4 ms·

I've said it before and I'll say it again (and yes let it rain downvotes): I don't understand this whole discussion and maligning of passwords. You cannot sav

I've said it before and I'll say it again (and yes let it rain downvotes): I don't understand this whole discussion and maligning of passwords. You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user once they replace their phone or it breaks or for any other mundane reason. User picked passwords (1FA) are and will always be the single best solution that has ever existed for authentication, considering everything from security to usability and practicality, wholistically. If I sign up for some crappy service that I'll barely even remember a week later I should be good to go setting my password to "asdf" and that's everything I need to log in. Fuck everything else. https://news.ycombinator.com/item?id=36717356 https://news.ycombinator.com/item?id=36717356

H8crilA 3y ago
I don't understand your point. Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The population there is hardly uneducated, yet they still had quite a few break-ins. Some of the companies have also nearly removed passwords, changing the minimum length requirement to something like 5 lowercase characters. They still experience a near zero, or zero, phishing success rates.
- jdthedisciple 3y ago
  Sure, you could even reduce phishing attack success rates to nearly 0% by having users authenticate with a sample of their DNA. Does that mean it's a great idea? What about losing the yubikey? In any case it's a different matter when it comes to high stake scenarios, in which case I don't mind something slightly more sophisticated. But not as the default for everything.
  - superkuh 3y ago
    >having users authenticate with a sample of their DNA. I know it's not your point and I agree with everything you're saying in this thread 100%, but DNA based login would be a username, not a password. Like all biometrics. And it'd have a really bad false positive rate if you're just doing restriction enzyme cut location tests like lots of "police work". A full exome scan ~$300-500/per might do it.
    - antonjs 3y ago
      And as you point out, the problem with biometrics is that once they're stolen or copied, there's no changing them. Particularly your DNA.
  - JCharante 3y ago
    > What about losing the yubikey? I have 5 yubikeys on multiple continents. If I lose one I can log in with the others and remove login access with the compromised yubikey.
    - xormapmap 3y ago
      > I have 5 yubikeys on multiple continents Are you actually retarded or just disingenuous? This is hardly a workable solution even for security nuts, let alone the average person.
- akira2501 3y ago
  > Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The actual question is: "Did they see an INCREASE in other types of attacks after using yubikeys?" To presume that these actors who were willing to go to some illegal lengths to get this information in the first place just "gave up" because "yubikeys exist" is a dangerous way to process these facts.
- ghusto 3y ago
  > Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? His point (my emphasis): > User picked passwords (1FA) are and will always be the single best solution that has ever existed for authentication, _considering everything from security to usability and practicality, wholistically_ So his point is that if you consider all aspects wholistically, including usability and practicality, passwords are the best solution. I'm not saying I agree, but a 100% reduction of successful phishing attacks after introducing Yubikeys only considers security, and not the other factors.
seabass-labrax 3y ago
You cannot save all people - too true. But remember that you, actually all of us, are indirectly the victim of other peoples' mistakes: - we lose contact with people because they get locked out of their email - we pay more in bank account fees to subsidise fraud compensation - we have our personal information stolen because others chose weak passwords Given how much we suffer from other peoples' poor choices, there is a huge incentive to somehow stop people from making poor choices. By analogy, we all benefit from fences by cliffs because the family of the unlucky soul who wandered off it, the emergency services and their funders all suffer too. If it weren't for values like personal freedom, aesthetics, financial cost and an apathy towards accidents, there would be no clifftop in the world without a fence by it.
- romwell 3y ago
  >- we lose contact with people because they get locked out of their email I've been locked out of my email because Google insists that "we don't recognize your device", and locked out of my other accounts because my phone was stolen, not because I didn't remember my password. People forgetting passwords isn't a problem that's solved with other schemes. It's a problem that's exacerbated by them. >- we pay more in bank account fees to subsidise fraud compensation Bank account fees, seriously? I can't remember the last time I've paid any. In any case, worrying about saving the banks a few bucks is dead last on my list of worries. >- we have our personal information stolen because others chose weak passwords If our info can be stolen because someone else chose a weak password, the weak password isn't the problem. It's the system that was badly designed in the first place. >Given how much we suffer from other peoples' poor choices,.. We don't. >By analogy, we all benefit from fences by cliffs The analogy doesn't hold because you have to first show that alternatives to passwords are better for the users, even those in the category you mention.
  - seabass-labrax 3y ago
    > People forgetting passwords isn't a problem that's solved with other schemes. Sorry, I should have clarified: that was in reference to users being unable to successfully use the parent's hypothetical 'terribly complex 5FA device-based passphrase scheme'. Passwords don't get any blame here. > Bank account fees, seriously? I can't remember the last time I've paid any. OK, fractionally lower interest growth then, or less frequent premium bond wins. In any case, the bank is going to find a way of passing the cost of business to you, so you have an indirect incentive for their business to be cheaper to them. > If our info can be stolen because someone else chose a weak password, the weak password isn't the problem. It's the system that was badly designed in the first place. That is correct for some kinds of personal information, like how storing documents on a 'cloud' without client-side encryption is a badly designed system for privacy. However, there are genuinely some occasions where a third-party needs to have access to (not just verification of) your information, but also has a responsibility to keep their copy secure. A hospital might need to see your medical records to do its job, for instance. > The analogy doesn't hold because you have to first show that alternatives to passwords are better for the users, even those in the category you mention. I completely agree with you. All I'm saying is that a lot of people will try to replace passwords (because we all have an incentive to improve the situation), even if their replacement fails at being better for users!
novok 3y ago
It costs the company in support costs to deal with lockouts, and the newbie does want their cake and to eat it to, thus the entire push to passkeys.
mike_hock 3y ago
Based. It's trivially easy to generate passwords with 128 bits of entropy and have them managed by a password manager. Until the password manager gets hacked. Well, tough shit. If your primary device gets hacked, the hacker just has to wait until the next time you log in with the bullshit gazillion factor authentication. And it always collapses to 1FA for the lost password recovery process, which you're gonna have to provide if you want customers.
- r00fus 3y ago
  > Until the password manager gets hacked. Well, tough shit. If your primary device gets hacked, the hacker just has to wait until the next time you log in with the bullshit gazillion factor authentication. Can you elaborate? This scenario assumes that a) the primary device is the only 2FA option b) there is no one-time codes and c) the attacker persistently waits until a 2FA request comes through then somehow hijacks it with their own connection request?
  - mike_hock 3y ago
    Nah, he just hijacks your session directly.
krupan 3y ago
I kind of see where you are coming from, because it's true that every alternative to passwords that seems to be gaining traction right now is horribly complicated. Webauthn and passkeys are like the IPv6 of security upgrades. Waaaaay, way more than is needed to improve upon the security of passwords. Now, the rest of your argument kinda sucks, sorry to say. There are things we can do to make everyone's personal information more secure. Using childhood clubhouse password "technology" is not cutting it. We can definitely do better than shared secrets that get leaked to the whole internet on the regular. We can be more secure with an easier to use UI. Yes, people will still get pwned, but less people will, the bad guys will have to work harder.
Dalewyn 3y ago
Hard agree. I can count on one hand the services that are critically important enough to warrant unique passwords and good practices anyway. All the other services I have accounts for? I literally can't care if some yahoo in WhereTheHellistan wants to and does get in, there's nothing valuable in there. They all get the same, simple, short password because that's the value of the things behind the password. Yes, this means all of you reading this are quite welcome to try and steal this HN account guarded by the same, simple, short password. I don't care, all you'll be getting are worthless shitposts and things of similar value in any other services you can find and breach with the same credentials.

