4 ms·

Many "middle-brow" dismissals here. I think if a mammoth like Google pushes forward strongly enough, it might achieve some results. And it probably takes all i

by gbog 14y ago

Many "middle-brow" dismissals here. I think if a mammoth like Google pushes forward strongly enough, it might achieve some results. And it probably takes all its mass to push this particular piece - the almighty and alstupid password, away. I'll bet that human beings in 20 years, looking back at our times, will point fingers and say "How we have been so silly! Passwords are the worst authentication mechanism, and so obviously flawed! How come did we not use x or y?" I see another thing that they will point fingers at: the human driven cars: this is so frightening, when you think about it. You have this thousands kilogs wheeled machine, driven by almost anyone including drunkyards, grannies, people who just married and people who just divorced, and a sec of inattention and you send families to the grave.

kijin 14y ago
Actually, I think passwords are a brilliant authentication mechanism that will continue to have a place in computer security for many years to come. When used correctly, a password implies the presence of the correct brain. Not a device that can be lost or stolen, not even a fingerprint that can be lifted. Authentication based on information stored in your neural network might not be suitable for everyone, but at least among competent professionals, I don't see mobile phones or USB dongles replacing the passphrase on my PGP key anytime soon.
- gbog 14y ago
  Right, but I was not talking about passphrases giving root access to critical machines or documents. I was talking about passwords for Twitter or HN accounts, or those used heavily in entreprises. I have a friend head of something in a big corp, she says she has at 6 passwords with 6 different policies and has to use them everyday, sometime just to sign the invoice for a new ink cartridge.
- 3JPLW 14y ago
  I agree with your statement with one minor change: a password (or better, passphrase) is a brilliant authentication... Passwords (plural) are just about the worst authentication mechanism. While brains are good at remembering one such token, needing to remember many for many different sites (and which ones go to which) is simply untenable. Additionally, the ability to easily compromise them through phishing makes them awful. I wonder if there'd be a way to cleverly move the hashing (that all servers should be doing) to the client side such that all of the above problems could be solved. It would confound password changes, however...
  - thirsteh 14y ago
    Use a password manager. Random, unique passwords for every site, and one long master passphrase that is stretched by the password manager. With random, unique passwords, resource-intensive server-side hashing provides no benefit. We are doing that because people re-use their passwords everywhere.
  - Groxx 14y ago
    There is. Or, a variety of ways, really. Two major ones: Option 1: your passphrase as a salt + the domain name + bcrypt = password. Lots of detailed schemes exist for this, including ones you can do on a piece of paper with a little math so you don't have to trust your computer. Inventing them seems to be a hobby for crypto people, or something - I've seen many dozens. Option 2: you use random passwords, and store them behind your passphrase somewhere. Password managers. At no point does your single, secure password enter anyone else's hands, so you don't need to trust them to hash it. If one is compromised, none of the others are.
    - 3JPLW 14y ago
      Yup, exactly option 1. But browsers need to support this intrinsically and universally. By salting with the domain name, you remove phishing. Password managers (especially in terms of built-in browser support) are generally a one-machine solution. Yes, there are ways to sync them to mobile devices and the cloud and such, but there's a lot to be desired in terms of portability. I currently use 1password, and it works great for me. I set my mother up on it, too, but it's only a 90% solution for her as she's not quite technically proficient enough to ensure it works all the time. My question was more if there'd be a smart way you could add one more level of indirection such that: 1) individually compromised passwords could be changed and 2) the master password could be changed without affecting every single site. Ideally neither situation would be necessary, but servers will be compromised.
      - Groxx 14y ago
        I'm personally not a fan of 1, and I don't know that it can ever work to complete satisfaction. Two reasons: 1) domain names change sometimes. especially with the current trend of weird ending domains, and "www.getx.com" which later becomes 'x.com' when they finally pay the squatters. Or a rebranding, or subdomains, etc. How do you handle changes, without recording them? Proactively you can change your password when such a thing occurs, but that's not a reliable assumption. 2) versioning. If you have to change a password every X time periods, how do you track which version you're on? without a database? you could salt it with the time the last password was created, but what about time zones? different calendar systems (did I set that password in china, or jerusalem, or canada...?)? All of which leaves you with a database of some kind in some (fairly likely to occur) situations, which means you essentially have a password manager. As you point out, a 90% solution simply isn't good enough.

