3 ms·

> Most people do not want to do this Yes, and I think that's not because they don't want to do it but because: 1) they don't know that they should do this; 2)

> Most people do not want to do this Yes, and I think that's not because they don't want to do it but because: 1) they don't know that they should do this; 2) they don't know why should they do this; 2) they don't know how to do this; 3) because even the systems marketed as current state-of-art (Passkeys) are poorly designed and don't even allow to have proper 3-2-1 backups conveniently (can't enroll a device sitting in a safe, it must be physically brought online which beats the whole point of offsite backups). Design it to make backups and failover secure yet easy, available out-of-box, and explicitly recommending best practices to follow - and everyone will do it as a no-brainer, at least for anything they care about. Until recently no one told people to not reuse passwords. Even today most password-based signup forms just ask for password and maybe tell the requirements (length, characters) but extremely rarely they explain anything about uniqueness, randomness or anything else. No surprise it sucks hard in practice, when nearly everyone ignores the education aspect. People aren't stupid. At least in general. They're just blissfully unaware about a lot of things, especially the older generations. What is impossible in real world is designing a fantasy football nanny authentication system to "safeguard" them, without making a lot of undesirable sacrifices. We manage to explain people to not poke with scissors into electrical outlets (and make it hard to do so accidentally) - we can manage similar stuff with computers too.

Vegenoid 2y ago
> We manage to explain people to not poke with scissors into electrical outlets (and make it hard to do so accidentally) - we can manage similar stuff with computers too. I don't think this is a good analogy, because the example is simply warning people of a thing not to do. It takes no effort. Maintaining backups does take effort. This is more like getting people to pick up a new chore, just like how many people see interacting with their bank and financial services as a chore. Many people who work in IT (or are into computers as a hobby) discount the effort it takes, because there is a lot less friction between them and computers than for the average person. > even the systems marketed as current state-of-art (Passkeys) are poorly designed and don't even allow to have proper 3-2-1 backups conveniently (can't enroll a device sitting in a safe, it must be physically brought online which beats the whole point of offsite backups). Design it to make backups and failover secure yet easy, available out-of-box, and explicitly recommending best practices to follow - and everyone will do it as a no-brainer, at least for anything they care about. People have been saying this for a long time. "We just need a better system!" The system doesn't exist because people don't want a system that requires effort. It requires effort to protect a secret that, if leaked or lost, would irreversibly result in your financial ruin. It requires a lot less ongoing effort (to a non computer savvy person) to use financial institutions to store their money securely. People will choose the system that safeguards them and makes sacrifices that many computer security and freedom oriented people will find undesirable. This is demonstrated by the choices that people have repeatedly made.
- drdaeman 2y ago
  I strongly disagree, but I feel that the conversation would be pointless fight of beliefs, unless I actually design and showcase a solution that would be simple yet secure (and I don't want anything that takes effort) - but that will take me a while to work on. The idea is that user shouldn't have any friction, besides meeting minimal requirements: 1) being capable of reading (or otherwise accessing the text) and comprehending simple instructions; and 2) having certain minimally required hardware or software installed. I'm sure this is doable and every primitive to build this already exists and vetted by competent people. I'm sure it's possible for a layman non-technical person with normal cognitive capabilities to have a safe authentication solution (which is very different from data backups) with full ownership of their identities and credentials. Sure there are people that cannot read or cannot comprehend things. A lot of people. I've seen way too many folks who had simple and clear ELI5-grade instructions with zero technical jargon - and nonetheless had failed to follow them because "computers hard". In some case it's the fault of UI or UX, but I strongly believe in most cases it's just learned helplessness - "computers are not my thing and they're hard" and brain shuts off instead of even trying to read. The only solutions are to 1) make them actually interested in achieving their goals (worked for my dad - man went from "I don't know and don't understand [and 'I don't want to' in the tone], order this for me" to suddenly figuring it all out and placing online orders in just a few minutes as soon as he actually needed something when I wasn't around to help), and 2) make sure they have all materials accessible, well structured and covering as many possible scenarios as possible so it's all there the moment they snap out of their learned helplessness. Nothing else works as it is fundamentally impossible to design anything that would work even if people don't read and don't think. I have some sketches in my mind, specifically focusing on use by laypeople without making compromises about fundamentals (like what is identity - a lot of modern auth perverts this concept badly). I'll give it a try someday, actually drawing it all and writing notes on the inner workings. Wish there'd be a ten of me and we'd have 240 hours a day... Sorry. > This is demonstrated by the choices that people have repeatedly made. I'm afraid this is a very bad attitude to follow. The choices people had repeatedly made got us in quite a bad place. Just look at the poster child - IoT - it's a complete disaster. Online auth is in a very similar poor and messed up state, it just less visible.
  - 2y ago
einhverfr 2y ago
Not reusing passwords at all is pretty impractical. If you really want to depend on a single password manager then you have some other issues. Usually I have settled for rotating, compartmentalized password modules which allows me to somewhat rather than fully contain a compromised password. And if your modular password has three slots (term taken from linguistics) then you can compose passwords which reuse parts, are memorizable, and not automatically reusable on other services. The problem though is that since one has a number of passwords which may be different but closely related, a human may be able to infer a few possible passwords from a few compromised ones. In other words it still dramatically shrinks the key space an attacker might want to try to brute force. Preventing re-use is then a problem for 2fa regimes. For my part I won't use passwords I cannot memorize and keep memorized in relation to the web site.

