5 ms·

Passwords should be dead soon and this article should be irrelevant soon after. PSA: For most basic and routine websites/apps of low-value, please, please use

Passwords should be dead soon and this article should be irrelevant soon after. PSA: For most basic and routine websites/apps of low-value, please, please use the FaceID/TouchID protected platform authenticators for passwordless authentication. And for those archaic sites that still insist on passwords (why? tell them about passwordless by writing feedback/app reviews), use the platform built-in password managers. Don't do passwords by memory. For higher value things like banks, please use a different user-id/e-mail-id and passwords stored in password-manager (or write down the password in a book kept safely at your home – this is so much safer than weak passwords you try to scheme up and remember). And, always use 2FA – preferably a hardware FIDO key that you can enroll at least 2 of them and keep them safe. In India, regulator insists banks use mobile SMS OTP. In such case, keeping your phone secure from SMS sniffing malicious apps is critical. If you are really paranoid, get the simplest modern feature phone with a phone number dedicated for receiving such critical SMS! The day when all financial institutions use passwordless auth with FIDO2 MFA cannot come soon enough!

MattPalmer1086 3y ago
Define soon. Passwords, for all their annoyances, will probably be around for a long time. While they are not brilliant at anything, they are good enough on many dimensions. Some disadvantages of the things you mention are: * They don't require specialised hardware * They don't require complicated recovery mechanisms if that hardware is lost, stolen or broken. * Arguably, biometrics should not be used for authentication. Once a biometric system is compromised, you have no way to recover. You can't change your biometrics.
- NikkiA 3y ago
  My bank dropped using passwords back in july. Now all that protects my account is a 5 digit PIN and SMS, and you can reset the pin via SMS. I'm glad financial companies hire security minded folks.
  - MattPalmer1086 3y ago
    Well, technically a PIN is a kind of low security password...
  - jowea 3y ago
    I suspect that what's supposed to be going on there is that what protects your account is law enforcement and the fact that financial transactions are traceable.
    - NoZebra120vClip 3y ago
      Yeah, her bank has stationed a cop to stand at every website login and proactively arrest hackers before they can get at her money.
      - jowea 3y ago
        I meant get the money back after the fact. Which yeah it will probably suck for the client even if the bank considers it a cost of doing business.
  - jwilk 3y ago
    This is satire, right?
    - NikkiA 3y ago
      Nope - although the last line is sarcasm, if that's what you mean.
vbezhenar 3y ago
I don't trust Face ID/Touch ID, so for me passwords will not be dead soon. Especially because on my device there's nor Face ID, nor Touch ID.
throw101010 3y ago
> please use the FaceID/TouchID protected platform authenticators for passwordless authentication. No, thank you, I don't wear my passwords on my face or my fingers because they need to be secret to serve their purpose. I don't really feel like wearing a balaclava and gloves all the time. Also sometimes I need to change them (if they get compromised, if computing progress made them easier to bruteforce, etc.), and I don't really want to have to use cosmetic surgery when that happens. Biometrics are closer to a username than a password in this regard. > Don't do passwords by memory. We can agree on this (and the disaster that SMS OTP is due to lousy carrier security mostly), you will still need a password for that password manager usually though. You can have a key based setup but you still need a way to store/remeber that key. So passwords will not die just based on this, they might become less ubiquitous. It sounds like you want to trivialize a problem that has existed for way longer than computer science and systematically relies at some point on human memory if you want a certain level of security and secrecy. Obviously if you decrease these requirements, you can get away with weaker authentication mechanisms... but you will not secure whatever that password was securing as well then.
- nwienert 3y ago
  I didn’t know Jason Bourne posted on HN. In all seriousness, where’s the threat of someone taking extremely high resolution scans of your iris unless you are truly rich/powerful/connected.
  - Swenrekcah 3y ago
    How long until a high resolution iris scanner can be embedded in a pair of sunglasses? Point is it wasn’t long ago that nobody could fake your voice either.
  - 8organicbits 3y ago
    Fingerprint scanning is going mainstream, heres a post about Amazon using palm scans on point of sale systems [1]. It seems reasonable that point of sale systems will get hacked or skimmers will get installed (common problems impacting normal people today). The current fix is to issue a new card. Unfortunately, you cannot have a new finger/palm print issued, so the threat appears unmitigated. [1] https://www.bbc.co.uk/news/technology-54337984 https://www.bbc.co.uk/news/technology-54337984
chess_horse_L 3y ago
I don't know. For banks and tech SaaS? Maybe. But for the average website, passwordless is confusing for the end user. I've researched WebAuthn for a web game to see if I could make the login natively and seamless. And it sucked. In Windows, it would prompt a confusing window asking for either an USB key, Windows Hello (So, a PIN or face, and most of people don't have this feature enabled), or to use a QR code. The average user won't know what they should do, so they won't be able to register. Also, it's really hard to use your account on other devices. Like, if you log in first with a Google phone, then yeah, you'll be able to use your key by scanning a QR when prompted on your computer. But if you log in with a computer first, you won't be able to use your key anywhere else because exporting keys isn't implemented anywhere yet. I've ended up just implementing Google and Apple OAuth, since WebAuthn requires accounts anyways to store your keys (Microsoft on Windows, Google on Android, Apple on Mac/ios), so why not just log in with them directly?
- wolletd 3y ago
  Because the goal of WebAuthn is to not depend on any companies infrastructure. And there's work being done in that direction. Apple supports passkeys from third-party password managers, 1Password has a Passkey beta and KeePassXC has a pull request working on passkey support. [0] That independence is a design goal of passkeys, because they want to replace passwords and passwords are independent by their nature. [0]: https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/keepassxreboot/keepassxc/pull/8825
- deleted 3y ago
  [deleted]
matkoniecz 3y ago
> please use the FaceID/TouchID protected platform authenticators nope I am working on basing less critical stuff on Google, not interested in doing exact opposite (or doing the same mistake with Apple)
wizofaus 3y ago
Right, and what you recommend in those situations where, due to unusual circumstances (flat battery, whatever), you need to access to, say, your online banking or airline site or email or whatever using another device that would have no way of knowing who you are? If there's a way to access a web-based password manager securely from any device, then surely there's a way to access whatever application you actually need access to securely too... FWIW I use a password manager of sorts, but only to remember "hints". Once I see the hint I can reliably recall what the full password is, but there's no way reasonable way for someone else to do so. It's only passwords I use very rarely I even really need such hints for.
throwawa14223 3y ago
I think I would drop any service that required me to go to WebAuthn.
egberts1 3y ago
> please use the FaceID/TouchID protected platform authenticators for passwordless authentication. No, I prefer to keep my fingers intact on both of my hands. Better to use the mind for something secured; the brain is essentially hack-proof.

