10 ms·

Passwords Are Fine

129 points by kevincox 3y ago

bkishan 3y ago
Of course passwords are fine. What's not fine is getting billions of people to change their behavior and switch to and use a password manager (that's not chrome). You could even argue passwords are better than passkeys for those with strong password hygiene. However when it to the masses, the convenience-security tradeoff of something like passkeys is always going to be better. And for the nerds and geeks, passwords are not going to disappear anytime soon.
- foobarbecue 3y ago
  Why not chrome?
  - cj 3y ago
    This isn't a great answer, but I've never liked Chrome password manager because I feel like a password manager is something I want to pay a company for, not a service I want to be given for free. Somehow, it being a free feature that's bundled with my browser makes me not trust it. (Again, not claiming this is a great reason not to use it)
    - Arch-TK 3y ago
      Weird. I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android). I basically refuse to use any password manager with an implementation I can't see or audit. I can't imagine trusting any company to handle my passwords correctly. The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would cause me to lose control over my passwords unless I lose control over the yubikey itself.
      - chkaloon 3y ago
        Did you actually look at it and audit it? >99% of people aren't going to do that. They're just assuming somebody has.
        nordsieck 3y ago
        > Did you actually look at it and audit it? >99% of people aren't going to do that. They're just assuming somebody has. That's a fair point. I certainly haven't. But the great virtue of pass is that it runs locally, which means that it's much more difficult to attack than a SaS password manager.
        worksonmine 3y ago
        I have, pass is just a bash script with <1000 loc.
        Arch-TK 3y ago
        Yes, pass is 800 lines of relatively straightforward bash and I am qualified to review bash. Now, granted, it uses GnuPG and git but in those cases I think the risk of problems is minimal. I haven’t in all honesty read the Password Store android application (nor OpenKeychain) source code but I trust my phone sandbox capabilities enough for it not to do anything nefarious like send my passwords somewhere. Its also not so large that it would be hard to read it. The point is, the operating principles behind how Pass works are simple enough that its relatively easy to verify the core of any implentation and relatively difficult to smuggle in nefarious behavior.
      - ValleZ 3y ago
        How do you know that the product you use was built from the provided sources?
        nordsieck 3y ago
        > How do you know that the product you use was built from the provided sources? Maybe you haven't heard of pass[1], but it's an open source project, and it's easy to build from source[2]. --- 1. https://www.passwordstore.org/ https://www.passwordstore.org/ 2. https://git.zx2c4.com/password-store/ https://git.zx2c4.com/password-store/
  - dspillett 3y ago
    Not sure if it is what the GPP is referring to, but I prefer to keep a larger gap between my browser and password manager to reduce the potential spread of difficulties if the browser falls foul of a security vulnerability. The risk of this happening is of course small, it would require significant bugs in a couple of different places, but the potential damage is high. Firefox's password manager, or those built into any other web UAs, I'd be wary of for the same reason rather than it being specifically an anti-chrome thing. An air gap would be preferable still, as that would protect from similar issues at the OS level, but that is another step or few into less practical (well, significantly more inconvenient) territory. I at least have my master password on a USB device (and backed up by other physical means in case that dies) which is only plugged in when needed, that is effectively an air gap when I don't leave the password manager unlocked between uses.
  - noirscape 3y ago
    Not the parent but the problem is that Chrome (sub. Firefox and Safari, these are problems with pretty much all browsers) isn't a password manager, its a password autofiller. The result is that what should be crucial things like "how do we ensure permanency of the passwords file" are treated as very second rank - profile corruption usually is met with "remove the entire profile", which also ditches the password database. Literally every other password manager has some sort of tool available that makes it very clear where your data is stored and emergency backup options. Chrome also doesn't like it if the login form doesn't look like most other login forms (and because this is the internet, you're gonna at some point run into weird login forms). It also can behave really funny if the site combines the user registration form with the user login form (which a lot of webshops do) by putting the autofill information in the registration form instead of the login form. Add to that a very subpar experience in manually filling the right fields and "why not Chrome" should have a very clear answer.
    - foobarbecue 3y ago
      It's a full-featured password manager, accessible via passwords.google.com . Also has great android app integration. I use it on Android, Linux, and Windows. The only thing it's missing is the marketing; I often wonder why they don't market it and crush 1password et al.
jlmb 3y ago
“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method. I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.
- hulitu 3y ago
  > so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?
  - wasmitnetzen 3y ago
    Passkeys are basically enforced password managers with random passwords. There's some more complexity below the surface, but for the user, that's it.
    - szasamasa 3y ago
      good point pass manager is needed and that is one of the key differences it is good but also a challenge for some people, especially if the 3 bigs cannot sync because normal people without pass manager begin to use Apple, Google, Microsoft pass management... if they have all 3 devices, all of them... what I do not understand, what the heck is the goal, one passkey per service and total sync or a domain (server) has to create and manage 4 passkeys for 4 operating system providers if user does not use a total syncing pass manager? that is the problem since those who use pass managers are normally ok but those who dont, and wont register/trust/pay for one, begin to use A/G/M/L pass managers and 4 pass manager accounts must be secured? and then you begin creating 4 passkeys for each website?
    - UncleMeat 3y ago
      It's even better than that. They don't give any secret data to the service you are using.
wheybags 3y ago
> My bank only supports SMS 2FA so while I'm travelling I'm effectively cut off from certain functionality EU citizen here. Do you... not have roaming?
- 4ad 3y ago
  International SMS delivery is unreliable. Unreliable is not strong enough word. It more often doesn't work that it does. Or it works with enough of a delay to cause a timeout on the site where you want to login. Plus, you know, SMS hijacking and all that.
  - coldtea 3y ago
    Where do you travel? Because I've gotten international text in dozens of countries in different continents with no problem. Delays I've seen (but also sometimes I also see them in my home country). Usually trying 1-2 times more it gets in time.
    - izacus 3y ago
      It's nice that you were lucky enough for it to work reliably, but it's not a universal experience.
      - coldtea 3y ago
        Sure, hence the question
  - kwhitefoot 3y ago
    Works fine in Europe in my recent experience. It was pretty poor fifteen years ago.
- madeofpalk 3y ago
  Maybe not! And?