Vegenoid 2y ago

> We manage to explain people to not poke with scissors into electrical outlets (and make it hard to do so accidentally) - we can manage similar stuff with computers too. I don't think this is a good analogy, because the example is simply warning people of a thing not to do. It takes no effort. Maintaining backups does take effort. This is more like getting people to pick up a new chore, just like how many people see interacting with their bank and financial services as a chore. Many people who work in IT (or are into computers as a hobby) discount the effort it takes, because there is a lot less friction between them and computers than for the average person. > even the systems marketed as current state-of-art (Passkeys) are poorly designed and don't even allow to have proper 3-2-1 backups conveniently (can't enroll a device sitting in a safe, it must be physically brought online which beats the whole point of offsite backups). Design it to make backups and failover secure yet easy, available out-of-box, and explicitly recommending best practices to follow - and everyone will do it as a no-brainer, at least for anything they care about. People have been saying this for a long time. "We just need a better system!" The system doesn't exist because people don't want a system that requires effort. It requires effort to protect a secret that, if leaked or lost, would irreversibly result in your financial ruin. It requires a lot less ongoing effort (to a non computer savvy person) to use financial institutions to store their money securely. People will choose the system that safeguards them and makes sacrifices that many computer security and freedom oriented people will find undesirable. This is demonstrated by the choices that people have repeatedly made.

drdaeman 2y ago
I strongly disagree, but I feel that the conversation would be pointless fight of beliefs, unless I actually design and showcase a solution that would be simple yet secure (and I don't want anything that takes effort) - but that will take me a while to work on. The idea is that user shouldn't have any friction, besides meeting minimal requirements: 1) being capable of reading (or otherwise accessing the text) and comprehending simple instructions; and 2) having certain minimally required hardware or software installed. I'm sure this is doable and every primitive to build this already exists and vetted by competent people. I'm sure it's possible for a layman non-technical person with normal cognitive capabilities to have a safe authentication solution (which is very different from data backups) with full ownership of their identities and credentials. Sure there are people that cannot read or cannot comprehend things. A lot of people. I've seen way too many folks who had simple and clear ELI5-grade instructions with zero technical jargon - and nonetheless had failed to follow them because "computers hard". In some case it's the fault of UI or UX, but I strongly believe in most cases it's just learned helplessness - "computers are not my thing and they're hard" and brain shuts off instead of even trying to read. The only solutions are to 1) make them actually interested in achieving their goals (worked for my dad - man went from "I don't know and don't understand [and 'I don't want to' in the tone], order this for me" to suddenly figuring it all out and placing online orders in just a few minutes as soon as he actually needed something when I wasn't around to help), and 2) make sure they have all materials accessible, well structured and covering as many possible scenarios as possible so it's all there the moment they snap out of their learned helplessness. Nothing else works as it is fundamentally impossible to design anything that would work even if people don't read and don't think. I have some sketches in my mind, specifically focusing on use by laypeople without making compromises about fundamentals (like what is identity - a lot of modern auth perverts this concept badly). I'll give it a try someday, actually drawing it all and writing notes on the inner workings. Wish there'd be a ten of me and we'd have 240 hours a day... Sorry. > This is demonstrated by the choices that people have repeatedly made. I'm afraid this is a very bad attitude to follow. The choices people had repeatedly made got us in quite a bad place. Just look at the poster child - IoT - it's a complete disaster. Online auth is in a very similar poor and messed up state, it just less visible.
- 2y ago

einhverfr 2y ago

Not reusing passwords at all is pretty impractical. If you really want to depend on a single password manager then you have some other issues. Usually I have settled for rotating, compartmentalized password modules which allows me to somewhat rather than fully contain a compromised password. And if your modular password has three slots (term taken from linguistics) then you can compose passwords which reuse parts, are memorizable, and not automatically reusable on other services. The problem though is that since one has a number of passwords which may be different but closely related, a human may be able to infer a few possible passwords from a few compromised ones. In other words it still dramatically shrinks the key space an attacker might want to try to brute force. Preventing re-use is then a problem for 2fa regimes. For my part I won't use passwords I cannot memorize and keep memorized in relation to the web site.