25 ms·
Passwordless: a different kind of hell?
- asylteltine 3y agoThe reason this happens is because of bad actors. This is why we can’t have nice things. Walk around and pay attention next time and you will notice all the little things that are shitty because of bad actors like thieves.
- cedws 3y agoI came to this realisation not too long ago as well. It's saddening to imagine how much better the world in general would be if it weren't for criminals. Generations before mine talk about their childhood as a wonderful time. Not having to lock their bikes up when going into a shop. Not having security cameras watching their every move. Not having barriers everywhere to prevent theft. My local supermarket introduced receipt scanners a few months ago that block you from exiting. They treat you as a thief by default. I wish I could live in a high trust society. It sounds like in some parts of world (Japan for example) there are still elements of that.
- vt85 3y ago[dead]
- asylteltine 3y agoI agree! And I think we could if we had very harsh punishments. We are way too lenient on crime. Steal? Life in jail. Litter? Year long sentence. Assault? Life in jail. Criminals are going to commit crime and there is absolutely no evidence that rehabilitation works for those kinds of crime. We need to keep them away from society and change our culture to be entirely intolerant of crime.
- _heimdall 3y agoI really hope this is facetious.
- _heimdall 3y agoIts not really so easy to peg the blame solely on the existence criminals. For one thing what makes a person a criminal changes over time as we redefine what is illegal and what technically illegal acts are given priority enough to enforce. More importantly though, generations past also often lived in smaller communities then we have today. When your world is smaller and you are only a degree or two of separation away from everyone, people often feel more bound to a certain standard of behavior. Stealing a bike in NYC today is one thing, stealing a bike in a town where you probably know whose bike it is and someone will recognize it if you ever actually ride it is very different. The larger we grow societal centers and the more we expand the boundaries of our own world, the more we break societal bonds and need laws to enforce rules that are more easily broken when your victim is just another random person living there.
- anigbrowl 3y agoBear in mind that the security/surveillance sector of the economy (including police) are heavily incentivized to exaggerate the risks of crime, as are politicians who want to appeal to a certain sort of voter. There's a lot of money to be made out of running a police state.
- jampekka 3y agoThieves and other "bad actors" are often a consequence of deeper underlying problems. People don't tend to steal that much when they are economically comfortable. OTOH with no legal resort to get sustinence, you're guaranteed to get people to resort to illegal means. I'm rather baffled how educated adult human beings keep on analyzing the world using moralistic fairytale level concepts like "bad actors" or "evildoers" as if there are some inherently tainted souls doing bad things just because they are bad. In my, probably biased, assesment this is especially prevalent in the US public discourse.
- cedws 3y agoNah, thieves are scum. People don't steal cars and bikes to buy food, they do it because they're selfish and want a shortcut to get the things they want. In any first world country there are ways to get food without resorting to taking other peoples' possessions that they worked hard for. There are many people out there having a really hard time who would never even think about stealing because they were raised with a functioning moral compass.
- jampekka 3y agoThis is why we can't have nice things.
- cedws 3y agoI don't know how I'm supposed to have any sympathy for thieves when myself and my family have been victims of multiple thefts totalling tens of thousands of pounds over the past years. I comforted my mum while she bawled her eyes out for hours when her car was stolen off of our driveway at the crack of dawn. Fuck thieves.
- BizarreByte 3y agoOne a thief always a thief, there's a reason it was punished so severely throughout history. Theft has the highest recidivism rate too[1]. You can never trust someone who has stolen again, thieves are the scum of the earth and only hurt good people. [1] https://www.gov.uk/government/statistics/proven-reoffending-statistics-january-to-march-2021/proven-reoffending-statistics-january-to-march-2021 https://www.gov.uk/government/statistics/proven-reoffending-...
- teeray 3y agoThis happens because people won’t use a password manager and insist that “monkey123” is their super-secret unguessable password. The solution is to force them to use some kind of credential store (SMS 2FA, passkeys), because they can’t be entrusted to just hit the “generate secure password & save” prompt in the browser.
- hypeatei 3y ago2FA is more than defending against bad passwords but also compromised passwords (e.g. you accidentally share it in a public forum) and phishing attacks. It's very unlikely a bad actor has access to both factors.