- qot 3y ago
  In the EU I get an EU cell plan because it's orders of magnitude cheaper than roaming from North America when travelling for a month. So to log into my bank I have to load the website on my device, enter my username / password, have it send the SMS 2FA, switch to my home SIM card, wait to receive the text message, switch back to my EU SIM card, ensure internet works, then submit the 2FA code to finally log in. That assumes I haven't forgotten something to poke the SIM card out with. I couldn't find eSIM last time I went to Portugal.
stevage 3y ago
I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.
- k8sToGo 3y ago
  Of course you despise it. Security always comes at the cost of convenience.
  - Cupprum 3y ago
    Security is inconvenience, therefore the role of security is to find where is the limit. Because afterwards users will start to search for shortcuts, which usually makes the systems even less secure.
  - stevage 3y ago
    I don't despise all inconvenient things. I don't mind carrying house keys. It's just a question of whether you value the security enough to make it worthwhile.
    - NoZebra120vClip 3y ago
      > I don't mind carrying house keys. House keys are a minimal inconvenience because the lock on your front door also affords minimal security. Just ask the Lock Picking Lawyer how long it would take a determined intruder to get into your home, whether by picking, force, or finding a weakness such as open window. If your home had high security, I can guarantee that you'd feel the inconvenience.
      - pclmulqdq 3y ago
        You can have a very secure facility that only uses a "house key"-style entry flow for the user. The key will look really weird (see Medeco and Evva for examples) and the building will have some design compromises - few entry points, no openable windows, etc. A password, in theory, could work the same way. Except that the normal password UX involves people remembering the password, which entails a huge security compromise.
crooked-v 3y ago
What I find more annoying is the aggressive insistence of bigcorps to do everything possible with 2FA except actually just use the damn 2FA code I already have set up in my password manager. SMS, emails, pushing codes to random devices I'm logged in on, whatever.
- mixmastamyk 3y ago
  I recently got a pair of yubikeys… they have been around about ten years already and support industry standards. Guess how many services I use support them? A smaller fraction than I’d like.
  - Joker_vD 3y ago
    I always find it funny that a thing can be an "industry standard" even if nobody supports it.
    - redog 3y ago
      The industry of dreams. Build it and they will ComeAsAService
      - connordoner 3y ago
        > ComeAsAService I’m sure there’s a joke in here to be made about dating apps.
        red-iron-pine 3y ago
        Not dating apps, but close...
  - kedean 3y ago
    My employer had a program where you could put in a request and get a free yubikey. Turns out they basically only work with Chrome (no Firefox, no terminal-based auth), so none of my team actually ever uses theirs because it's not really more convenient.
figbert 3y ago
The argument that passwords are acceptable as long as everyone practices good "hygiene" strikes me as having many parallels with the argument that C code is memory safe as long as it is written properly. I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it.
- creshal 3y ago
  > I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it. It's a hard problem. I don't think passkeys really are the solution long term, they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately.
  - rjzzleep 3y ago
    Not really, to some extent some amount of collateral damage is necessary for a free and open society. I don't want to live in a nanny state that decides everything for me. But somehow the same people arguing for ultimate freedom and OSS are also arguing for centralization of passwords into corporate controlled infrastructure. I'm somewhat at a loss on how to argue on these issues. You want to hand over control over your key infrastructure to big tech and you want the average population to do that as well? Go ahead. Most people on iPhones already use sign in with Apple with apples 2FA system anyway it won't matter to them. But why encroach on me and force me to use it to protect me from myself?
    - ValleZ 3y ago
      Because users who lost account because of lack of 2FA usually require attention and support resources. It’s easier to require more security than to figure out if this is a legitimate user who is trying to get access.
    - madeofpalk 3y ago
      What part of Passkeys is "centralization of passwords into corporate controlled infrastructure"? "Big Tech" does not control Passkeys beyond the work on the underlying WebAuthn spec https://www.w3.org/TR/webauthn-2/ https://www.w3.org/TR/webauthn-2/, and that they develop implementations of that spec.
MrVandemar 3y ago
> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service. ChatGPT that everyone is spamming on every discussion? I can't even sign up for it (I'm not really bothered about that; it seems like a dangerous crutch than a useful technology). The problem is the developers have smartphones, their friends have smartphones, their bosses have smartphones and their clients have smartphones. Everyone they know have smartphones and live in places with reception. So they don't or can't imagine something different.
- ethanbond 3y ago
  If you use an authentication app instead of SMS 2FA (which you should anyway), you don’t need cell service. You can even have the authentication app on your laptop so you don’t need to switch devices (1Password at least supports this).
  - rationalist 3y ago
    Lots of services do not offer that ability, especially when signing up.
    - sdoering 3y ago
      I have never had a problem with Authy in that regard. Yeah, I share my 2fa with every device and defy the purpose. I know. But if you have access to any of my devices I sm already compromised.
      - ValleZ 3y ago
        You are not if you use 2FA.
    - ethanbond 3y ago
      Sure, I was just pointing out a clarification for GP since a lot of people aren’t actually aware that you can use 2FA without an internet-connected device. Maybe they already knew it, maybe not.
apetrovic 3y ago
> I guess the point I'm trying to make here is that the problem with passwords is password hygiene, not with the method itself. I guess the point I'm trying to make here is that the problem with obesity is just amount of food consumed, not the food itself.
matusp 3y ago
I used to control the passwords manually, but now I just rely on the Firefox password manager. I have it on my notebooks and in my smartphone, it syncs all the passwords, generates them and that's basically all I need. It completely abstracted the password handling away from me, and I have not types a password manually for quite some time. I hope that it's safe.
jmuguy 3y ago
I want whatever solution that my parents, wife and coworkers will actually use so I don’t have to help them. I try to explain that if they’d just commit to using a password manager, they just won’t have to think about it anymore, but it’s like pulling teeth. I’m sure one day we’ll have some sort of standard that replaces passwords (maybe it’ll be passkey) but until then I’m prepared for the continued death by a thousand cuts of password related IT.
a-dub 3y ago
passwords are not fine. my user agent should do otp on my behalf with clean, hassle free and reliable ux. my secrets should auto-rotate on a regular schedule and i should be able to force a rotation at any time in the event of a compromise. the existence of a relationship between myself and any party i wish to authenticate with, or knowledge of authentication events shall remain private between myself and that party exclusively. in the event of a catastrophic loss of control over my digital identity, i should be able to work with a partner to quickly prove my physical identity and regain access to my digital one.