MattPalmer1086 3y ago

Define soon. Passwords, for all their annoyances, will probably be around for a long time. While they are not brilliant at anything, they are good enough on many dimensions. Some disadvantages of the things you mention are: * They don't require specialised hardware * They don't require complicated recovery mechanisms if that hardware is lost, stolen or broken. * Arguably, biometrics should not be used for authentication. Once a biometric system is compromised, you have no way to recover. You can't change your biometrics.

NikkiA 3y ago
My bank dropped using passwords back in july. Now all that protects my account is a 5 digit PIN and SMS, and you can reset the pin via SMS. I'm glad financial companies hire security minded folks.
- MattPalmer1086 3y ago
  Well, technically a PIN is a kind of low security password...
- jowea 3y ago
  I suspect that what's supposed to be going on there is that what protects your account is law enforcement and the fact that financial transactions are traceable.
  - NoZebra120vClip 3y ago
    Yeah, her bank has stationed a cop to stand at every website login and proactively arrest hackers before they can get at her money.
    - jowea 3y ago
      I meant get the money back after the fact. Which yeah it will probably suck for the client even if the bank considers it a cost of doing business.
- jwilk 3y ago
  This is satire, right?
  - NikkiA 3y ago
    Nope - although the last line is sarcasm, if that's what you mean.

vbezhenar 3y ago

I don't trust Face ID/Touch ID, so for me passwords will not be dead soon. Especially because on my device there's nor Face ID, nor Touch ID.