- jeroenhd 3y agoI think it's the people who pick bad passwords that are making login flows worse. Bad actors are the reason we have passwords in the first place, yes, but authentication still shouldn't be as bad an experience as it is today. As it turns out, after thirty years of internet access, people just suck at picking a good password. When I generate random passwords, people complain that they're unreadable. When I ask them why the password they need to enter once every two years would need to be readable, they just shrug. When I bring up the ability to save passwords to their devices using a password manager or their browser, they say they're "not into IT" and ignore any advice beyond that. Then they change their passwords to Welcome2024!, and that's why we have to make things more complicated. I don't care about most random accounts, but the Welcom2024! people are the ones safeguarding personal data, medical information, and so much more, and if they don't care, you have to force them to use computers responsibly. Most websites would be perfectly fine with just a username and a randomly generated password. Even eBay or banks, if we're talking about <€100 worth of transactions/day. 2FA is a workaround only very few, very important services should actually need. However, in real life, we can't do that, because when the Welcome2024! people get their accounts taken over, their digital wallets drained, their credit cards emptied out, and their life ruined by people on another continent, it's always the websites' fault. People love to say "Google/eBay/PayPal/my bank should've prevented this" but when these services take steps to prevent that stuff, they get mad that everything gets so complicated. Bad actors will always cause things to be worse, but the general apathy the general public has to digital safety is the reason why it's _this_ bad.
- filleokus 3y agoI think the industry, to some extent, already have reconsidered the session length, see [0] by Auth0 for example (even if it's obv. a PR piece). Nowadays my gut assumption when I use a service with really short sessions is that their security practices are probably questionable. I recently argued, as the cybersecurity guy™, with a vendor that we can't ask regular users to reauthenticate every 15 minutes. They insisted raising it would be to insecure and instead suggested to make MFA optional as it would make the login process smoother… [0]: https://auth0.com/blog/balance-user-experience-and-security-to-retain-customers/ https://auth0.com/blog/balance-user-experience-and-security-...
- organsnyder 3y agoSome of it depends on regulations and usage context. When I worked in healthcare, sessions were always short-lived. This may have been regulation-driven, but it's also based on the fact that often this software is being used on shared machines or in areas where unauthorized users are present (such as in patient rooms). While users are trained (very well, in my experience) to lock machines whenever they're unattended, short session lengths provide an additional layer of protection.
- gregmac 3y agoI saw a demo like 15 or 20 years ago of a Sun thin client that used smart cards. You put your card in to any terminal, and nearly instantly your desktop session was live. Remove the card and it instantly disappears and locks. That type of thing seems ideally suited to healthcare use, and we have such better devices now than whatever cards were used way back then. Amazing it's still Windows PCs deployed and secured with passwords.
- organsnyder 3y agoA previous employer (regional healthcare system) did exactly that: staff used their badges (along with another authentication factor, IIRC) to pull up their VDI instance on any client. This was just being rolled out ~8 years ago.
- 3y ago
- smitty1e 3y agoBiometrics seem worse-is-better: you now have some unique identifier for me, which is totally swell until the inevitable DB breach. Which breech will likely be due to an Admin whoopsie of some sort. Because the people remain the weakest link.
- wkrause13 3y agoCould you elaborate on your concern? My understanding of how most biometric auth works is that it functions a lot like passwords in that your features get translated into a non-reversible hash that should be meaningless to any other biometric auth system.
- SketchySeaBeast 3y agoYeah, assuming that my biometric auth is relatively strong, stays on my device, and is a device-specific hashed representation I have a hard time finding fault. I believe most modern phone's biometrics fit that criteria.
- smitty1e 3y ago> stays on my device Heh.
- SketchySeaBeast 3y agoOK, so we're at that level of contribution, are we?
- smitty1e 3y agoI'm just saying that the information staying on the device is aspirational. I see that this skepticism has offended.
