4 ms·

> I don't give a fuck if other people can't manage secure passwords. Sure you do. When your local tax office / hospital / large data holder of your personal da

by growse 2y ago

> I don't give a fuck if other people can't manage secure passwords. Sure you do. When your local tax office / hospital / large data holder of your personal data has an administrative interface that only uses passwords, then the administrator gets fished and your identity stolen, suddenly you care a great deal.

jiggawatts 2y ago
Or they store your password insecurely — plain text or merely “encrypted” with XOR. I still see both of those regularly.
dheera 2y ago
Everything boils down to some password or key (effectively a long password) access to some SQL instance. Anything on top of that is just fluff. The database can still be compromised directly.
- growse 2y ago
  There's a difference between fluffy that's phishable (passwords) and fluff that isn't (webauthn). Not all fluff is equal.
  - dheera 2y ago
    How is Webauth'n Crunch not phishable? Most implementations throw about 20 "recovery codes" at you and at the absolute fucking worst possible moment while the user is trying to do something urgent, they say "save these in a secure place right now". It's not 1, but 20 passwords that ALL give access to your account. Where do you think those codes go? They are not only phishable, but they usually end up in a Google doc, screenshotted and pasted to Notion, or some other insecure place.
    - growse 2y ago
      We're talking about webauthn, not recovery codes.
- hirsin 2y ago
  Keys are _not_ just long passwords. They're asymmetric. Feel free to steal any and all of my webauthn public keys. Heck, here's one: "kty": "EC", "alg": "ECDSA_w_SHA256", "crv": "P-256", "x": "xYkEVgMClD28hXHn5JQjrgjRX3crmr0OhGiWKsLvxUY=", "y": "5lZZGFF6VrVubIHfRhGbvQBGpw6LcbP3/ZBVk7PqH0Y=" It's what you'd get if you somehow got into the db and decrypted it. Now, do feel free to give me your nice symmetric secret password, since it's the same, yeah?
  - dheera 2y ago
    Keys can be symmetric or asymmetric depending on the algorithm. From the standpoint of a non-technical user, they're not any different in nature; a password and a private key are both just strings that give full access to your account. One is easier to remember (password), one is harder to remember (key). The one that is harder to remember usually ends up in a Google doc, iCloud, or saved as a text file.
tshaddox 2y ago
That seems like a separate problem, since no authentication mechanism can somehow force a competence floor onto your local government office. Even if passkeys become the industry standard (or even required by law) your local government office will always rise to the challenge to lose your data, leak your data, sell your data, etc.
- tptacek 2y ago
  Phishing isn't a competence issue. This is well studied. In practice, even security practitioners trained to be vigilant against phishing attacks fall to targeted ("spear") phishing attacks of suitable sophistication; that's the impetus behind phishing-proof authenticators like U2F and WebAuthn. Phishing is a technology issue, not a user issue.
  - frogsRnice 2y ago
    I work in the security space and fell victim to an internal campaign as they sent a very enticing looking email at a point where I was on leave and my grandfather just passed. You simply cannot know what mindset youll be in when you get phished :) Edit: To clarify i was itching to work because it helps distract me from the reality that someone so dear to me was gone forever. I didnt want to cancel leave though because my output would have been absolutely turdy
  - stavros 2y ago
    Can confirm, I know all about cryptography and security and the things, and I still got phished for a bunch of cryptocurrency. The only thing that saved me is that it was in a hardware wallet, so it was physically impossible to steal. Otherwise I was ready to happily paste my private key into the (official-looking) form and domain.
    - DaSHacka 2y ago
      > Otherwise I was ready to happily paste my private key into the (official-looking) form and domain. Sorry, why would you ever disclose your private key to some online forum? I can't see a situation where it makes sense. Clearly there's something I'm not thinking of, so I'm genuinely curious

by growse 2y ago

jiggawatts 2y ago

Or they store your password insecurely — plain text or merely “encrypted” with XOR. I still see both of those regularly.

dheera 2y ago

Everything boils down to some password or key (effectively a long password) access to some SQL instance. Anything on top of that is just fluff. The database can still be compromised directly.

growse 2y ago
There's a difference between fluffy that's phishable (passwords) and fluff that isn't (webauthn). Not all fluff is equal.
- dheera 2y ago
  How is Webauth'n Crunch not phishable? Most implementations throw about 20 "recovery codes" at you and at the absolute fucking worst possible moment while the user is trying to do something urgent, they say "save these in a secure place right now". It's not 1, but 20 passwords that ALL give access to your account. Where do you think those codes go? They are not only phishable, but they usually end up in a Google doc, screenshotted and pasted to Notion, or some other insecure place.
  - growse 2y ago
    We're talking about webauthn, not recovery codes.
hirsin 2y ago
Keys are _not_ just long passwords. They're asymmetric. Feel free to steal any and all of my webauthn public keys. Heck, here's one: "kty": "EC", "alg": "ECDSA_w_SHA256", "crv": "P-256", "x": "xYkEVgMClD28hXHn5JQjrgjRX3crmr0OhGiWKsLvxUY=", "y": "5lZZGFF6VrVubIHfRhGbvQBGpw6LcbP3/ZBVk7PqH0Y=" It's what you'd get if you somehow got into the db and decrypted it. Now, do feel free to give me your nice symmetric secret password, since it's the same, yeah?
- dheera 2y ago
  Keys can be symmetric or asymmetric depending on the algorithm. From the standpoint of a non-technical user, they're not any different in nature; a password and a private key are both just strings that give full access to your account. One is easier to remember (password), one is harder to remember (key). The one that is harder to remember usually ends up in a Google doc, iCloud, or saved as a text file.

tshaddox 2y ago

That seems like a separate problem, since no authentication mechanism can somehow force a competence floor onto your local government office. Even if passkeys become the industry standard (or even required by law) your local government office will always rise to the challenge to lose your data, leak your data, sell your data, etc.

tptacek 2y ago
Phishing isn't a competence issue. This is well studied. In practice, even security practitioners trained to be vigilant against phishing attacks fall to targeted ("spear") phishing attacks of suitable sophistication; that's the impetus behind phishing-proof authenticators like U2F and WebAuthn. Phishing is a technology issue, not a user issue.
- frogsRnice 2y ago
  I work in the security space and fell victim to an internal campaign as they sent a very enticing looking email at a point where I was on leave and my grandfather just passed. You simply cannot know what mindset youll be in when you get phished :) Edit: To clarify i was itching to work because it helps distract me from the reality that someone so dear to me was gone forever. I didnt want to cancel leave though because my output would have been absolutely turdy
- stavros 2y ago
  Can confirm, I know all about cryptography and security and the things, and I still got phished for a bunch of cryptocurrency. The only thing that saved me is that it was in a hardware wallet, so it was physically impossible to steal. Otherwise I was ready to happily paste my private key into the (official-looking) form and domain.
  - DaSHacka 2y ago
    > Otherwise I was ready to happily paste my private key into the (official-looking) form and domain. Sorry, why would you ever disclose your private key to some online forum? I can't see a situation where it makes sense. Clearly there's something I'm not thinking of, so I'm genuinely curious