- szasamasa 3y ago
  so your concrete suggestion?
vgchh 3y ago
For a layperson, the passwords are easy to understand and provide enough ways to shoot themselves in the foot. Unless you are an expert, password hygiene can rarely be accomplished. For a layperson, passkeys are difficult to understand, but provide out-of-the-box hygiene and security. Passwords are not fine. What we need is better explanation/education of passkeys.
- CaptainFever 3y ago
  > Unless you are an expert, password hygiene can rarely be accomplished. Why? Aren’t built-in password managers such as iCloud Keychain (which also auto-generates secure passwords) enough?
  - UncleMeat 3y ago
    The key advantage of passkeys is phishing immunity.
pndy 3y ago
> 2. People don't have their phone on them all the time (and some don't even have a smartphone). Even if people have their phones all the time there's always a possibility that components on the device might suddenly fail. The charging port in my iPhone stopped working on one May morning and thus device died. I temporarily lost access to most of the apps incl. 2FA code generators for about a month. Luckily one of service centers was able to find component and replace it cheaply.
stavros 3y ago
I guess it's the time of the week to post my "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misconceptions/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco... To answer the article's points: > While the tech is great, the problem is that nothing supports these new-fangled methods of authentication. Should we never switch to anything else, then, because nothing will support it until everything does? > Multi-devicing for authentication is a poor user experience. Even having to go click a link in your mailbox sucks. WebAuthn doesn't require multi-devicing. > People don't have their phone on them all the time (and some don't even have a smartphone). WebAuthn doesn't require a phone. > New users don't understand these methods of authentication. New users don't understand how to safely use passwords either. If we're going with max usability, we might as well get rid of passwords and just use usernames for authentication. Otherwise, we should compare like to like, and the usability of passwords is not worth how insecure they are. > They're generally much more complicated to implement than a basic email/password combo. Yes, it's much easier to implement something insecure than something secure. This sentence is disingenuously omitting all the impossibility around actually making passwords secure, ie using a different password for each site, 2FA, password length restrictions, etc. When it comes down to it, Passkeys are orders of magnitudes more secure for a small usability cost over completely insecure passwords. To say anything else is hostile to security.
_8j50 3y ago
This is also something I feel strongly about. I absolutley disdain any product or vendor that promotes "passwordless" (like bitwarden!). For typical web auth, you can't do better than passphrase+FIDO2. Device secrer only methods like passkeys and anything biometric+tpm without non-pin knowledge factor if auth are cancer. Skip thid bandwagon if you can help it.
cool-RR 3y ago
On many Israeli sites, like insurance providers and credit cards, 2FA texts are used for authentication without a password. i.e. instead of typing in a password, you type in your phone number and then type the 6-number code you got as an SMS message to your phone. I hate it so much.
BjoernKW 3y ago
What I find increasingly annoying is third parties (i.e. those whose primary service isn't to provide authentication or MFA, specifically) trying to route me through their mobile apps for a second factor. For example, GitHub and Google (via their Gmail mobile app) are constantly nagging me to open their apps for certain actions such as modifying security settings on a GitHub repository or even just logging in to Google Workspace. While certainly more secure than SMS, I'd like to use an authenticator app of my own choosing for that process (e.g., 1Password or Authy). While that's still possible, UX-wise that requires an additional step and possibly also brings about the risk of being flagged by some internal fraud detection system. To me, this feels like they're trying to promote their apps and increase user retention and interaction by means of what superficially looks like a beneficial security feature.
- hpb42 3y ago
  I use 2FA for GitHub with KeePassXC, on my desktop. I don't have a GitHub app on my phone. You can setup a TOTP app for GitHub without their mobile app.
hipokampa 3y ago
With a password manager you're putting all the eggs in the same basked. Why I'm I the only one who see this? More analyticalally: the probability_of_an_account_getting_hacked times damage is constant. More unrelated accounts you have, hack more probable, less damage on a single hack. With one password manager account, everything you have is at stake. There is no way around it. You can't manage this risk.
- UncleMeat 3y ago
  You are not the only one that sees this. Everybody sees this. But we can compare things. People who don't use a password manager observably reuse passwords and use weak passwords. In huge quantity. People who use passwords managers do not reuse passwords or use weak passwords at anything resembling this scale. Thefts of password vaults appear to be rare and it is much much easier to train people to use one good password for their vault, meaning that even with something like the LastPass breach, many people can be will protected. Yes, if you are a unicorn and can happily generate and recall 100+ strong and unique passwords for your various services then a password manager reduces your security posture. But almost nobody does this. Password managers also provide some small resistance to phishing, since they can help you notice a page that doesn't match the origin used to register a password.
madeofpalk 3y ago
I think this article misses the mark in a pretty big way. It starts off by saying the problem with WebAuthn is lack of widespread support, which is fair now, but not a fundamental unsolvable problem. WebAuthn/Passkeys are pretty new - essentially less than 12 months old (since iOS 16 GA). Google.com added support this year, and Apple.com is adding support this year. iOS 17 adds support to the system frameworks to let third party apps (like 1Password) store and sync Passkeys. But my biggest objection is with saying all problems of passwords are "solved by fairly simple password hygiene". Apart from the "if everyone just did the correct thing we wouldn't have any problems" declaration, IMHO the main advantage of Passkeys is that they eliminate phishing as a possibility due to the public/private key cryptography. Passkeys just entirely eliminate classes of problems with passwords by shifting the burden of security from the user to the tech itself. I remain skeptical that Passkeys will end up with widespread support, and I think it's too early to tell how it'll go, but all signs are pretty promising. I hope Passkeys work out.
sufehmi 3y ago