- SketchySeaBeast 3y ago
- michaelt 3y agoI recently ordered something on ebay. Nothing expensive, just a £60 item, and delivered to an address I've ordered many things to in the past. First I had to log into ebay - no problem, got my password manager right here, as soon as I unlock my phone with my fingerprint. Now I'll just key in my 12 character, randomly generated password with mixed case letters, numbers and symbols. Then ebay decided they wanted to send me a code by SMS. I'd never enabled that security option, but whatever. I can do that, quick fingerprint to unlock the phone then key in the code. Then I chose to pay with paypal, requiring a second password. And a 2FA code, this time from a TOTP app. For some reason paypal ask for TOTP every time. Easy enough, quick fingerprint auth then just key in the code. Then I told paypal I wanted to pay by card, as I always do. They redirected me to my bank, who asked me to use their mobile app to authorise the payment with my fingerprint. After unlocking my phone with my fingerprint, naturally. Clearly, the days when businesses thought online shopping ought to be low-friction are long gone.
- mrits 3y agoIn a couple decades I had to verify my bank once with PayPal
- michaelt 3y agoIn their defence, I'm sure the parties involved would blame EU Strong Customer Authentication rules and claim that they "don't have a choice"
- cogogo 3y agoApple pay when available is about as low friction as you can get. I know it isnt available to everyone but there should be some similar standard that is. Near seamless.
- makeitdouble 3y agoAmazon is probably the lowest and will stay so for a while I guess. They didn't cling to their one click patent for nothing.
- BoppreH 3y agoI understand the frustration with login systems, but why is the title "Passwordless: A Different Kind of Hell" if it doesn't talk about passwordless authentication, like passkeys, magic links, and biometrics?
- davidmurdoch 3y agoIt talks about passkeys and biometrics though.
- gipp 3y agoAt the very end, as possible alternatives to the hell they're describing.
- charles_f 3y agoI was confused as well. It seems to me that by lowering the experience complexity, while not really changing security, by the author's own logic the experience stars would go up a notch. Instead they just mention it in passing with a "only time will tell" comment
- felipeccastro 3y agoI was curious about that as well. Since most services implement an email based Forgot Password feature, and 2FA tokens are also often email based, why isn't magic links the default approach now? Seems to be just as secure as password+2FA but easier to use (and probably to implement, as well). By the title, I thought the article would explore some of the downsides of this approach that I might be missing.
- catapart 3y agoA nice little read! Fun to have a short trip through history, there. I'm a little disappointed that it didn't talk about passwordless logins, at all, though. I'm thinking of implementing one, and I was hoping this would give me some food for thought! Ah well.
- deleted 3y ago[deleted]
- Al-Khwarizmi 3y agoWe are going way over the top with 2FA. Why do I need to activate mandatory 2FA in services like GitHub repositories for hobby projects? It's a lot of extra effort for a questionable security improvement, and anyway, if someone impersonates me there, it's not the end of the world. If they care about end users (which my projects mostly don't even have) mark me as "unverified" or something, but let me avoid the hassle. And in more serious services, like banking... since there is no such thing about 100% security (and in particular 2FA is far from it, e.g. if your phone is stolen with the banking app open, you're screwed), actually the most important thing is that the bank responds and can refund the money if fraud is committed, which it inevitably will for some percentage of unlucky customers. I view 2FA as a way to pass responsability to the customer ("we have very secure systems, so if someone transferred $X out of your account it's surely your fault"). Personally, I feel safer with less security and the bank worrying about fraud than the other way around, so I don't think they're protecting me when they implement this kind of stuff.
- Shank 3y agoJust turn on Passkeys on GitHub, then you don't need 2FA/TOTP. It's also faster.
- mminer237 3y agoMy password manager autofilling will always be faster than any other option, especially one that requires me to pull out my phone, navigate to my authenticator app, switch to your app (which will only become more time-consuming as more sites require it), then type in the code by hand. The only thing that can compete with password managers on user experience is just actually remembering they're logged in instead of pointlessly logging them out every single day for no reason.
- mimsee 3y ago1Password supports Passkeys, not sure for others. But it's one click on the login page and you're in.
- 3y ago
- pjkundert 3y agoI have 743 login credentials (1984-present). Trusting 743 “randos on the internet” to safeguard “my” data, and give me access to use it. Insanity. Agent-Centric systems where I retain signing keys to authorize access to (and transactions using my) data are the way forward. A Key Fob (like you have for your car) is not onerous, and methods for recovery using trusted community members is practical. Holochain (and the Holo project) are good examples of working implementations.
