4 ms·

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. Very much th

by jjav 3y ago

> Run away screaming. Don’t believe the hype. Wait until the vendors get their act together and come up with a solution for transfer and recovery. Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password). And it comes with the benefit that you control how it is stored and can apply as much redundancy as you want to feel comfortable.

EGreg 3y ago
Just like the rest of it, they’re going to try to lock down the open web, general-purpose computing, etc. They are going to be the gatekeepers if you and the web services let them. Oh yeah — also they’ll run all the web, email and other services anyway. Trap you in their metaverse and AI most likely, since that’s where your coworkers and friends will be you’ll have to be there too. Resist by opting out :)
- paiute 3y ago
  I think it’s time for a government solution, but nowadays it’d be done to be benefit big tech and the surveillance state.
  - EGreg 3y ago
    How about an open source one? https://intercoin.org/overview.pdf https://intercoin.org/overview.pdf
    - trinsic2 3y ago
      Riiight. Another cryptocurrency solution. crypto falls into the same category of untrustworthiness as the rest of these so called solutions. The only difference is the that crypto has a more murky past.
- raxxorraxor 3y ago
  Contrary to popular belief Google doesn't run email. It more or less does so in the US, but only there people were so enthusiastic to jump onto their platform. Probably a result of other US alternatives being that bad. But in many other countries, gmail isn't that successful. Still, email is still under attack by big mail servers getting more and more restrictive.
artursapek 3y ago
There are existing cryptographically secured systems which have scaled to many users, like Bitcoin wallets and Keybase accounts, and do have a recovery fallback. It's usually called a "seed phrase" or "paper key"... which is really just a password! :D
stavros 3y ago
> Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. Then you can tie it to hardware you do control, or to software. Obligatory "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misconceptions/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco...
- 90-00-09 3y ago
  How does this address OP's concern? If you have a single device (e.g. an iPhone) and you store all your passkeys on it, then losing it means you lost all passkeys. Your post describes exactly that: - "I can’t recover the keys if I lose the hardware" - "That is a risk you’ll need to take if you’re using hardware authenticators" Fantasizing that with this proposed simplification of the authentication process people will introduce complexities such as a password manager or a backup hardware device is naive to say the least.
  - stavros 3y ago
    I haven't heard anyone claim that passkeys are simpler than passwords, as that would be trivially false. The claim is that they're more secure while still remaining fairly usable. Passkeys are WebAuthn credentials that are synced between devices, so they aren't hardware keys, they're software keys.
    - jjav 3y ago
      > more secure "more secure" is a completely meaningless statement, I wish this usage would die already (in general). You need to talk about security in the face of a very specific threat, then you can say solution A is better than solution B against threat T1, worse for T2 and about a wash for T3 and so on. Security is not a linear scale from 0-100 where you can say "more secure". There are many different criteria and any given solution will be better in some, worse in others. You must do a threat model for your specific use case to say if something is better or worse for those specific threats, and keep in mind other people will have very different threat models for the same solution.
RockRobotRock 3y ago
Non-tech people have a fundamental misunderstanding of what makes a good password, and stupid IT policies like password expiration lead to really bad habits like frequently forgetting passwords, frequently reusing passwords, and end with writing it down on a post-it note.
KronisLV 3y ago
> People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password). > And it comes with the benefit that you control how it is stored and can apply as much redundancy as you want to feel comfortable. Honestly, I agree! I used KeePass back in the day (https://keepass.info/ https://keepass.info/) but now use KeePassXC (https://keepassxc.org/ https://keepassxc.org/) and it's really nice - I don't know any of my passwords because they're all randomly generated and are pretty secure, in addition to them being unique for every account. The only one I have to remember is my main password for decrypting the safe, which I also wrote down and entrusted to someone close to me due to its complexity. It honestly works great, software to interact with the password safe is on every platform where I need it to be, in addition to it being super easy to reason about storage, because it's basically just a file - that I can then put on self-hosted Nextcloud, or another solution like that, or USB sticks or burn to CDs for all I care. Maybe I should also migrate all of my TOTP stuff over to it and look into good Android apps at some point, then I wouldn't quite need Google Authenticator or FreeOTP anymore, either.
- prometheon1 3y ago
  I tried a few different android apps a few years ago and since then I'm a happy user of Keepass2Android.
- blur13 3y ago
  You're gonna have a problem when you're on a trip abroad and lose your phone. Your only recourse is to go to the local internet cafe and log on to your email so you can send a message for help. Except you can't, because you dont know your password...
  - KronisLV 3y ago
    > You're gonna have a problem when you're on a trip abroad and lose your phone. There's also the possibility of bringing my netbook with me, which also could have a Nextcloud client setup (or Syncthing, or some cloud based option), same as every other device that I own, which would have the last offline backup of the file even if the server itself would blink out of existence. Honestly a bigger problem without my phone would be the fact that I basically couldn't pay for things all that well when using a card, because of a redirect to my bank when making a purchase online (to confirm it), which then makes me use https://www.smart-id.com/ https://www.smart-id.com/ with a code to confirm it. That's kind of a problem because it's not TOTP but rather it's bound to the device. I can work around the password safe issue with an SD card that has the database on it, or a USB stick as well, but that wouldn't work for the app, so in the modern day I'd basically need to have two phones, the same way someone might have two sets of keys to their apartment or something. Kind of crazy when you think about it. And I'd also need a smart card reader to even register a new account in most cases, in combination with my government issued ID card.
linsomniac 3y ago
>Having authentication tied to hardware you don't control is a near-certain denial of service in the future. You can use passkeys with a yubikey, right?

