5 ms·

Not just phishing, server side attacks can hoover up passwords all day long. Also XSS can extract passwords from password managers, etc. Passwords are dumb. The

by px43 4y ago

Not just phishing, server side attacks can hoover up passwords all day long. Also XSS can extract passwords from password managers, etc. Passwords are dumb. The static/symmetric nature of passwords makes authentication fully transitive, where if A can be tricked into logging into system B, then an attacker on system B can use A's credentials to log in to system C. This is fundamentally broken. We've had asymmetric authentication for nearly 30 years now, it's insane that people are still using passwords to authenticate to stuff.

mschuster91 4y ago
> We've had asymmetric authentication for nearly 30 years now, it's insane that people are still using passwords to authenticate to stuff. The thing is, anything but passwords is extremely challenging for non-tech users. Even SMS-based 2FA is too much for tech illiterate people. You do not want to be the support staff for a service that has 2FA enabled. It's utter madness - people lose their 2FA devices, get them stolen, drop them in water, run over it with their cars, have them eaten by your pets (Yubikeys seem to have a particular attraction to cats and dogs as toys), forget them at home before a vacation, of course no one prints out their 2FA recovery codes... and then there are the scammers who pretend one of these events has happened and the account needs to be unlocked, or those who fell victim to a phishing scam and now 2FA is under the control of the attacker.
- snowstormsun 4y ago
  > The thing is, anything but passwords is extremely challenging for non-tech users. People usually manage to not loose/destroy the keys to their houses/cars very often. A FIDO token is very similar. You just need to understand that it's important to not loose it and that you should have a second backup key. I don't think this problem has anything to do with being a "non-tech" user.
  - mschuster91 4y ago
    > People usually manage to not loose/destroy the keys to their houses/cars very often. Lol. Friend of mine works in real estate... losing keys is very common. > You just need to understand that it's important to not loose it and that you should have a second backup key. And how many people have that? Know that? Don't skip the dialog warnings because they've been conditioned to do so? And on top of that, what about the services that only support one 2FA device like Amazon AWS with Yubikeys?
    - snowstormsun 4y ago
      > Lol. Friend of mine works in real estate... losing keys is very common. Ok, fair point. That's why it'd be good to have a second key somewhere safe. The FIDO token also is just one key that can be used for multiple websites. That's like having many houses and all can be unlocked with one key. > And how many people have that? Know that? Don't skip the dialog warnings because they've been conditioned to do so? I don't know, you're right perhaps not that many. But the problem is maybe also that people do not want to pay ca. 60$ for two yubi-keys just to be able to use the same websites their using with a password already. Perhaps the passkeys login using android/ios (e.g. authentication via fingerprint with your smartphone) is going to be much more popular because it's more convenient and "free" (except you pay with your data). > And on top of that, what about the services that only support one 2FA device like Amazon AWS with Yubikeys? Yeah, services that do that or even have 2FA as a paid-only feature need to change that. It's just a system flaw on their side in my eyes. Hopefully, such bad practices will bring those services a big enough competitive disadvantage in the future that they're forced to implement 2FA properly.
throw0101c 4y ago
> Not just phishing, server side attacks can hoover up passwords all day long. Just to note that there are password-based login systems that solve this problem: * https://en.wikipedia.org/wiki/Salted_Challenge_Response_Authentication_Mechanism https://en.wikipedia.org/wiki/Salted_Challenge_Response_Auth... * https://en.wikipedia.org/wiki/Password-authenticated_key_agreement https://en.wikipedia.org/wiki/Password-authenticated_key_agr...
- e12e 4y ago
  Doesn't solve keyloggers?
- px43 4y ago
  The attacker controls the login form. They could use javascript to just scrape it out of the password field if they wanted to. Those solutions might get in the way of existing tools for logging password forms, but there are trivial workarounds.

by px43 4y ago

mschuster91 4y ago

> We've had asymmetric authentication for nearly 30 years now, it's insane that people are still using passwords to authenticate to stuff. The thing is, anything but passwords is extremely challenging for non-tech users. Even SMS-based 2FA is too much for tech illiterate people. You do not want to be the support staff for a service that has 2FA enabled. It's utter madness - people lose their 2FA devices, get them stolen, drop them in water, run over it with their cars, have them eaten by your pets (Yubikeys seem to have a particular attraction to cats and dogs as toys), forget them at home before a vacation, of course no one prints out their 2FA recovery codes... and then there are the scammers who pretend one of these events has happened and the account needs to be unlocked, or those who fell victim to a phishing scam and now 2FA is under the control of the attacker.

snowstormsun 4y ago
> The thing is, anything but passwords is extremely challenging for non-tech users. People usually manage to not loose/destroy the keys to their houses/cars very often. A FIDO token is very similar. You just need to understand that it's important to not loose it and that you should have a second backup key. I don't think this problem has anything to do with being a "non-tech" user.
- mschuster91 4y ago
  > People usually manage to not loose/destroy the keys to their houses/cars very often. Lol. Friend of mine works in real estate... losing keys is very common. > You just need to understand that it's important to not loose it and that you should have a second backup key. And how many people have that? Know that? Don't skip the dialog warnings because they've been conditioned to do so? And on top of that, what about the services that only support one 2FA device like Amazon AWS with Yubikeys?
  - snowstormsun 4y ago
    > Lol. Friend of mine works in real estate... losing keys is very common. Ok, fair point. That's why it'd be good to have a second key somewhere safe. The FIDO token also is just one key that can be used for multiple websites. That's like having many houses and all can be unlocked with one key. > And how many people have that? Know that? Don't skip the dialog warnings because they've been conditioned to do so? I don't know, you're right perhaps not that many. But the problem is maybe also that people do not want to pay ca. 60$ for two yubi-keys just to be able to use the same websites their using with a password already. Perhaps the passkeys login using android/ios (e.g. authentication via fingerprint with your smartphone) is going to be much more popular because it's more convenient and "free" (except you pay with your data). > And on top of that, what about the services that only support one 2FA device like Amazon AWS with Yubikeys? Yeah, services that do that or even have 2FA as a paid-only feature need to change that. It's just a system flaw on their side in my eyes. Hopefully, such bad practices will bring those services a big enough competitive disadvantage in the future that they're forced to implement 2FA properly.

throw0101c 4y ago

> Not just phishing, server side attacks can hoover up passwords all day long. Just to note that there are password-based login systems that solve this problem: * https://en.wikipedia.org/wiki/Salted_Challenge_Response_Authentication_Mechanism https://en.wikipedia.org/wiki/Salted_Challenge_Response_Auth... * https://en.wikipedia.org/wiki/Password-authenticated_key_agreement https://en.wikipedia.org/wiki/Password-authenticated_key_agr...

e12e 4y ago
Doesn't solve keyloggers?
px43 4y ago
The attacker controls the login form. They could use javascript to just scrape it out of the password field if they wanted to. Those solutions might get in the way of existing tools for logging password forms, but there are trivial workarounds.