- mminer237 3y agoI mean, either those services need your data or they don't. I don't see how requiring you to upload or decrypt your data every time you want to use a service would be feasible for most things.
- pjkundert 3y ago743 x: - Addresses that are wrong - Passwords stored (probably insecurely) - Other personal data that can be stolen If they "need it", they can be granted access to it (or a personally encrypted copy of it unique to them). Of course they can (and likely will) mis-manage even this data; Zero-Knowledge Proofs and Homomorphic Encryption should be used instead, where possible. Remember, Public data written by an Agent are written to the DHT and are persistenly available, so "upload and decrypt" isn't really usually a thing in Holochain hApps. So, if they want to make some non-repudiable claim under the auspices of "my account" (ie. claim agency on my behalf over some change of state, such as a "post" under my name, ...), then they can bloody well get me to sign such a state change with my private key. And, make all such data publicly available so that I (by my sole decision) can cease to use their service and take my data elsewhere. Remember -- these are "randos on the internet" holding your data. Hundreds, or possibly even thousands of them including all the partners they sell your harvested data to, who are evidently incompetent in managing/securing it, and certainly don't care a whit about you and the sanctity of your data.
- orthecreedence 3y agoMy main issue with Holochain and agent-based systems is that I am the agent, but the system is built around my singular device being the agent. Now the work on linking my devices and convincing other "agents" in the system that these collections of keys represents "me" is forced back onto me. In other words, agent-device-based identity is a crappy experience for some mixture of end-users and/or devs. Either the user has to manage muiltiple identities, or the devs have to build an ad-hoc identity systems on top of the agent-device-based system. I think PGP got about halfway there, but falls short in a lot of ways.
- freitzkriesler2 3y ago2fa and always having to enter a pin for credit/debit cards is simply a way for banks to refuse to refund fraud. Because no one has ever hacked 2fa and stolen a pin before /s
- zeptonix 3y agoInteresting that the article picks Notion as its example. For me too it seems like I am initially NEVER logged in no matter how often I login to Notion.
- 0xbadcafebee 3y agoNote that all uses of the password before the computer were not for personal security, but organizational security. If the enemy infiltrated without the use of the password, it could mean the downfall of an empire. Today we use passwords largely for personal security. Yet when companies choose what methods of authentication/authorization they offer, they don't care what the user wants. They pick methods that will make their own jobs easier, rather than giving the user more convenience. The user has no agency today; it's just take what they give you and be thankful for it. As a result, the tech landscape is full of wildly varying authn+z methods. Inconsistent password policies, inconsistent challenge methods (when they exist), inconsistent use (and types) of MFA, inconsistent use of hacker-prevention methods, the occasional use of single sign-on for only a few identity providers, "magic login email links", nearly non-existent use of client-side keys, etc etc. Almost every site you login to today will have a different system. Passkeys aren't much better, because it too is just a hodge-podge of different standards, not all of which need to be supported. We need more consistency for the methods that exist. There should be a standard for challenge questions, a standard for hacker-detection, a standard for password policies, a standard for MFA, etc. That way it will be a little less haphazard how everyone implements them, and it will be easier to prevent security bugs by following the guidelines for implementing the standard. But I also think more should be done to advocate for what the user wants. If the user wants to use a regular password, let them enable it. If the user wants to disable MFA, let them disable it. If they want to opt-out of the multi-layered hacker-detecting challenge-questions, let them opt-out. This is, after all, their personal security, not the security of the entire company selling them some service or product. A person should be able to decide their personal security level. Alas, we don't really have much choice in what current companies give us. But if we voice our opinions loud enough, maybe new companies will give us the agency we want, and maybe that tiny competitive edge will prompt other companies to match them.
- fragmede 3y agoThe "standard" is to have someone else deal with it. Login with Auth0/Apple/Facebook/Google/GitHub/Microsoft/GitHub/Twitter/etc is that.