"I guess the point I'm trying to make here is that the problem with passwords is password hygiene, not with the method itself" Clearly this guy has never got his password sniffed before, or even heard about it. It's always painful to see someone who doesn't understand something talking about it, and worse, badmouthing it. And, "Notice that all of these problems are solved by fairly simple password hygiene" Clearly this guy has never heard about various fiascos of various password manager software. ===== Passkey doesn't need you connected to the internet. Google Auth too. Actually weak password is fine, when you have 2FA. I have some accounts which has weak password, some even already in haveibeenpwned; but no problem for years because it got 2FA as well. Password alone without 2FA is okay, as long you can ensure no malware/keylogger enter your system. Which is a risk. Forcing your users to change their password routinely is bad policy, it motivates your users to use weak password and/or store it insecurely, and other unexpected behaviours. SMS 2FS sucks because it can be intercepted and/or snooped - no, this is not just a theory, this happens rather routinely in my country. Etc etc
- janfromdaito 3y ago
  Can you please elaborate on SMS 2FA being intercepted or snooped? (Disclosure: working on a product to prevent exactly that and really curious to hear about those hijacking cases.)
- LightHugger 3y ago
  It doesn't sound like you actually use 2FA, it sounds like you use 1FA plus a formality-password, where the "second factor" is the only one that matters. so it's 1FA.
a_imho 3y ago
Why not just let everyone use their preferred method for authentication and not forcing a particular doing-it-the-right-way on people? Also, how many accounts and passwords people tend to have which are pets rather than cattle? Bank and email can cause major headaches and probably everyone has 1-2 more accounts which they value and would cause significant setbacks if compromised. Passwords are plenty fine.
snowstormsun 3y ago
Password Phishing is a problem. WebAuthn solves that problem.
ozim 3y ago
Basically I agree with the article. For me it works basically the same way. But then you get all people who don’t care or are so technically inept that at first occasion will lock themselves out of password manager. As myself and as a user I could use passwords, no problem. As a service provider that is entirely different ball game. If I could skip sending out emails or smses it will be cheaper to have web authn, then not having to store passwords only public keys is such a great thing. In the end if webauthn takes over as end user I will never have to see login screen ever again. I would beet to register once and then maybe rotate key once in a while.
sholladay 3y ago
Support for passwordless flows via WebAuth was only added to browsers very recently. And it was only with the introduction of Passkeys that the user experience became good enough for regular people to use. Now the keys will auto-sync between devices and can be shared with other people via Bluetooth, etc. It’s too early to say it won’t be well understood or adopted. > Multi-devicing for authentication is a poor user experience. Even having to go click a link in your mailbox sucks. Agreed. Passkeys reduce this friction quite a bit since you won’t need to multi-device if you’re already signed in to your platform account. But if you’re borrowing someone else’s computer, then yeah you need to get a key from another device that already has it. If this use case happens to you a lot, I would recommend using a USB security key to store your credentials. > People don't have their phone on them all the time (and some don't even have a smartphone). WebAuthn doesn’t require a phone. It only requires you to be using or have handy some device that holds your keys. It can be a laptop or a USB security key. Again, I would recommend a USB security key for people who don’t own a phone or computer. These things are cheap enough for charities to give them out in large numbers and small enough to go anywhere. Keep one on your keychain. If that’s still too much of a problem, then keep your keys in your platform account and see if you can temporarily sign in to your platform account on the device where you are a guest. Just be sure to sign out afterward. > New users don't understand these methods of authentication. An old dog can learn new tricks, but it takes time. We’re in a phase where most of the writing on this topic is geared towards developers. That will change. A lot of people seem to prefer native UIs to web based UIs and WebAuthn makes a large part of the sign in process native, so maybe people will find it easier. I certainly do with the implementations I’ve built, though that may be a given. > They're generally much more complicated to implement than a basic email/password combo. Agreed and I think this is mostly the fault of the spec. For example, some of the data the client and server have to send to each other can’t be easily serialized to JSON and for some reason, apparently no one thought that was a problem. There are some ways to do it but they are hacky and the auth libraries barely even paper over this problem. Also, the spec wants a signature counter to be implemented to prevent replay attacks. But Apple’s implementation of Passkeys always reports 0 for the signature count, which I think may be to preserve privacy. I don’t particularly like having to store the signature count either, nor does it seem like a reliable detection method, so Apple’s approach seems ok to me. But then how do I prevent replay attacks? There’s very little information on this subject, let alone guidance on how to handle it. There’s lots of jargon in the spec that you have to memorize and the libraries that exist today tend to embrace the same jargon. I think a lot of these wrinkles will be ironed out in time. The momentum is clearly there and the tech has gotten to a point where you can build some really low friction sign in flows. You may bang your head against the wall dealing with some of the wrinkles I mentioned, but the end result can be great. One of my favorite features is that you can build the sign in flow in such a way where the native UI presents the accounts that are available. That means not only does the user not need to type a password, but they don’t need to type their email either. Literally no more typos possible, even for people who don’t use autofill.
botanical 3y ago
I just "lost access" to passkeys.io while trying out passkeys. My phones Bluetooth was switched off, and by the time my phone created and saved a passkey, it timed out on the computer. So now I can't login with that passkey and it only fails. Seems like I'm locked out now...
RamenJunkie_ 3y ago
I like 2FA with an app, not so much SMS. I really hate all these other trends I keep seeing. Log ins only using Magic Links in emails, which is an ENORMOUS pain in the ass, and now I often have to log in to another service as well. Or this weird thing sites are doing lately, where the log in page just asks for a username, then loads a second page with the password box. Like WTF is that even accomplishing besides sometimes confusing my password manager. Why do we need this weird intermediate step at all?
- avh02 3y ago
  this is very often so the service can choose if you have a regular password or need to be redirected to an external SSO service (though i guess it's not the only case) (not that i like it.)
hashstring 3y ago
They missed the point that users with passwords are often extremely prone to phishing; especially with certain popular MiTM frameworks. We have the technology available to combat that, so, please yes, let’s move away from open sesame authentication.
NoPicklez 3y ago
Strange article I must admit. They describe common pitfalls as: 1. People don't have their phone on them all the time (some don't have a smartphone) 2. New users don't understand these methods of authentication 3. General much more complicated than a basic email/password combo However, recommendations were to use Apple's authentication methods that are not device manufacturer agnostic, download and use a password manager (complicated) or use 2FA apps. All of these require a smartphone and are additional methods of authentication. Overall, you need MFA and try not to use SMS MFA.

