and clueless c-suite execs prefer to follow trends instead of listening to actual security professionals.

1101010010 4y ago
Passwordless authentication means removing the most critical failure factor from authentication: the human. > I should not be able to steal a yubikey This type of attack is not based in reality; most attacks are done remotely from a location with limited jurisdiction and practically no repercussions. When there is no credential to phish because it's a hardware-backed cryptographic assertion, security is drastically improved. WebAuthN literally provides credential phishing immunity, which is by far the most prevalent source of account compromise today (see: annual Verizon threat report). It is so superior, I would even go so far as to share my password to, say, my Google account provided it is protected exclusively with a hardware authentication factor.
- _8j50 4y ago
  > Passwordless authentication means removing the most critical failure factor from authentication: the human. Yes it is but you are removing a layer of defense not a link in a chain. You think this is better based on a fundamentally flawed understanding of defensive security. > This type of attack is not based in reality; most attacks are done remotely from a location with limited jurisdiction and practically no repercussions Of course the threat landscape never changes right? And the process you have to issue new yubikeys is flawless too right? And threat actors never adapt right? WebUSB and in browser vnc can't possibly be abused? So many things can go wrong. Look, here is the fundamental thing you people that jump on these hype trains don't understand about security: it is that after half a century, what we've learned is that it is a cat and mouse game and there are no long lasting silver bullets and even if there were, you still do security in layers because mistakes happen and you could screw up something that makes your silver bullet ineffective. So you add multiple layers of preventive and detection focused security. You don't remove an entire layer of security and somehow twist that to sound like you improved something. It's legitimately fraudulent and harmful.
  - 1101010010 4y ago
    Passwords are bearer credentials and as such, they are not a meaningful layer of defense when in the custody of even a modestly competent system administrator. As I'd said, you need to look no further than annual threat reports to see that credential theft is the most common avenue of abuse - by a lot. Hardware assertions, on the other hand, which in WebAuthN standards are also bound to domain origins, simply remove this risk entirely. Let me repeat: you cannot phish a WebAuthN assertion. Yes, you can pull off a physical attack, but at this point of the game, it is over because the adversary could just implant a bootkit, keylogger or backdoor on your valuable system. The threat landscape certainly changes but the economics of computer fraud and abuse remains largely the same: attack the most vulnerable link in the chain for maximum profit for the least amount of cost - the human and her portable password (and other forms of exportable factors, roughly in order of security: SMS-based, HOTP/TOTP apps, email magic links, Duo-style "confirmations").