- 3y ago
- Karellen 3y ago> Gileadite soldiers used the word "shibboleth" to detect their enemies, the Ephraimites. The Ephraimites spoke in a different dialect so that they would say "sibboleth" instead. Experience : you just had to say a word. Security : there's a single word to authenticate multiple users and it can be cracked by learning how to spell it. Although that's roughly how the Wikipedia entry[0] summarises it, the actual wording of the story indicates a slightly different issue: > for he could not frame to pronounce it right. It's not a spelling difference per se, it's (AIUI) that the Gileadite pronunciation uses a phoneme that was not used at all in the Ephraimites spoken language, so an Ephraimites soldier was literally incapable of pronouncing the word "correctly". e.g. How some spoken dialects/accents do not use a rhotic "r", or do not distinguish between "l"/"r", or are not tonal languages. If you have not already learned how to make that specific sound, and distinguish it from the other one, through repeated practice, you will be unable to replicate it properly. And this will be the case no matter how the word is spelled, or even if you try to immediately copy someone saying it the exact way they want you to say it. [0] https://en.wikipedia.org/wiki/Shibboleth https://en.wikipedia.org/wiki/Shibboleth
- tsm 3y agoSee also: the Parsley Massacre in the Dominican Republic, which preyed on Haitians' inability to pronounce the word "perejil" as a native Spanish speaker would: > The Haitian languages, French and Haitian Creole, pronounce the r as a uvular approximant or a voiced velar fricative, respectively so their speakers can have difficulty pronouncing the alveolar tap or the alveolar trill of Spanish, the language of the Dominican Republic. Also, only Spanish but not French or Haitian Creole pronounces the j as the voiceless velar fricative. If they could pronounce it the Spanish way the soldiers considered them Dominican and let them live, but if they pronounced it the French or Creole way they considered them Haitian and murdered them. https://en.wikipedia.org/wiki/Parsley_massacre https://en.wikipedia.org/wiki/Parsley_massacre
- selimthegrim 3y agoCase in point - Hebrew lost “Ghayin” way back in history so the Hebrew for Gaza is “’Aza” (with ‘Ayin)
- bufordtwain 3y agoI find myself wondering, how much collective time is being lost these days to authentication? I mean, if you have to authenticate using your phone, you have to dig it out of your pocket, sign into the phone, read the text message or use the authenticator app, type in the code...
- ijhuygft776 3y agoAnd how much time is being wasted on authentication when they don't accept valid credential because you cleared your cookies or changed IP or whatever?
- deleted 3y ago[deleted]
- patrulek 3y ago"I, like most people, hate passwords..." Citation needed.
- strickjb9 3y agoCan we talk about having your account locked from a website because a bot attempted to login using someone's email address?
- switch007 3y agoMy biggest pet-peeve is when they just ask for your email address, then on the next page inform you they've emailed you a one-time login code, and then you need to hunt for the link in small text along the lines of "Log in with a password instead".
- mooreds 3y agoWeird post. It's a good history of authentication, including offline and online, and I like the ratings. But the title seems like pure click bait, as the author didn't spend more than 2 sentences on passkeys/Webauthn (which is the typical tech for passwordless solutions nowadays). I have my own issues with Webauthn usability and was expecting a deeper dive into that. That larger problem, of course, is that security and ease of use are in tension. Always were, always will be.
- alabhyajindal 3y ago90 days timeout for a login session seems very decent. Why is logging back into a service once every 3 months even an issue?
- wffurr 3y agoSMS-based 2FA is still vulnerable to phishing, but U2F is not. This has been solved for a while now, but I guess it's still a hassle for most folks to use them. I got my whole family Yubikeys a while back, and it seems to be going pretty well.
- cogman10 3y agoHow do you backup access? The one thing that's stopped me from pulling the trigger on U2F is if that device is lost, stolen, or broken then I'm hosed, right? With standard 2FA, I have backup devices and codes that I can start restart from scratch if my phone is ever lost/stolen/broken.
- wffurr 3y agoWrite down your backup codes. Register a second key if possible. Google accounts are set up to prompt phones, too. In some cases we still have SMS 2FA enabled.
- happyopossum 3y agoBackup codes and (in my case) backup keys. In the corporate world, the backup codes can be generated and shared on-demand, or U2F temporarily disabled if ID can be verified another way.