129 points by kevincox 3y ago

Of course passwords are fine. What's not fine is getting billions of people to change their behavior and switch to and use a password manager (that's not chrome). You could even argue passwords are better than passkeys for those with strong password hygiene. However when it to the masses, the convenience-security tradeoff of something like passkeys is always going to be better. And for the nerds and geeks, passwords are not going to disappear anytime soon.

foobarbecue 3y ago
Why not chrome?
- cj 3y ago
  This isn't a great answer, but I've never liked Chrome password manager because I feel like a password manager is something I want to pay a company for, not a service I want to be given for free. Somehow, it being a free feature that's bundled with my browser makes me not trust it. (Again, not claiming this is a great reason not to use it)
  - Arch-TK 3y ago
    Weird. I use pass as my password manager on all my Linux boxes (with a yubikey to store GPG keys and Password Store + OpenKeychain on android). I basically refuse to use any password manager with an implementation I can't see or audit. I can't imagine trusting any company to handle my passwords correctly. The only proprietary component is the yubikey which is basically incapable of misbehaving in a way which would cause me to lose control over my passwords unless I lose control over the yubikey itself.
    - chkaloon 3y ago
      Did you actually look at it and audit it? >99% of people aren't going to do that. They're just assuming somebody has.
      - nordsieck 3y ago
        > Did you actually look at it and audit it? >99% of people aren't going to do that. They're just assuming somebody has. That's a fair point. I certainly haven't. But the great virtue of pass is that it runs locally, which means that it's much more difficult to attack than a SaS password manager.
      - worksonmine 3y ago
        I have, pass is just a bash script with <1000 loc.
      - Arch-TK 3y ago
        Yes, pass is 800 lines of relatively straightforward bash and I am qualified to review bash. Now, granted, it uses GnuPG and git but in those cases I think the risk of problems is minimal. I haven’t in all honesty read the Password Store android application (nor OpenKeychain) source code but I trust my phone sandbox capabilities enough for it not to do anything nefarious like send my passwords somewhere. Its also not so large that it would be hard to read it. The point is, the operating principles behind how Pass works are simple enough that its relatively easy to verify the core of any implentation and relatively difficult to smuggle in nefarious behavior.
    - ValleZ 3y ago
      How do you know that the product you use was built from the provided sources?
      - nordsieck 3y ago
        > How do you know that the product you use was built from the provided sources? Maybe you haven't heard of pass[1], but it's an open source project, and it's easy to build from source[2]. --- 1. https://www.passwordstore.org/ https://www.passwordstore.org/ 2. https://git.zx2c4.com/password-store/ https://git.zx2c4.com/password-store/
- dspillett 3y ago
  Not sure if it is what the GPP is referring to, but I prefer to keep a larger gap between my browser and password manager to reduce the potential spread of difficulties if the browser falls foul of a security vulnerability. The risk of this happening is of course small, it would require significant bugs in a couple of different places, but the potential damage is high. Firefox's password manager, or those built into any other web UAs, I'd be wary of for the same reason rather than it being specifically an anti-chrome thing. An air gap would be preferable still, as that would protect from similar issues at the OS level, but that is another step or few into less practical (well, significantly more inconvenient) territory. I at least have my master password on a USB device (and backed up by other physical means in case that dies) which is only plugged in when needed, that is effectively an air gap when I don't leave the password manager unlocked between uses.
- noirscape 3y ago
  Not the parent but the problem is that Chrome (sub. Firefox and Safari, these are problems with pretty much all browsers) isn't a password manager, its a password autofiller. The result is that what should be crucial things like "how do we ensure permanency of the passwords file" are treated as very second rank - profile corruption usually is met with "remove the entire profile", which also ditches the password database. Literally every other password manager has some sort of tool available that makes it very clear where your data is stored and emergency backup options. Chrome also doesn't like it if the login form doesn't look like most other login forms (and because this is the internet, you're gonna at some point run into weird login forms). It also can behave really funny if the site combines the user registration form with the user login form (which a lot of webshops do) by putting the autofill information in the registration form instead of the login form. Add to that a very subpar experience in manually filling the right fields and "why not Chrome" should have a very clear answer.
  - foobarbecue 3y ago
    It's a full-featured password manager, accessible via passwords.google.com . Also has great android app integration. I use it on Android, Linux, and Windows. The only thing it's missing is the marketing; I often wonder why they don't market it and crush 1password et al.

jlmb 3y ago

“Passwords are fine” only in a theoretical world where everyone uses passwords “correctly” and securely. But in the real world people don’t, so passkeys are a much better and easier method. I fail to understand how educating billions (?) of people about proper password hygiene is faster or simpler than moving all authentication to a “tap this button to magically log in” method.

hulitu 3y ago
> so passkeys are a much better and easier method. I'm old. What's the difference between a pass word and a pass key ? > tap this button to magically log in” method. And how exactly is "this button" authenticated ?
- wasmitnetzen 3y ago
  Passkeys are basically enforced password managers with random passwords. There's some more complexity below the surface, but for the user, that's it.
  - szasamasa 3y ago
    good point pass manager is needed and that is one of the key differences it is good but also a challenge for some people, especially if the 3 bigs cannot sync because normal people without pass manager begin to use Apple, Google, Microsoft pass management... if they have all 3 devices, all of them... what I do not understand, what the heck is the goal, one passkey per service and total sync or a domain (server) has to create and manage 4 passkeys for 4 operating system providers if user does not use a total syncing pass manager? that is the problem since those who use pass managers are normally ok but those who dont, and wont register/trust/pay for one, begin to use A/G/M/L pass managers and 4 pass manager accounts must be secured? and then you begin creating 4 passkeys for each website?
  - UncleMeat 3y ago
    It's even better than that. They don't give any secret data to the service you are using.

wheybags 3y ago

> My bank only supports SMS 2FA so while I'm travelling I'm effectively cut off from certain functionality EU citizen here. Do you... not have roaming?