H8crilA 3y ago

I don't understand your point. Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The population there is hardly uneducated, yet they still had quite a few break-ins. Some of the companies have also nearly removed passwords, changing the minimum length requirement to something like 5 lowercase characters. They still experience a near zero, or zero, phishing success rates.

jdthedisciple 3y ago
Sure, you could even reduce phishing attack success rates to nearly 0% by having users authenticate with a sample of their DNA. Does that mean it's a great idea? What about losing the yubikey? In any case it's a different matter when it comes to high stake scenarios, in which case I don't mind something slightly more sophisticated. But not as the default for everything.
- superkuh 3y ago
  >having users authenticate with a sample of their DNA. I know it's not your point and I agree with everything you're saying in this thread 100%, but DNA based login would be a username, not a password. Like all biometrics. And it'd have a really bad false positive rate if you're just doing restriction enzyme cut location tests like lots of "police work". A full exome scan ~$300-500/per might do it.
  - antonjs 3y ago
    And as you point out, the problem with biometrics is that once they're stolen or copied, there's no changing them. Particularly your DNA.
- JCharante 3y ago
  > What about losing the yubikey? I have 5 yubikeys on multiple continents. If I lose one I can log in with the others and remove login access with the compromised yubikey.
  - xormapmap 3y ago
    > I have 5 yubikeys on multiple continents Are you actually retarded or just disingenuous? This is hardly a workable solution even for security nuts, let alone the average person.
akira2501 3y ago
> Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The actual question is: "Did they see an INCREASE in other types of attacks after using yubikeys?" To presume that these actors who were willing to go to some illegal lengths to get this information in the first place just "gave up" because "yubikeys exist" is a dangerous way to process these facts.
ghusto 3y ago
> Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? His point (my emphasis): > User picked passwords (1FA) are and will always be the single best solution that has ever existed for authentication, _considering everything from security to usability and practicality, wholistically_ So his point is that if you consider all aspects wholistically, including usability and practicality, passwords are the best solution. I'm not saying I agree, but a 100% reduction of successful phishing attacks after introducing Yubikeys only considers security, and not the other factors.