- imzadi 3y agoSomething that often gets overlooked in these discussions is the impact of all this on older people and people with intellectual disabilities. Managing all of this is annoying to an average person, but can literally be impossible for an older person with a memory disorder. It creates a lot of additional vulnerability for them, because they now need to trust someone to help them manage their accounts. It also puts a heavier burden on people in customer service who have to deal with often irate older customers who are having trouble managing their accounts.
- itschrisyoko 3y agoI very much wish more people considered the various types of users and contexts that use their system. Many seem to be moving towards a "magic link" solution, which can be convenient but is also predicated on the user's phone or email which leaves users with a single point of failure and little additional protection or recourse if it is exploited. While I understand the burden on organizations to protect user data, the user should have say as well. A one-size fits all solution almost always leaves users on the lower slopes of the bell curve vulnerable or frustrated.
- bombcar 3y agoThis is getting exceptionally bad, where places like the SSA are moving to "online-only" for basically everything, and the ability to go to a local office and have someone help you is getting rarer and rarer. And even if you can get in-person with someone, the new "secure" systems may block them from being able to help, anyway.
- BeetleB 3y agoMy work just replaced our VPN app (which required a password) with something that they excitedly promised would provide us "passwordless login!" Lo and behold, it uses 2FA. Periodically I have to go get my phone[1] just to do my work. Way more friction than typing in the password. [1] No, I don't keep my phone on me all the time. It usually just sits in some random room at home.
- arwineap 3y agoThey are managing their liabilities, as is standard industry practice. I'm surprised your workplace did not have 2fa until now
- BeetleB 3y agoNot arguing that 2FA isn't more secure. But don't promise a smoother driving experience by removing speed bumps and replacing them with stop signs.
- nsxwolf 3y agoOur VPN login used to be type your password, then accept the push notification from Duo. Now we decided push is insecure, so you now have to type "<your password>,<Pin from Duo>" as your password. The starred-out password field plus my blank keycaps are a real test of my touch-typing ability.
- jhartwig 3y agoI love the theme of this blog but the side bar just disappears when scrolling which is kinda jarring.
- mavhc 3y agoI can't login to a website from my desktop any more because I enabled passkeys, and my desktop doesn't have bluetooth to talk to my phone. Nor does anyone say what version of bluetooth is required
- happyopossum 3y agoWhy would you use a passkey manager that required a phone and BT? that's nuts.. 1password and Safari both handle syncing passkeys between all your devices - no device swapping needed.
- mavhc 3y agoIt's the default. Isn't putting your private keys on the internet the thing we're trying to avoid?
- 1B05H1N 3y agoFraud is a huge driver of this. The need for high friction is here as more people are issuing chargebacks, hackers are getting more bold, etc.,. Source: I work in ecommerce.
- INTPenis 3y agoIf the author is reading this, sorry but I spaced out when you started going into the history of passwords. When you say passwordless in this day and age my thoughts go straight to hw keys. And speaking of hw keys I started using one alongside my gpg password for my personal password manager a year ago. After 1 year I removed the hw key from the list of keys. My experience is that it's more of a hassle to reach for a hw key every time I need to view a password, than it is to just enter a very long passphrase. I'm of course special to be able to remember multiple very long passphrases, but as long as I do it's much more convenient. Then it also got me thinking, what if I had gone 100% hw key and lost the key? Then my passwords are lost forever. It's much harder to lose the passphrase in my head.
- digging 3y agoOh, this was disappointingly light on substance. It's an interesting musing on the history of passwords and the (very real) frustrations of modern authentication. I thought it would have more depth though into the current state of various authentication schemes, in particular passwordless, which isn't actually mentioned at all. I find passwordless to be slightly less bumpy than various 2FA but still a genuine pain in the ass, to have to open up email in a second tab, wait for the email to come through, and then often follow a dubious link.
- Hydrocarb0n 3y agoYou are a pavlovian dog, 2FA is just reporting to uncle Sam, It binds the biologic to the transaction, no plausible denieability. Great for securely buying Pizza but not so much for the future of humanity.
- jokingjust 3y agoIts a joke how bad a future white people have ahead of them. Even their best here are hopelessly clueless about the situation they are entering into.
- yungporko 3y agoanything other than username/email + password is stupid bullshit, i don't care what any cybersecurity nerd says.