4ad 3y ago
International SMS delivery is unreliable. Unreliable is not strong enough word. It more often doesn't work that it does. Or it works with enough of a delay to cause a timeout on the site where you want to login. Plus, you know, SMS hijacking and all that.
- coldtea 3y ago
  Where do you travel? Because I've gotten international text in dozens of countries in different continents with no problem. Delays I've seen (but also sometimes I also see them in my home country). Usually trying 1-2 times more it gets in time.
  - izacus 3y ago
    It's nice that you were lucky enough for it to work reliably, but it's not a universal experience.
    - coldtea 3y ago
      Sure, hence the question
- kwhitefoot 3y ago
  Works fine in Europe in my recent experience. It was pretty poor fifteen years ago.
madeofpalk 3y ago
Maybe not! And?
qot 3y ago
In the EU I get an EU cell plan because it's orders of magnitude cheaper than roaming from North America when travelling for a month. So to log into my bank I have to load the website on my device, enter my username / password, have it send the SMS 2FA, switch to my home SIM card, wait to receive the text message, switch back to my EU SIM card, ensure internet works, then submit the 2FA code to finally log in. That assumes I haven't forgotten something to poke the SIM card out with. I couldn't find eSIM last time I went to Portugal.

stevage 3y ago

I'm glad they said it. As a user I just despise MFA. I hate having to keep my phone with me while I work. I hate the disruption in flow logging into everyday services like AWS. Passwords are so much better.

k8sToGo 3y ago
Of course you despise it. Security always comes at the cost of convenience.
- Cupprum 3y ago
  Security is inconvenience, therefore the role of security is to find where is the limit. Because afterwards users will start to search for shortcuts, which usually makes the systems even less secure.
- stevage 3y ago
  I don't despise all inconvenient things. I don't mind carrying house keys. It's just a question of whether you value the security enough to make it worthwhile.
  - NoZebra120vClip 3y ago
    > I don't mind carrying house keys. House keys are a minimal inconvenience because the lock on your front door also affords minimal security. Just ask the Lock Picking Lawyer how long it would take a determined intruder to get into your home, whether by picking, force, or finding a weakness such as open window. If your home had high security, I can guarantee that you'd feel the inconvenience.
    - pclmulqdq 3y ago
      You can have a very secure facility that only uses a "house key"-style entry flow for the user. The key will look really weird (see Medeco and Evva for examples) and the building will have some design compromises - few entry points, no openable windows, etc. A password, in theory, could work the same way. Except that the normal password UX involves people remembering the password, which entails a huge security compromise.

crooked-v 3y ago

What I find more annoying is the aggressive insistence of bigcorps to do everything possible with 2FA except actually just use the damn 2FA code I already have set up in my password manager. SMS, emails, pushing codes to random devices I'm logged in on, whatever.

mixmastamyk 3y ago
I recently got a pair of yubikeys… they have been around about ten years already and support industry standards. Guess how many services I use support them? A smaller fraction than I’d like.
- Joker_vD 3y ago
  I always find it funny that a thing can be an "industry standard" even if nobody supports it.
  - redog 3y ago
    The industry of dreams. Build it and they will ComeAsAService
    - connordoner 3y ago
      > ComeAsAService I’m sure there’s a joke in here to be made about dating apps.
      - red-iron-pine 3y ago
        Not dating apps, but close...
- kedean 3y ago
  My employer had a program where you could put in a request and get a free yubikey. Turns out they basically only work with Chrome (no Firefox, no terminal-based auth), so none of my team actually ever uses theirs because it's not really more convenient.

figbert 3y ago

The argument that passwords are acceptable as long as everyone practices good "hygiene" strikes me as having many parallels with the argument that C code is memory safe as long as it is written properly. I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it.

creshal 3y ago
> I'd rather just have memory safety built in to the language I'm using—I'm not sure exactly what the equivalent is for passwords, but I don't think I would oppose it. It's a hard problem. I don't think passkeys really are the solution long term, they just sweep the problem under a corporate rug and ignore that people will still use them inappropriately.
- rjzzleep 3y ago
  Not really, to some extent some amount of collateral damage is necessary for a free and open society. I don't want to live in a nanny state that decides everything for me. But somehow the same people arguing for ultimate freedom and OSS are also arguing for centralization of passwords into corporate controlled infrastructure. I'm somewhat at a loss on how to argue on these issues. You want to hand over control over your key infrastructure to big tech and you want the average population to do that as well? Go ahead. Most people on iPhones already use sign in with Apple with apples 2FA system anyway it won't matter to them. But why encroach on me and force me to use it to protect me from myself?
  - ValleZ 3y ago
    Because users who lost account because of lack of 2FA usually require attention and support resources. It’s easier to require more security than to figure out if this is a legitimate user who is trying to get access.
  - madeofpalk 3y ago
    What part of Passkeys is "centralization of passwords into corporate controlled infrastructure"? "Big Tech" does not control Passkeys beyond the work on the underlying WebAuthn spec https://www.w3.org/TR/webauthn-2/ https://www.w3.org/TR/webauthn-2/, and that they develop implementations of that spec.

MrVandemar 3y ago

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). I live in rural Western Australia with almost zero phone coverage, and this is a huge problem. I'm terrified of all these services wanting my phone number, or bugging me to turn on phone 2FA, because the moment that happens, I lose access to that service. ChatGPT that everyone is spamming on every discussion? I can't even sign up for it (I'm not really bothered about that; it seems like a dangerous crutch than a useful technology). The problem is the developers have smartphones, their friends have smartphones, their bosses have smartphones and their clients have smartphones. Everyone they know have smartphones and live in places with reception. So they don't or can't imagine something different.

ethanbond 3y ago
If you use an authentication app instead of SMS 2FA (which you should anyway), you don’t need cell service. You can even have the authentication app on your laptop so you don’t need to switch devices (1Password at least supports this).
- rationalist 3y ago
  Lots of services do not offer that ability, especially when signing up.
  - sdoering 3y ago
    I have never had a problem with Authy in that regard. Yeah, I share my 2fa with every device and defy the purpose. I know. But if you have access to any of my devices I sm already compromised.
    - ValleZ 3y ago
      You are not if you use 2FA.
  - ethanbond 3y ago
    Sure, I was just pointing out a clarification for GP since a lot of people aren’t actually aware that you can use 2FA without an internet-connected device. Maybe they already knew it, maybe not.

apetrovic 3y ago

> I guess the point I'm trying to make here is that the problem with passwords is password hygiene, not with the method itself. I guess the point I'm trying to make here is that the problem with obesity is just amount of food consumed, not the food itself.

matusp 3y ago

I used to control the passwords manually, but now I just rely on the Firefox password manager. I have it on my notebooks and in my smartphone, it syncs all the passwords, generates them and that's basically all I need. It completely abstracted the password handling away from me, and I have not types a password manually for quite some time. I hope that it's safe.

jmuguy 3y ago

I want whatever solution that my parents, wife and coworkers will actually use so I don’t have to help them. I try to explain that if they’d just commit to using a password manager, they just won’t have to think about it anymore, but it’s like pulling teeth. I’m sure one day we’ll have some sort of standard that replaces passwords (maybe it’ll be passkey) but until then I’m prepared for the continued death by a thousand cuts of password related IT.

a-dub 3y ago

passwords are not fine. my user agent should do otp on my behalf with clean, hassle free and reliable ux. my secrets should auto-rotate on a regular schedule and i should be able to force a rotation at any time in the event of a compromise. the existence of a relationship between myself and any party i wish to authenticate with, or knowledge of authentication events shall remain private between myself and that party exclusively. in the event of a catastrophic loss of control over my digital identity, i should be able to work with a partner to quickly prove my physical identity and regain access to my digital one.

szasamasa 3y ago
so your concrete suggestion?

vgchh 3y ago

For a layperson, the passwords are easy to understand and provide enough ways to shoot themselves in the foot. Unless you are an expert, password hygiene can rarely be accomplished. For a layperson, passkeys are difficult to understand, but provide out-of-the-box hygiene and security. Passwords are not fine. What we need is better explanation/education of passkeys.

