3 ms·

Until phones are surgically attached or implanted at birth, they are not secure enough to serve as a login device. It is way too easy for someone to forget thei

Until phones are surgically attached or implanted at birth, they are not secure enough to serve as a login device. It is way too easy for someone to forget their phone or for someone else to steal the phone.

harryf 14y ago
Agreed. But for many cases you don't need something that secure like when you're posting pictures of cats. And many web based logins are not providing a great deal of security either - this approach may actually be an improvement as it makes identity theft via brute forcing redundant.
Seldaek 14y ago
In light of recent password leaks events, I feel much safer leaving my phone on the table than giving my password to any of the major websites. Also this point was addressed in the original article.
- pdx 14y ago
  Why? You still have a password. You now have a password you don't know, that's entered on your behalf by querying some aspect of your phone, but it's still a password in a database that can be compromised if the database is compromised. I now need to pretend to be your phone, instead of pretending to be you, but that's not such a leap, security wise. If some library becomes common and used by multiple sites, now you're even worse off, because now, you have the same "password" on multiple sites, and you are relying on each site salting this "password" for your security. Since you now no longer have the option of using different passwords on different sites, your security is now completely out of your hands and you are at the mercy of each person using this "mobile authentication library" to properly salt before saving it into their database.
  - Seldaek 14y ago
    I don't think this is necessarily a problem. If the model is based on generating a secure (in terms of entropy) token that is then stored on the device or in the iOS cloud it's fine. Every app using that lib has its own token even for the same device.
    - 286c8cb04bda 14y ago
      > If the model is based on generating a secure (in terms of entropy) token that is then stored on the device or in the iOS cloud it's fine. That's about a likely to happen on your phone as any given website is to have secure password handling, eh?
toddmorey 14y ago
Isn't that a problem with phone-based email and apps already? For example, how many people have their email set to ask for a password each and every time and who has the facebook app set to ask for a password each launch? If I had someone's mobile phone, I could easily use the "forgot password" link on most web services and then just pull up the email client.
brianpan 14y ago
On the other hand, if I forget my phone somewhere or it's stolen, I'll probably know within hours, if not minutes. If someone steals my password, who knows how or when I'll find out.

harryf 14y ago

Agreed. But for many cases you don't need something that secure like when you're posting pictures of cats. And many web based logins are not providing a great deal of security either - this approach may actually be an improvement as it makes identity theft via brute forcing redundant.

Seldaek 14y ago

In light of recent password leaks events, I feel much safer leaving my phone on the table than giving my password to any of the major websites. Also this point was addressed in the original article.

pdx 14y ago
Why? You still have a password. You now have a password you don't know, that's entered on your behalf by querying some aspect of your phone, but it's still a password in a database that can be compromised if the database is compromised. I now need to pretend to be your phone, instead of pretending to be you, but that's not such a leap, security wise. If some library becomes common and used by multiple sites, now you're even worse off, because now, you have the same "password" on multiple sites, and you are relying on each site salting this "password" for your security. Since you now no longer have the option of using different passwords on different sites, your security is now completely out of your hands and you are at the mercy of each person using this "mobile authentication library" to properly salt before saving it into their database.
- Seldaek 14y ago
  I don't think this is necessarily a problem. If the model is based on generating a secure (in terms of entropy) token that is then stored on the device or in the iOS cloud it's fine. Every app using that lib has its own token even for the same device.
  - 286c8cb04bda 14y ago
    > If the model is based on generating a secure (in terms of entropy) token that is then stored on the device or in the iOS cloud it's fine. That's about a likely to happen on your phone as any given website is to have secure password handling, eh?

toddmorey 14y ago

Isn't that a problem with phone-based email and apps already? For example, how many people have their email set to ask for a password each and every time and who has the facebook app set to ask for a password each launch? If I had someone's mobile phone, I could easily use the "forgot password" link on most web services and then just pull up the email client.

brianpan 14y ago

On the other hand, if I forget my phone somewhere or it's stolen, I'll probably know within hours, if not minutes. If someone steals my password, who knows how or when I'll find out.