- lil-grandson 3y agoFreakin Chipotle has mandatory 2FA. Blows my mind how thoroughly I need to authenticate myself to order a dang burrito.
- calderwoodra 3y agoSurprisingly, Chipotle is it's own layer of hell with it comes to auth. Every time I need to sign-in, I need to reset my password.
- bombcar 3y agoMcDonald's, Taco Bell, and Dominos apps seem to be the best, everything else ends up in login hell (though I suspect I have two McDonald's and Taco Bell accounts from before they added Apple login). Some are literally so bad I just won't use them anymore. All most of these things need is basic authentication, set some long-lived whatever it is based on the Secure Enclave, and if then don't allow seeing the charge method or changing the delivery address without requiring some second factor. You don't need full bank-level security for a burrito (amusingly enough, my bank security is more based on normal things than the burritos are).
- justanorherhack 3y agoI just opened a ticket with notion on mobile and plan on switching because I can’t use it for simple notes. This is the amount of steps it takes to login and you have to do it all the time: * unlock your phone * tap notion * you're logged out - avoid the big login with x sso buttons, scan for and click the little text that's black on black labeled "login here with email" * type my email out (no autofill) * tap submit * exit app, open mail * find the notion email, usually it's right there other times, you must refresh constantly, sometimes it takes whole minutes because it's email * highlight as much of the password as you are able but not all of it because you can't due to the dashes * adjust highlighted text while holding down long enough to pop up the copy context window or memorize a cute phrase with dashes and type it out without making a mistake, 3 taps a dash (x4) because mobile keyboard layering * hit copy, exit app, open notion * press and hold in the textbox for the paste window or type it out * finally hit paste and submit * remember what you were trying to do quickly Now add slow or glitchy(5g+) internet and it doesn’t work. Even if you wanted to tie yourself permanently to an sso provider, a lot of the time, they too require re auth. If you have 2fa on (as you should) that's as many steps. The push for sso is also incredibly annoying. I’ve nearly deplatformed very intentionally. Notion does a lot of funky things like refuse to build and offline mode which exacerbates this. One other thing I don’t like about “passwordless” is biometric as a security feature instead of it as a convenience. 1Password removed passcode unlock on mobile in favor of faceid. Which if you don’t use it results in entering your full long password every time you use it, even if you just used it. Apparently I wasn’t the only one that complained because they restored the feature shortly after removing it. I unlock my friends phones while they are driving with faceid all the time. Too easy, not secure enough for the app that has most of my secrets. Use 2fa, local passcodes that require reauth occasionally, and assume you are running on a locked device, if logging in from a new place maybe 3fa like Coinbase.
- bombcar 3y agoThis is the main problem - I want the ability to say "this app should be authenticated whenever my phone is unlocked" - I trust that the timeouts on my phone will protect me from the unlikely "grab" attack, and I can remotely lock it anyway. I do NOT want to have to sign in a billion times a day, even if it's relatively quickly with FaceID or similar.
- latchkey 3y agoIt is really hard to read that article on a site where 20% of the page is covered by a cookies warning with only an "OK" button. Talk about hell.
- krupan 3y agoWe have all been using physical keys for our homes and cars our whole lives. Physical U2F keys for digital authentication are basically the same level of convenience and actually very very secure: no shared secrets, not copyable, not forgeable, not vulnerable to phishing, etc. I don’t know why we haven’t all jumped on this solution to digital authentication
- pphysch 3y agoTheoretically it's a good solution, but practically it's an enormous task to migrate all existing digital infrastructure into a new hardware security paradigm.
- sigwinch28 3y agoI can get any proficient locksmith to open my front door with valid photo ID. In a pinch I can get in using a brick, a window, and a good throw. The police might turn up or they might not. With 2FA, a lot of times I’m going to go through endless technical support, or I will be told it’s simply “not possible” for me to regain access to my accounts. There’s a third tier here, which is 2FA at work. If I lose a 2FA token I can usually get the IT or security team to let me back into the system because they’re physically present and know who I am.