by jjav 3y ago

EGreg 3y ago

Just like the rest of it, they’re going to try to lock down the open web, general-purpose computing, etc. They are going to be the gatekeepers if you and the web services let them. Oh yeah — also they’ll run all the web, email and other services anyway. Trap you in their metaverse and AI most likely, since that’s where your coworkers and friends will be you’ll have to be there too. Resist by opting out :)

paiute 3y ago
I think it’s time for a government solution, but nowadays it’d be done to be benefit big tech and the surveillance state.
- EGreg 3y ago
  How about an open source one? https://intercoin.org/overview.pdf https://intercoin.org/overview.pdf
  - trinsic2 3y ago
    Riiight. Another cryptocurrency solution. crypto falls into the same category of untrustworthiness as the rest of these so called solutions. The only difference is the that crypto has a more murky past.
raxxorraxor 3y ago
Contrary to popular belief Google doesn't run email. It more or less does so in the US, but only there people were so enthusiastic to jump onto their platform. Probably a result of other US alternatives being that bad. But in many other countries, gmail isn't that successful. Still, email is still under attack by big mail servers getting more and more restrictive.

artursapek 3y ago

There are existing cryptographically secured systems which have scaled to many users, like Bitcoin wallets and Keybase accounts, and do have a recovery fallback. It's usually called a "seed phrase" or "paper key"... which is really just a password! :D

stavros 3y ago

> Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future. Then you can tie it to hardware you do control, or to software. Obligatory "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misconceptions/ https://www.stavros.io/posts/clearing-up-some-passkeys-misco...

90-00-09 3y ago
How does this address OP's concern? If you have a single device (e.g. an iPhone) and you store all your passkeys on it, then losing it means you lost all passkeys. Your post describes exactly that: - "I can’t recover the keys if I lose the hardware" - "That is a risk you’ll need to take if you’re using hardware authenticators" Fantasizing that with this proposed simplification of the authentication process people will introduce complexities such as a password manager or a backup hardware device is naive to say the least.
- stavros 3y ago
  I haven't heard anyone claim that passkeys are simpler than passwords, as that would be trivially false. The claim is that they're more secure while still remaining fairly usable. Passkeys are WebAuthn credentials that are synced between devices, so they aren't hardware keys, they're software keys.
  - jjav 3y ago
    > more secure "more secure" is a completely meaningless statement, I wish this usage would die already (in general). You need to talk about security in the face of a very specific threat, then you can say solution A is better than solution B against threat T1, worse for T2 and about a wash for T3 and so on. Security is not a linear scale from 0-100 where you can say "more secure". There are many different criteria and any given solution will be better in some, worse in others. You must do a threat model for your specific use case to say if something is better or worse for those specific threats, and keep in mind other people will have very different threat models for the same solution.

RockRobotRock 3y ago

Non-tech people have a fundamental misunderstanding of what makes a good password, and stupid IT policies like password expiration lead to really bad habits like frequently forgetting passwords, frequently reusing passwords, and end with writing it down on a post-it note.

KronisLV 3y ago

> People love to hate on passwords but the reality is that for many circumstances (threat models) they are the best compromise. You can make them more than strong enough (take 32+ bytes out of /dev/random and encode however you like, nobody will ever brute force that in this universe) and various passwords managers solve the problem of re-use (never reuse a password). > And it comes with the benefit that you control how it is stored and can apply as much redundancy as you want to feel comfortable. Honestly, I agree! I used KeePass back in the day (https://keepass.info/ https://keepass.info/) but now use KeePassXC (https://keepassxc.org/ https://keepassxc.org/) and it's really nice - I don't know any of my passwords because they're all randomly generated and are pretty secure, in addition to them being unique for every account. The only one I have to remember is my main password for decrypting the safe, which I also wrote down and entrusted to someone close to me due to its complexity. It honestly works great, software to interact with the password safe is on every platform where I need it to be, in addition to it being super easy to reason about storage, because it's basically just a file - that I can then put on self-hosted Nextcloud, or another solution like that, or USB sticks or burn to CDs for all I care. Maybe I should also migrate all of my TOTP stuff over to it and look into good Android apps at some point, then I wouldn't quite need Google Authenticator or FreeOTP anymore, either.

prometheon1 3y ago
I tried a few different android apps a few years ago and since then I'm a happy user of Keepass2Android.
blur13 3y ago
You're gonna have a problem when you're on a trip abroad and lose your phone. Your only recourse is to go to the local internet cafe and log on to your email so you can send a message for help. Except you can't, because you dont know your password...
- KronisLV 3y ago
  > You're gonna have a problem when you're on a trip abroad and lose your phone. There's also the possibility of bringing my netbook with me, which also could have a Nextcloud client setup (or Syncthing, or some cloud based option), same as every other device that I own, which would have the last offline backup of the file even if the server itself would blink out of existence. Honestly a bigger problem without my phone would be the fact that I basically couldn't pay for things all that well when using a card, because of a redirect to my bank when making a purchase online (to confirm it), which then makes me use https://www.smart-id.com/ https://www.smart-id.com/ with a code to confirm it. That's kind of a problem because it's not TOTP but rather it's bound to the device. I can work around the password safe issue with an SD card that has the database on it, or a USB stick as well, but that wouldn't work for the app, so in the modern day I'd basically need to have two phones, the same way someone might have two sets of keys to their apartment or something. Kind of crazy when you think about it. And I'd also need a smart card reader to even register a new account in most cases, in combination with my government issued ID card.

linsomniac 3y ago

>Having authentication tied to hardware you don't control is a near-certain denial of service in the future. You can use passkeys with a yubikey, right?