4 ms·

I understand the frustration with login systems, but why is the title "Passwordless: A Different Kind of Hell" if it doesn't talk about passwordless authenticat

I understand the frustration with login systems, but why is the title "Passwordless: A Different Kind of Hell" if it doesn't talk about passwordless authentication, like passkeys, magic links, and biometrics?

davidmurdoch 3y ago
It talks about passkeys and biometrics though.
- gipp 3y ago
  At the very end, as possible alternatives to the hell they're describing.
  - mimsee 3y ago
    Yeah and would passkeys themselves prevent the session from expiring? Notion et al can still have short lived sessions on their client apps.
    - gipp 3y ago
      Yeah I'm not saying anything about the truth of that, just that the title doesn't match the content
charles_f 3y ago
I was confused as well. It seems to me that by lowering the experience complexity, while not really changing security, by the author's own logic the experience stars would go up a notch. Instead they just mention it in passing with a "only time will tell" comment
felipeccastro 3y ago
I was curious about that as well. Since most services implement an email based Forgot Password feature, and 2FA tokens are also often email based, why isn't magic links the default approach now? Seems to be just as secure as password+2FA but easier to use (and probably to implement, as well). By the title, I thought the article would explore some of the downsides of this approach that I might be missing.
- Macha 3y ago
  Magic links are not the default as it gives your login process the speed and reliability of email delivery and most login processes are aiming for better than a p95 of about 5 minutes.
Sohcahtoa82 3y ago
> biometrics Biometrics are a convenience feature, not a security feature. Fingerprints are trivial to lift and replicate. Face unlocks can be fooled by pictures, or in some cases, get false positives from people that just look enough like you (which is common in some Asian countries). Even if it requires you to blink, new AI tools will easily generate a video of you looking around and blinking. But the worst part about it all, is that biometrics are a password you can't change without surgery. I really REALLY wish "biometrics" would stop coming up as a solution to security.
- firejake308 3y ago
  Agree with the insights in your comment about biometrics != security, but I'd like to take a moment to nitpick a slight inaccuracy-- Asian faces don't actually look similar to each other, but they do look similar to a person/model that has been trained mostly on white faces. If the facial recognition model had been trained predominantly on Asian faces, then white faces would look similar to each other instead. Reminder that the outputs of AI don't reflect some deeper truth about reality, just an extrapolation of the training data. Garbage in, garbage out.
  - justincredible 3y ago
    [dead]
  - Affric 3y ago
    > don’t actually look similar to each other I think this should be “more similar than other groups” rather than simply “similar”. Even then I think it’s possible that some groups have more loci with higher diversity for facial features. That’s not even getting to epigenetic and environmental elements. I think the deeper truth is in your final paragraph: facial similarity is in the eye of the beholder.
- kube-system 3y ago
  Low security is security too. Biometrics can useful when used for appropriate applications. They're very useful in applications where authentication would be otherwise be omitted or undermined due to usability concerns. They can also be used in conjunction with other authentication methods to complement the flaws of other authentication methods, like passphrase or token, which can be shared more easily. Like with many things pertaining to security, there are no universal solutions without first defining the problem. Say for instance, you have an access control system where you want to solve the issue of credentials being intentionally shared. Biometrics are a great solution for this; tokens and passphrases are not. You need different tools for different problems.

davidmurdoch 3y ago

It talks about passkeys and biometrics though.

gipp 3y ago
At the very end, as possible alternatives to the hell they're describing.
- mimsee 3y ago
  Yeah and would passkeys themselves prevent the session from expiring? Notion et al can still have short lived sessions on their client apps.
  - gipp 3y ago
    Yeah I'm not saying anything about the truth of that, just that the title doesn't match the content

charles_f 3y ago

I was confused as well. It seems to me that by lowering the experience complexity, while not really changing security, by the author's own logic the experience stars would go up a notch. Instead they just mention it in passing with a "only time will tell" comment

felipeccastro 3y ago

I was curious about that as well. Since most services implement an email based Forgot Password feature, and 2FA tokens are also often email based, why isn't magic links the default approach now? Seems to be just as secure as password+2FA but easier to use (and probably to implement, as well). By the title, I thought the article would explore some of the downsides of this approach that I might be missing.

Macha 3y ago
Magic links are not the default as it gives your login process the speed and reliability of email delivery and most login processes are aiming for better than a p95 of about 5 minutes.

Sohcahtoa82 3y ago

> biometrics Biometrics are a convenience feature, not a security feature. Fingerprints are trivial to lift and replicate. Face unlocks can be fooled by pictures, or in some cases, get false positives from people that just look enough like you (which is common in some Asian countries). Even if it requires you to blink, new AI tools will easily generate a video of you looking around and blinking. But the worst part about it all, is that biometrics are a password you can't change without surgery. I really REALLY wish "biometrics" would stop coming up as a solution to security.

firejake308 3y ago
Agree with the insights in your comment about biometrics != security, but I'd like to take a moment to nitpick a slight inaccuracy-- Asian faces don't actually look similar to each other, but they do look similar to a person/model that has been trained mostly on white faces. If the facial recognition model had been trained predominantly on Asian faces, then white faces would look similar to each other instead. Reminder that the outputs of AI don't reflect some deeper truth about reality, just an extrapolation of the training data. Garbage in, garbage out.
- justincredible 3y ago
  [dead]
- Affric 3y ago
  > don’t actually look similar to each other I think this should be “more similar than other groups” rather than simply “similar”. Even then I think it’s possible that some groups have more loci with higher diversity for facial features. That’s not even getting to epigenetic and environmental elements. I think the deeper truth is in your final paragraph: facial similarity is in the eye of the beholder.
kube-system 3y ago
Low security is security too. Biometrics can useful when used for appropriate applications. They're very useful in applications where authentication would be otherwise be omitted or undermined due to usability concerns. They can also be used in conjunction with other authentication methods to complement the flaws of other authentication methods, like passphrase or token, which can be shared more easily. Like with many things pertaining to security, there are no universal solutions without first defining the problem. Say for instance, you have an access control system where you want to solve the issue of credentials being intentionally shared. Biometrics are a great solution for this; tokens and passphrases are not. You need different tools for different problems.