- kevincox 3y agoI have like 2 or 3 physical keys. I have accounts on hundreds of websites. Sure, you can use the same key on every website but you better not lose it. So now you need to register multiple keys on every website. Also if you lose one you need to go back to every single site and add your replacement. (I hope you remember every site you have signed into.) So "not copyable" is actually a huge downside for convenience. Such a downside that even though I have a collection of U2F keys I only use them in a handful of accounts. The maintenance cost is just far too high. To resolve this you would probably need something like cross-signing. So I can say "I know that you only trust key A, but I lost it a few years ago. However I have an attestation from key A saying that key B is mine as well. Here is a signature from key B". However this is effectively equivalent to copying keys. So it basically defeats that point.
- 3y ago
- 1970-01-01 3y agoAuth is like paint. Adding more layers can make it better or worse.
- walteweiss 3y agoI have an iPhone that fell, and its fingerprint reader doesn’t work any longer. It simply cannot recognise my fingers, or it does recognise the finger once in like 50 attempts. I was unable to trace what I did and how much I pushed that sensor. I turned the biometrics off and use passwords instead. It’s less convenient, but I’m not planning to upgrade the phone for that very reason either. So I’m stuck with this for a while. I cannot imagine how passkeys are going to work in this scenario. This, and also brand dependency, is what makes my worried about passkeys. If I got the idea correctly. It hashes my fingerprint data, but what if my fingerprint changes? I have that very often on my iPad that it stops seeing my thumbs as the correct thing. I assume that happens due to some manual work I may do. And my thumb becomes different to the sensor. I hack that with my pinky finger, for some reason it’s more reliable. But what if something happens to the sensor and it stops being reliable. What are my options then? What are my options if I’m about to change my smartphone brand? What are my options if I’m on my PC that has no sensors for any biometrics?
- apitman 3y agoI'm currently unable to log in to my Amazon account on new devices because I accidentally deleted the MFA for it. I've submitted my government ID to their recovery form multiple times. No response. Phone customer support said they couldn't do anything. Any ideas?
- senectus1 3y agoThis is why I run passwordless on my most high value/important services and use my password manager to hold passwords for all the end point services like ebay and other low / risk low expectations sites. for me its about lowering the price to use a service. (as in mental price not dollar value)
- AlienRobot 3y agoI've had a personal Google e-mail account for decades. I never worried about losing access to it. Until the day I enabled 2FA on it. You can't get my personal e-mail password out of my mind but you can get my smart phone out of my hand. I've used half my backup codes by now.
- ranguna 3y agoLots of people having lots of issues in the comments, I can't be the only one that has no problems with this. I use bitwarden, it has my passwords and my TOTP codes in there, I have this on my phone and on my computers, everything auto fills. Other than that, I also have a hardware key for some services, all I need to do is click the hardware key when prompted. Some services only have email 2FA, but that's quite easy as well, I just get a notification and copy the code from there. Doing a chain of 3 2FAs for 3 different services takes seconds. For improved security this is easy, I'm not sure what everyone is on about. Is this another case of complaining just for the sake of it?
- soerxpso 3y agoWhat really annoys me lately is websites which require me to verify my login by email, but which also allow me to change my password by email without knowing the old password. It seems to be an attempt at "2FA" but it ends up being 1FA, and even less secure than if they'd just accept my password on its own. A friend of mine recently got caught in a loop where he wanted to interact with an account that he hadn't used in a long time, which was registered under an email he hadn't used in a long time, which had a recovery email set which he also hadn't used in a long time. He had the passwords written down for all three, but account A refused to let him in without an email verification (but would let him in without a password, if only he could access the email), and email A wouldn't let him in without proving he had access to email B, which wouldn't let him in without proving he had access to email A. A person who wandered into a logged-in computer with access to email B could theoretically have done anything they wanted to all 3 accounts, password or not, but the rightful owner was forbidden from using any of them, despite knowing all the passwords. I miss the days of, "You have a password, and we'll assume anyone with that password is you. Don't get phished." It's actually pretty easy not to get phished, and sometimes downright impossible to go through the hoops that all of these new anti-phishing measures require. A service I stumbled into recently which I think does it right is Mullvad. They've taken it a step further and done away with usernames, too. They just give you a long numerical code and tell you that if you lose it, you're screwed. It feels much more respectful to the user.