by gbog 14y ago

kijin 14y ago

Actually, I think passwords are a brilliant authentication mechanism that will continue to have a place in computer security for many years to come. When used correctly, a password implies the presence of the correct brain. Not a device that can be lost or stolen, not even a fingerprint that can be lifted. Authentication based on information stored in your neural network might not be suitable for everyone, but at least among competent professionals, I don't see mobile phones or USB dongles replacing the passphrase on my PGP key anytime soon.

gbog 14y ago
Right, but I was not talking about passphrases giving root access to critical machines or documents. I was talking about passwords for Twitter or HN accounts, or those used heavily in entreprises. I have a friend head of something in a big corp, she says she has at 6 passwords with 6 different policies and has to use them everyday, sometime just to sign the invoice for a new ink cartridge.
3JPLW 14y ago
I agree with your statement with one minor change: a password (or better, passphrase) is a brilliant authentication... Passwords (plural) are just about the worst authentication mechanism. While brains are good at remembering one such token, needing to remember many for many different sites (and which ones go to which) is simply untenable. Additionally, the ability to easily compromise them through phishing makes them awful. I wonder if there'd be a way to cleverly move the hashing (that all servers should be doing) to the client side such that all of the above problems could be solved. It would confound password changes, however...
- thirsteh 14y ago
  Use a password manager. Random, unique passwords for every site, and one long master passphrase that is stretched by the password manager. With random, unique passwords, resource-intensive server-side hashing provides no benefit. We are doing that because people re-use their passwords everywhere.
- Groxx 14y ago
  There is. Or, a variety of ways, really. Two major ones: Option 1: your passphrase as a salt + the domain name + bcrypt = password. Lots of detailed schemes exist for this, including ones you can do on a piece of paper with a little math so you don't have to trust your computer. Inventing them seems to be a hobby for crypto people, or something - I've seen many dozens. Option 2: you use random passwords, and store them behind your passphrase somewhere. Password managers. At no point does your single, secure password enter anyone else's hands, so you don't need to trust them to hash it. If one is compromised, none of the others are.
  - 3JPLW 14y ago
    Yup, exactly option 1. But browsers need to support this intrinsically and universally. By salting with the domain name, you remove phishing. Password managers (especially in terms of built-in browser support) are generally a one-machine solution. Yes, there are ways to sync them to mobile devices and the cloud and such, but there's a lot to be desired in terms of portability. I currently use 1password, and it works great for me. I set my mother up on it, too, but it's only a 90% solution for her as she's not quite technically proficient enough to ensure it works all the time. My question was more if there'd be a smart way you could add one more level of indirection such that: 1) individually compromised passwords could be changed and 2) the master password could be changed without affecting every single site. Ideally neither situation would be necessary, but servers will be compromised.
    - Groxx 14y ago
      I'm personally not a fan of 1, and I don't know that it can ever work to complete satisfaction. Two reasons: 1) domain names change sometimes. especially with the current trend of weird ending domains, and "www.getx.com" which later becomes 'x.com' when they finally pay the squatters. Or a rebranding, or subdomains, etc. How do you handle changes, without recording them? Proactively you can change your password when such a thing occurs, but that's not a reliable assumption. 2) versioning. If you have to change a password every X time periods, how do you track which version you're on? without a database? you could salt it with the time the last password was created, but what about time zones? different calendar systems (did I set that password in china, or jerusalem, or canada...?)? All of which leaves you with a database of some kind in some (fairly likely to occur) situations, which means you essentially have a password manager. As you point out, a 90% solution simply isn't good enough.