seabass-labrax 3y ago

You cannot save all people - too true. But remember that you, actually all of us, are indirectly the victim of other peoples' mistakes: - we lose contact with people because they get locked out of their email - we pay more in bank account fees to subsidise fraud compensation - we have our personal information stolen because others chose weak passwords Given how much we suffer from other peoples' poor choices, there is a huge incentive to somehow stop people from making poor choices. By analogy, we all benefit from fences by cliffs because the family of the unlucky soul who wandered off it, the emergency services and their funders all suffer too. If it weren't for values like personal freedom, aesthetics, financial cost and an apathy towards accidents, there would be no clifftop in the world without a fence by it.

romwell 3y ago
>- we lose contact with people because they get locked out of their email I've been locked out of my email because Google insists that "we don't recognize your device", and locked out of my other accounts because my phone was stolen, not because I didn't remember my password. People forgetting passwords isn't a problem that's solved with other schemes. It's a problem that's exacerbated by them. >- we pay more in bank account fees to subsidise fraud compensation Bank account fees, seriously? I can't remember the last time I've paid any. In any case, worrying about saving the banks a few bucks is dead last on my list of worries. >- we have our personal information stolen because others chose weak passwords If our info can be stolen because someone else chose a weak password, the weak password isn't the problem. It's the system that was badly designed in the first place. >Given how much we suffer from other peoples' poor choices,.. We don't. >By analogy, we all benefit from fences by cliffs The analogy doesn't hold because you have to first show that alternatives to passwords are better for the users, even those in the category you mention.
- seabass-labrax 3y ago
  > People forgetting passwords isn't a problem that's solved with other schemes. Sorry, I should have clarified: that was in reference to users being unable to successfully use the parent's hypothetical 'terribly complex 5FA device-based passphrase scheme'. Passwords don't get any blame here. > Bank account fees, seriously? I can't remember the last time I've paid any. OK, fractionally lower interest growth then, or less frequent premium bond wins. In any case, the bank is going to find a way of passing the cost of business to you, so you have an indirect incentive for their business to be cheaper to them. > If our info can be stolen because someone else chose a weak password, the weak password isn't the problem. It's the system that was badly designed in the first place. That is correct for some kinds of personal information, like how storing documents on a 'cloud' without client-side encryption is a badly designed system for privacy. However, there are genuinely some occasions where a third-party needs to have access to (not just verification of) your information, but also has a responsibility to keep their copy secure. A hospital might need to see your medical records to do its job, for instance. > The analogy doesn't hold because you have to first show that alternatives to passwords are better for the users, even those in the category you mention. I completely agree with you. All I'm saying is that a lot of people will try to replace passwords (because we all have an incentive to improve the situation), even if their replacement fails at being better for users!

novok 3y ago

It costs the company in support costs to deal with lockouts, and the newbie does want their cake and to eat it to, thus the entire push to passkeys.

mike_hock 3y ago

Based. It's trivially easy to generate passwords with 128 bits of entropy and have them managed by a password manager. Until the password manager gets hacked. Well, tough shit. If your primary device gets hacked, the hacker just has to wait until the next time you log in with the bullshit gazillion factor authentication. And it always collapses to 1FA for the lost password recovery process, which you're gonna have to provide if you want customers.

r00fus 3y ago
> Until the password manager gets hacked. Well, tough shit. If your primary device gets hacked, the hacker just has to wait until the next time you log in with the bullshit gazillion factor authentication. Can you elaborate? This scenario assumes that a) the primary device is the only 2FA option b) there is no one-time codes and c) the attacker persistently waits until a 2FA request comes through then somehow hijacks it with their own connection request?
- mike_hock 3y ago
  Nah, he just hijacks your session directly.

krupan 3y ago

I kind of see where you are coming from, because it's true that every alternative to passwords that seems to be gaining traction right now is horribly complicated. Webauthn and passkeys are like the IPv6 of security upgrades. Waaaaay, way more than is needed to improve upon the security of passwords. Now, the rest of your argument kinda sucks, sorry to say. There are things we can do to make everyone's personal information more secure. Using childhood clubhouse password "technology" is not cutting it. We can definitely do better than shared secrets that get leaked to the whole internet on the regular. We can be more secure with an easier to use UI. Yes, people will still get pwned, but less people will, the bad guys will have to work harder.

Dalewyn 3y ago

Hard agree. I can count on one hand the services that are critically important enough to warrant unique passwords and good practices anyway. All the other services I have accounts for? I literally can't care if some yahoo in WhereTheHellistan wants to and does get in, there's nothing valuable in there. They all get the same, simple, short password because that's the value of the things behind the password. Yes, this means all of you reading this are quite welcome to try and steal this HN account guarded by the same, simple, short password. I don't care, all you'll be getting are worthless shitposts and things of similar value in any other services you can find and breach with the same credentials.