3 ms·

What would passwords move past too? A device people lose? Some specifications everyone argues about and implements differently. Just look at SAML and everyone u

by pixl97 3mo ago

What would passwords move past too? A device people lose? Some specifications everyone argues about and implements differently. Just look at SAML and everyone using slightly different terminology. Security is more annoying because the attacks are better than ever.

OroPla 3mo ago
Certificates seemed promising there for a while. I also don't mind hardware keys/cards, but when you have to first enter your password, then your pin for your hardware key and then touch the hardware key it gets ridiculous again. Not a fan of biometrics, though, as that cannot be changed trivially. Ideally, authentication should happen like entering a building. You do that _once_ at the beginning of a day by swiping your card or unlocking a door and then it is done and you are never asked to do it again for the rest of the day. I don't have to enter a password and a pin for my key to open the door to either my office or my home. Sure, it might be trivial for an attacker to enter the building using different means, but that hasn't prompted us to play security theater around every building entrance.
- pixl97 3mo ago
  >but that hasn't prompted us to play security theater around every building entrance Um, then you're just not going into any secured buildings. There are places where you must always have a badge showing. Or, you must always be with another known member of staff keeping an eye on you. Often these places have locks on every door with access levels. It really just sounds like you're a bit less experienced with security in this case.
  - OroPla 3mo ago
    Notice how none of that is a cumbersome user experience. I put a badge on my person and maybe have someone walk beside me and that's it. I notably do not have to unlock the same door over and over again by first entering a password and then entering a pin and then touching my hardware key. Again and again,.. and again. As for personal experience, the most secure facility I entered so far was a data center. It was not annoying to get in and out of that either, despite a whole lot of security.

by pixl97 3mo ago

OroPla 3mo ago

Certificates seemed promising there for a while. I also don't mind hardware keys/cards, but when you have to first enter your password, then your pin for your hardware key and then touch the hardware key it gets ridiculous again. Not a fan of biometrics, though, as that cannot be changed trivially. Ideally, authentication should happen like entering a building. You do that _once_ at the beginning of a day by swiping your card or unlocking a door and then it is done and you are never asked to do it again for the rest of the day. I don't have to enter a password and a pin for my key to open the door to either my office or my home. Sure, it might be trivial for an attacker to enter the building using different means, but that hasn't prompted us to play security theater around every building entrance.

pixl97 3mo ago
>but that hasn't prompted us to play security theater around every building entrance Um, then you're just not going into any secured buildings. There are places where you must always have a badge showing. Or, you must always be with another known member of staff keeping an eye on you. Often these places have locks on every door with access levels. It really just sounds like you're a bit less experienced with security in this case.
- OroPla 3mo ago
  Notice how none of that is a cumbersome user experience. I put a badge on my person and maybe have someone walk beside me and that's it. I notably do not have to unlock the same door over and over again by first entering a password and then entering a pin and then touching my hardware key. Again and again,.. and again. As for personal experience, the most secure facility I entered so far was a data center. It was not annoying to get in and out of that either, despite a whole lot of security.