CaptainFever 3y ago
> Unless you are an expert, password hygiene can rarely be accomplished. Why? Aren’t built-in password managers such as iCloud Keychain (which also auto-generates secure passwords) enough?
- UncleMeat 3y ago
  The key advantage of passkeys is phishing immunity.

pndy 3y ago

> 2. People don't have their phone on them all the time (and some don't even have a smartphone). Even if people have their phones all the time there's always a possibility that components on the device might suddenly fail. The charging port in my iPhone stopped working on one May morning and thus device died. I temporarily lost access to most of the apps incl. 2FA code generators for about a month. Luckily one of service centers was able to find component and replace it cheaply.

stavros 3y ago

I guess it's the time of the week to post my "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misconceptions/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco... To answer the article's points: > While the tech is great, the problem is that nothing supports these new-fangled methods of authentication. Should we never switch to anything else, then, because nothing will support it until everything does? > Multi-devicing for authentication is a poor user experience. Even having to go click a link in your mailbox sucks. WebAuthn doesn't require multi-devicing. > People don't have their phone on them all the time (and some don't even have a smartphone). WebAuthn doesn't require a phone. > New users don't understand these methods of authentication. New users don't understand how to safely use passwords either. If we're going with max usability, we might as well get rid of passwords and just use usernames for authentication. Otherwise, we should compare like to like, and the usability of passwords is not worth how insecure they are. > They're generally much more complicated to implement than a basic email/password combo. Yes, it's much easier to implement something insecure than something secure. This sentence is disingenuously omitting all the impossibility around actually making passwords secure, ie using a different password for each site, 2FA, password length restrictions, etc. When it comes down to it, Passkeys are orders of magnitudes more secure for a small usability cost over completely insecure passwords. To say anything else is hostile to security.

_8j50 3y ago

This is also something I feel strongly about. I absolutley disdain any product or vendor that promotes "passwordless" (like bitwarden!). For typical web auth, you can't do better than passphrase+FIDO2. Device secrer only methods like passkeys and anything biometric+tpm without non-pin knowledge factor if auth are cancer. Skip thid bandwagon if you can help it.

cool-RR 3y ago

On many Israeli sites, like insurance providers and credit cards, 2FA texts are used for authentication without a password. i.e. instead of typing in a password, you type in your phone number and then type the 6-number code you got as an SMS message to your phone. I hate it so much.

BjoernKW 3y ago

What I find increasingly annoying is third parties (i.e. those whose primary service isn't to provide authentication or MFA, specifically) trying to route me through their mobile apps for a second factor. For example, GitHub and Google (via their Gmail mobile app) are constantly nagging me to open their apps for certain actions such as modifying security settings on a GitHub repository or even just logging in to Google Workspace. While certainly more secure than SMS, I'd like to use an authenticator app of my own choosing for that process (e.g., 1Password or Authy). While that's still possible, UX-wise that requires an additional step and possibly also brings about the risk of being flagged by some internal fraud detection system. To me, this feels like they're trying to promote their apps and increase user retention and interaction by means of what superficially looks like a beneficial security feature.

hpb42 3y ago
I use 2FA for GitHub with KeePassXC, on my desktop. I don't have a GitHub app on my phone. You can setup a TOTP app for GitHub without their mobile app.

hipokampa 3y ago

With a password manager you're putting all the eggs in the same basked. Why I'm I the only one who see this? More analyticalally: the probability_of_an_account_getting_hacked times damage is constant. More unrelated accounts you have, hack more probable, less damage on a single hack. With one password manager account, everything you have is at stake. There is no way around it. You can't manage this risk.

UncleMeat 3y ago
You are not the only one that sees this. Everybody sees this. But we can compare things. People who don't use a password manager observably reuse passwords and use weak passwords. In huge quantity. People who use passwords managers do not reuse passwords or use weak passwords at anything resembling this scale. Thefts of password vaults appear to be rare and it is much much easier to train people to use one good password for their vault, meaning that even with something like the LastPass breach, many people can be will protected. Yes, if you are a unicorn and can happily generate and recall 100+ strong and unique passwords for your various services then a password manager reduces your security posture. But almost nobody does this. Password managers also provide some small resistance to phishing, since they can help you notice a page that doesn't match the origin used to register a password.

madeofpalk 3y ago

I think this article misses the mark in a pretty big way. It starts off by saying the problem with WebAuthn is lack of widespread support, which is fair now, but not a fundamental unsolvable problem. WebAuthn/Passkeys are pretty new - essentially less than 12 months old (since iOS 16 GA). Google.com added support this year, and Apple.com is adding support this year. iOS 17 adds support to the system frameworks to let third party apps (like 1Password) store and sync Passkeys. But my biggest objection is with saying all problems of passwords are "solved by fairly simple password hygiene". Apart from the "if everyone just did the correct thing we wouldn't have any problems" declaration, IMHO the main advantage of Passkeys is that they eliminate phishing as a possibility due to the public/private key cryptography. Passkeys just entirely eliminate classes of problems with passwords by shifting the burden of security from the user to the tech itself. I remain skeptical that Passkeys will end up with widespread support, and I think it's too early to tell how it'll go, but all signs are pretty promising. I hope Passkeys work out.