throw101010 3y ago

> please use the FaceID/TouchID protected platform authenticators for passwordless authentication. No, thank you, I don't wear my passwords on my face or my fingers because they need to be secret to serve their purpose. I don't really feel like wearing a balaclava and gloves all the time. Also sometimes I need to change them (if they get compromised, if computing progress made them easier to bruteforce, etc.), and I don't really want to have to use cosmetic surgery when that happens. Biometrics are closer to a username than a password in this regard. > Don't do passwords by memory. We can agree on this (and the disaster that SMS OTP is due to lousy carrier security mostly), you will still need a password for that password manager usually though. You can have a key based setup but you still need a way to store/remeber that key. So passwords will not die just based on this, they might become less ubiquitous. It sounds like you want to trivialize a problem that has existed for way longer than computer science and systematically relies at some point on human memory if you want a certain level of security and secrecy. Obviously if you decrease these requirements, you can get away with weaker authentication mechanisms... but you will not secure whatever that password was securing as well then.

nwienert 3y ago
I didn’t know Jason Bourne posted on HN. In all seriousness, where’s the threat of someone taking extremely high resolution scans of your iris unless you are truly rich/powerful/connected.
- Swenrekcah 3y ago
  How long until a high resolution iris scanner can be embedded in a pair of sunglasses? Point is it wasn’t long ago that nobody could fake your voice either.
- 8organicbits 3y ago
  Fingerprint scanning is going mainstream, heres a post about Amazon using palm scans on point of sale systems [1]. It seems reasonable that point of sale systems will get hacked or skimmers will get installed (common problems impacting normal people today). The current fix is to issue a new card. Unfortunately, you cannot have a new finger/palm print issued, so the threat appears unmitigated. [1] https://www.bbc.co.uk/news/technology-54337984 https://www.bbc.co.uk/news/technology-54337984

chess_horse_L 3y ago

I don't know. For banks and tech SaaS? Maybe. But for the average website, passwordless is confusing for the end user. I've researched WebAuthn for a web game to see if I could make the login natively and seamless. And it sucked. In Windows, it would prompt a confusing window asking for either an USB key, Windows Hello (So, a PIN or face, and most of people don't have this feature enabled), or to use a QR code. The average user won't know what they should do, so they won't be able to register. Also, it's really hard to use your account on other devices. Like, if you log in first with a Google phone, then yeah, you'll be able to use your key by scanning a QR when prompted on your computer. But if you log in with a computer first, you won't be able to use your key anywhere else because exporting keys isn't implemented anywhere yet. I've ended up just implementing Google and Apple OAuth, since WebAuthn requires accounts anyways to store your keys (Microsoft on Windows, Google on Android, Apple on Mac/ios), so why not just log in with them directly?

wolletd 3y ago
Because the goal of WebAuthn is to not depend on any companies infrastructure. And there's work being done in that direction. Apple supports passkeys from third-party password managers, 1Password has a Passkey beta and KeePassXC has a pull request working on passkey support. [0] That independence is a design goal of passkeys, because they want to replace passwords and passwords are independent by their nature. [0]: https://github.com/keepassxreboot/keepassxc/pull/8825 https://github.com/keepassxreboot/keepassxc/pull/8825
deleted 3y ago
[deleted]

matkoniecz 3y ago

> please use the FaceID/TouchID protected platform authenticators nope I am working on basing less critical stuff on Google, not interested in doing exact opposite (or doing the same mistake with Apple)

wizofaus 3y ago

Right, and what you recommend in those situations where, due to unusual circumstances (flat battery, whatever), you need to access to, say, your online banking or airline site or email or whatever using another device that would have no way of knowing who you are? If there's a way to access a web-based password manager securely from any device, then surely there's a way to access whatever application you actually need access to securely too... FWIW I use a password manager of sorts, but only to remember "hints". Once I see the hint I can reliably recall what the full password is, but there's no way reasonable way for someone else to do so. It's only passwords I use very rarely I even really need such hints for.

throwawa14223 3y ago

I think I would drop any service that required me to go to WebAuthn.

egberts1 3y ago

> please use the FaceID/TouchID protected platform authenticators for passwordless authentication. No, I prefer to keep my fingers intact on both of my hands. Better to use the mind for something secured; the brain is essentially hack-proof.