5 ms·
Let’s recap the problem: Passwords don’t work because people can’t remember very much. Password generators don’t work because they have to store the key somewh
by jl2718 3y ago
Let’s recap the problem:
Passwords don’t work because people can’t remember very much. Password generators don’t work because they have to store the key somewhere. Might as well just authenticate with the encryption key. Encryption keys often get lost, so they need to be stored in the cloud, accessible with a password, which brings us back to the first problem, but adds another point of exploit, or ‘lawful intercept’. Phone number second factor doesn’t work because that can be stolen or transferred, and the same device is probably used for password reset. Authenticator apps don’t work because devices can be stolen, and they require a password anyway to transfer to a new device. Biometrics don’t work because they can be cloned, or used on an incapacitated person, and in the case of phone biometrics, they can be overridden with a pin. FiDO devices don’t work because they can be lost or stolen and used by someone else. Social recovery doesn’t work because of moral hazard and probably the only people you trust that much are not particularly savvy with security around this kind of thing. Practically in an app, they would also have to authenticate in some technical manner, so this cascades.
What have I missed?
- laeri 3y agoFIDO/physical keys still work and they are still the best solution. Sure they can be stolen but physical access is much harder to get than digital access. The loss problem is also practically not of importance as a backup key can mitigate this. Also physical loss does not guarantee access to the new owner as they need to know which identity uses the key as well as the password as the key is only the second factor. Best solution would probably be an implant of the physical key which makes it nearly impossible to lose it (apart from the worst case scenario).
- nosefurhairdo 3y agoBitwarden + 2 yubikeys is my solution. I remember one password, keep one key with me, and leave one key at home.
- bloopernova 3y agoIs there a "create duplicate/backup of yubikey" app of some kind? EDIT: How to register your spare Yubikey: https://support.yubico.com/hc/en-us/articles/360021919459 https://support.yubico.com/hc/en-us/articles/360021919459
- alwa 3y agoWait, they suggest saving photos of the QR codes of your TOTP secrets? That seems to weaken the concept by making it easy for an attacker 1) to identify secrets and the sites they’re associated with, and 2) to retrieve them (in plaintext, no less) with no more than access to a device’s photo roll. I thought the idea was that we’d write the secret once to an arbitrary number of primary and backup devices, then destroy it so it can’t be stolen as easily. Although I guess password managers save TOTP secrets alongside the password factor these days too. Does the “the secret itself is not phishable” aspect of TOTP just not actually matter in practice as much as the rapid expiration and frustrating replay attacks / on-the-wire sort of secret interception?
- ubercow13 3y agoHaving the QR in your photo roll doesn't break the 'not phishable' property.
- the_pwner224 3y agoRegular people are incapable of properly managing a key + keeping an up to date backup. You still need to have a recovery mechanism for lost keys.
- zrail 3y agoRegular people have been carrying house keys and/or car keys around for practically their entire lives. A physical key for their computers wouldn't be weird, except it's different than what they're used to.
- the_pwner224 3y agoYou don't need to regularly plug your spare house key into your computer to update the password DB on it. And even with spares people still get locked out and need locksmiths.
- pixl97 3y agoDear sir, what is a locksmith, and why is there so many of them?
- dstroot 3y agoThis. People assume weak security. They think if they lose their house or car key they can get in some other way, or a locksmith can “fix it”, or they can order another car key at the dealer. The concept that if I lose my key I am totally screwed doesn’t align.
- Nick87633 3y agoCar keys are getting a lot more troublesome these days. I see an analogy... if you lose your security device you can pay $XX to get on a call and verify with an account security rep. Of course this can be deepfaked nowadays. Maybe you need to do password recovery in person with a notary! Notary public... the new digital locksmith for password recovery.
- 3y ago
- hospitalJail 3y agoFor lawful things that aren't targeted by major attackers, almost everything you said is fine. For things that are high value or targeted by major attackers, you spend the extra effort on physical keys or a better authenticator system. I can think of a few methods that would make it quite difficult by adding multiple layers. A determined person with a gun might be able to get it, but even then, I have some 'traps'.
- verisimi 3y agoGreat list!
- deleted 3y ago[deleted]
- smolder 3y agoPasswords work to a point, with some effort. Perhaps people just need to expect a level of security that is proportional to their efforts. No free lunch, it's all trade-offs. For people who are not capable of managing it themselves, they will need help or risk ending up victims.
- xg15 3y agoI'd agree with the sibling comments that physical keys are probably still the best option, along maybe with the realisation that without some sort of trust root based on human contact, things don't work. Case in point: we actually have an extremely widely used 2factor system which appears to be working reasonably well for several decades now, despite constant attacks and strong incentives to crack it: Debit cards, PINs and ATMs. Even with the constant threat of skimmers, there hasn't been any mass events of emptied bank accounts so far. Why does it work? My hunch is that two factors play a role: 1) it's based on a physical token, so any attack is necessarily local and needs "people on the ground". 2) there is actually a robust system for recovery and revocation in the shape of bank branches that you can visit, which involve human staff who can apply common sense judgement. Those make the event of a lost card into a nuisance rather than catastrophe. And maybe the second lesson we can learn from the breach: Entrusting the entire collection of passwords of your digital life to a single 3rd party and then allowing that party to upload the passwords to the cloud, in plaintext, does not just superficially appear to be a bad idea that is actually genius because of crypto magic, it is, in fact, a really bad idea.
- Too 3y agoThis is why 2FA is so so important. Something you have physically and something you remember. Doesn’t matter if one of them is weak or can be lost, the combination will be stronger than a single difficult password.
- rrobukef 3y agoOIDC/oAuth seems like the solution: make it somebody else's problem. But OIDC tokens can be stolen, they can change domains because of misconfiguration or bad redirect urls.
- mindslight 3y agoYou've missed that the ultimate problem is this assumption that there even exists one singular "best" way that should be implemented uniformly top-down. Some people will be happy using secure passwords and a local password manager. Others will be happy with no password but an email/SMS challenge. Some will prefer setting up a menagerie of security keys. Any many will prefer different mechanisms for different sites, depending on what a particular site means to them. Infantilizing people and trying to protect them in spite of themselves never works out, but rather just makes for a race to the bureaucratic bottom where everyone suffers death by a thousand paper cuts.
- deleted 3y ago[deleted]