sufehmi 3y ago

"I guess the point I'm trying to make here is that the problem with passwords is password hygiene, not with the method itself" Clearly this guy has never got his password sniffed before, or even heard about it. It's always painful to see someone who doesn't understand something talking about it, and worse, badmouthing it. And, "Notice that all of these problems are solved by fairly simple password hygiene" Clearly this guy has never heard about various fiascos of various password manager software. ===== Passkey doesn't need you connected to the internet. Google Auth too. Actually weak password is fine, when you have 2FA. I have some accounts which has weak password, some even already in haveibeenpwned; but no problem for years because it got 2FA as well. Password alone without 2FA is okay, as long you can ensure no malware/keylogger enter your system. Which is a risk. Forcing your users to change their password routinely is bad policy, it motivates your users to use weak password and/or store it insecurely, and other unexpected behaviours. SMS 2FS sucks because it can be intercepted and/or snooped - no, this is not just a theory, this happens rather routinely in my country. Etc etc

janfromdaito 3y ago
Can you please elaborate on SMS 2FA being intercepted or snooped? (Disclosure: working on a product to prevent exactly that and really curious to hear about those hijacking cases.)
LightHugger 3y ago
It doesn't sound like you actually use 2FA, it sounds like you use 1FA plus a formality-password, where the "second factor" is the only one that matters. so it's 1FA.

a_imho 3y ago

Why not just let everyone use their preferred method for authentication and not forcing a particular doing-it-the-right-way on people? Also, how many accounts and passwords people tend to have which are pets rather than cattle? Bank and email can cause major headaches and probably everyone has 1-2 more accounts which they value and would cause significant setbacks if compromised. Passwords are plenty fine.

snowstormsun 3y ago

Password Phishing is a problem. WebAuthn solves that problem.

ozim 3y ago

Basically I agree with the article. For me it works basically the same way. But then you get all people who don’t care or are so technically inept that at first occasion will lock themselves out of password manager. As myself and as a user I could use passwords, no problem. As a service provider that is entirely different ball game. If I could skip sending out emails or smses it will be cheaper to have web authn, then not having to store passwords only public keys is such a great thing. In the end if webauthn takes over as end user I will never have to see login screen ever again. I would beet to register once and then maybe rotate key once in a while.

sholladay 3y ago

Support for passwordless flows via WebAuth was only added to browsers very recently. And it was only with the introduction of Passkeys that the user experience became good enough for regular people to use. Now the keys will auto-sync between devices and can be shared with other people via Bluetooth, etc. It’s too early to say it won’t be well understood or adopted. > Multi-devicing for authentication is a poor user experience. Even having to go click a link in your mailbox sucks. Agreed. Passkeys reduce this friction quite a bit since you won’t need to multi-device if you’re already signed in to your platform account. But if you’re borrowing someone else’s computer, then yeah you need to get a key from another device that already has it. If this use case happens to you a lot, I would recommend using a USB security key to store your credentials. > People don't have their phone on them all the time (and some don't even have a smartphone). WebAuthn doesn’t require a phone. It only requires you to be using or have handy some device that holds your keys. It can be a laptop or a USB security key. Again, I would recommend a USB security key for people who don’t own a phone or computer. These things are cheap enough for charities to give them out in large numbers and small enough to go anywhere. Keep one on your keychain. If that’s still too much of a problem, then keep your keys in your platform account and see if you can temporarily sign in to your platform account on the device where you are a guest. Just be sure to sign out afterward. > New users don't understand these methods of authentication. An old dog can learn new tricks, but it takes time. We’re in a phase where most of the writing on this topic is geared towards developers. That will change. A lot of people seem to prefer native UIs to web based UIs and WebAuthn makes a large part of the sign in process native, so maybe people will find it easier. I certainly do with the implementations I’ve built, though that may be a given. > They're generally much more complicated to implement than a basic email/password combo. Agreed and I think this is mostly the fault of the spec. For example, some of the data the client and server have to send to each other can’t be easily serialized to JSON and for some reason, apparently no one thought that was a problem. There are some ways to do it but they are hacky and the auth libraries barely even paper over this problem. Also, the spec wants a signature counter to be implemented to prevent replay attacks. But Apple’s implementation of Passkeys always reports 0 for the signature count, which I think may be to preserve privacy. I don’t particularly like having to store the signature count either, nor does it seem like a reliable detection method, so Apple’s approach seems ok to me. But then how do I prevent replay attacks? There’s very little information on this subject, let alone guidance on how to handle it. There’s lots of jargon in the spec that you have to memorize and the libraries that exist today tend to embrace the same jargon. I think a lot of these wrinkles will be ironed out in time. The momentum is clearly there and the tech has gotten to a point where you can build some really low friction sign in flows. You may bang your head against the wall dealing with some of the wrinkles I mentioned, but the end result can be great. One of my favorite features is that you can build the sign in flow in such a way where the native UI presents the accounts that are available. That means not only does the user not need to type a password, but they don’t need to type their email either. Literally no more typos possible, even for people who don’t use autofill.

botanical 3y ago

I just "lost access" to passkeys.io while trying out passkeys. My phones Bluetooth was switched off, and by the time my phone created and saved a passkey, it timed out on the computer. So now I can't login with that passkey and it only fails. Seems like I'm locked out now...

RamenJunkie_ 3y ago

I like 2FA with an app, not so much SMS. I really hate all these other trends I keep seeing. Log ins only using Magic Links in emails, which is an ENORMOUS pain in the ass, and now I often have to log in to another service as well. Or this weird thing sites are doing lately, where the log in page just asks for a username, then loads a second page with the password box. Like WTF is that even accomplishing besides sometimes confusing my password manager. Why do we need this weird intermediate step at all?

avh02 3y ago
this is very often so the service can choose if you have a regular password or need to be redirected to an external SSO service (though i guess it's not the only case) (not that i like it.)

hashstring 3y ago

They missed the point that users with passwords are often extremely prone to phishing; especially with certain popular MiTM frameworks. We have the technology available to combat that, so, please yes, let’s move away from open sesame authentication.

NoPicklez 3y ago

Strange article I must admit. They describe common pitfalls as: 1. People don't have their phone on them all the time (some don't have a smartphone) 2. New users don't understand these methods of authentication 3. General much more complicated than a basic email/password combo However, recommendations were to use Apple's authentication methods that are not device manufacturer agnostic, download and use a password manager (complicated) or use 2FA apps. All of these require a smartphone and are additional methods of authentication. Overall, you need MFA and try not to use SMS MFA.