3 ms·

The concept of requiring a special string to gain access to an account is massively dated, whether that string is something a human has memorised or random outp

by ljm 3y ago

The concept of requiring a special string to gain access to an account is massively dated, whether that string is something a human has memorised or random output from a password manager. Either the database of special strings lives in your brain, a notebook, a bit of paper, or encrypted on disk somewhere, but it's still a database of special strings. Public key crypto never took off for account management and neither did Persona, but the current iteration with passkeys/Webauthn should hopefully be a fresh step in the right direction there.

lelanthran 3y ago
> The concept of requiring a special string to gain access to an account is massively dated, whether that string is something a human has memorised or random output from a password manager. I disagree. Any system, whether computerised or not, needs to pieces of information to authenticate a person - something the person has (identification), and something the person knows (authentication). You cannot simply rely on something the person has; that thing can be stolen and used by someone else. If you have a reasonable replacement for "something the person knows", I'd love to hear it.
- starttoaster 3y ago
  I don't think they actually have to come up with a replacement for "something the person knows," they just need to prove it's already not there to be replaced. With password managers, the password becomes more like something the person has anyway.
  - lelanthran 3y ago
    > I don't think they actually have to come up with a replacement for "something the person knows," they just need to prove it's already not there to be replaced. I don't know what this means. Once you've identified a person, you still have to authenticate that they aren't masquerading as someone else. The replacement I asked for is not "how do I identify who I am talking to", it's for "Right, now that I've identified them, how do I verify that it really is* them."* If you want to do away with passwords, tokens are no replacement. > With password managers, the password becomes more like something the person has anyway. Maybe. The user still has to both identify and authenticate themselves to the password manager anyway, so you can give access to the password manager as a "something they know" anyway.
    - starttoaster 3y ago
      > I don't know what this means. You responded to this after your second quotation, I effectively said the same thing twice in different ways to make my point. Hopefully you understand it now. To be fair, it's a somewhat complicated sentence, took me a while to put that thought into words. > so you can give access to the password manager as a "something they know" anyway. Mostly true. Ignoring password manager breaches, as that hurts your argument a little. Security researchers are currently of the opinion that the last LastPass security breach leaked people's encrypted password vaults, which people have somehow managed to decrypt since then. In that case, the password was something the attacker had, not something they had to know. But I think I mostly agree that access to the password manager can at least (mostly) be seen as something they know.

by ljm 3y ago

lelanthran 3y ago

> The concept of requiring a special string to gain access to an account is massively dated, whether that string is something a human has memorised or random output from a password manager. I disagree. Any system, whether computerised or not, needs to pieces of information to authenticate a person - something the person has (identification), and something the person knows (authentication). You cannot simply rely on something the person has; that thing can be stolen and used by someone else. If you have a reasonable replacement for "something the person knows", I'd love to hear it.

starttoaster 3y ago
I don't think they actually have to come up with a replacement for "something the person knows," they just need to prove it's already not there to be replaced. With password managers, the password becomes more like something the person has anyway.
- lelanthran 3y ago
  > I don't think they actually have to come up with a replacement for "something the person knows," they just need to prove it's already not there to be replaced. I don't know what this means. Once you've identified a person, you still have to authenticate that they aren't masquerading as someone else. The replacement I asked for is not "how do I identify who I am talking to", it's for "Right, now that I've identified them, how do I verify that it really is* them."* If you want to do away with passwords, tokens are no replacement. > With password managers, the password becomes more like something the person has anyway. Maybe. The user still has to both identify and authenticate themselves to the password manager anyway, so you can give access to the password manager as a "something they know" anyway.
  - starttoaster 3y ago
    > I don't know what this means. You responded to this after your second quotation, I effectively said the same thing twice in different ways to make my point. Hopefully you understand it now. To be fair, it's a somewhat complicated sentence, took me a while to put that thought into words. > so you can give access to the password manager as a "something they know" anyway. Mostly true. Ignoring password manager breaches, as that hurts your argument a little. Security researchers are currently of the opinion that the last LastPass security breach leaked people's encrypted password vaults, which people have somehow managed to decrypt since then. In that case, the password was something the attacker had, not something they had to know. But I think I mostly agree that access to the password manager can at least (mostly) be seen as something they know.