4 ms·

I had a talk in 2005 and the person was saying passwords belonged to the past. 2014 and we're still there: Why? - We have browserside certificates. Granted the

by aragot 13y ago

I had a talk in 2005 and the person was saying passwords belonged to the past. 2014 and we're still there: Why? - We have browserside certificates. Granted they're not sexy. - We have logins by email tokens. After all, that's how to do password recovery anyway, so why not promoting password recovery to the normal login? - We could have thousand kinds of SIM or USB passwords, such as YubiKey, which would have features like, you only auth while it's in the slot. Instead the last gov website I've used to declare my payroll employees takes the birth date as the default password. And so many others accept my mother's maiden name as an authentifying proof. How did we get there?

harshreality 13y ago
Browser side certificates only work in the browsers you install them in; the average computer user will need tech support to help them copy a key/cert pair to a new browser. The key is also probably not encrypted on disk (by default). Emailing a login token to a user every time they want to log in requires that their email is working and that they can get to their email, and would slow down the login process. It would waste everyone's time. I think it only makes sense as an additional authentication measure for high security applications where logging in at a moment's notice is not a necessity. Yubikey is okay for one or two sites if you have one[1]. They cost money, and serve no purpose other than improving security of logins. Compare to a smartphone running a TOTP app. Most people already have a handheld device, and a TOTP app and setup for a website is a free one-time install with one-time setup and no ongoing overhead. It also doesn't require working email or even working internet, which doesn't matter in the typical case but matters a lot in edge cases. Email might be down. SMS might be down. You might not have cell coverage at all. [1] Yubikey only has two slots, and so you can't store unique OATH seeds for more than two sites, right? How many yubikeys do you expect people to carry around? How many sites even implement HOTP rather than TOTP? If every site implementing 2FA implemented challenge/response for yubikey, then yubikey would be great. However, TOTP is the dominant form of 2FA, and that limits the usefulness of yubikey.
- maxerickson 13y ago
  Gregarious device use should sort of be on the decline. To the extent security matters, any ol' device is less and less of a good idea. Still, I'd like devices to be able to ask my cell phone for authorizations (maybe with a complicated enough UI that the cell phone can limit the valid time of the auth).
- lstamour 13y ago
  Have a look at Yubico Authenticator ;-)
- aragot 13y ago
  > browser-side certificates (...) the average computer user will need tech support That's an example of good security with a bad UI. It's an order of magnitude better than passwords. But history didn't make them sexy and it's too late to start.
yk 13y ago
Sadly, portability trumps everything. The thing is, most people will never experience a identity theft. But most people will want to lock in to some service from a friends computer at some point. So immediate experience, as opposed to analysis, favors passwords over your suggestions.
- aragot 13y ago
  "I agree but" ;) With a little head scratching, there are excellent solutions. In Luxembourg, I had a little hard-printed card with 52 letters. At each login to my bank, I would be asked for 3 of them, plus my password. With this kind of extremely-cheap-and-portable token, I would dare to login even from an untrusted country. Because I never have to type the full 52 letters. That's only for email. Every other service relies on email security. The problem is, it's the provider (fb, gmail, ...) who chooses how their authenticate you. I wish a system like Mozilla Persona would gain traction (looking at you Gmail), because it would trigger innovation. There are a lot of better alternatives to passwords and SMS for 2FAs.
jerf 13y ago
"I had a talk in 2005 and the person was saying passwords belonged to the past. 2014 and we're still there: Why?" Because passwords qua passwords are not the problem. The security skill of the median person is. I honestly don't know how to secure people in general, even making the blindingly optimistic assumption of perfectly secure authentication code. 2FA has the problem that to work properly, you must also print off one-time-use reset tokens and properly keep them. (If you can just reset via an email, well, you've just returned back to auth-by-email-account and the second factor is of dubious utility.) Specialized hardware is problematic because it really ought to be open to be secure, but if it's open, it's hard to make the profit enough to make it work... and users would still have to do something to properly prepare for losing their token which is going to be nontrivial. (Login by email tokens, BTW, is not a great idea in general; obtaining an email account fraudulently should not grant you access to everything the user has. That's a problem with the current system, not the solution.)
- aragot 13y ago
  > Because passwords qua passwords are not the problem. The security skill of the median person is. Not possible to blame the people, here's why: - You can't remember 50 different passwords for each site you're on, - You can't use password templates because hackers have pattern-matching attacks, - You can't rely on password managers. Imagine one piece of software that a million people have, which provides access to all their banks and mail and websites? How much is the bug bounty for 1Password? I'll give you the formula: risk occurrence x cost of a leak per user x number of users. That's a hell lot of 0's. Should the bug bounty be under that, it's worth selling your bug to the pirates. Passwords should have been thrown away in 2005.
  - jerf 13y ago
    "Not possible to blame the people" It's not blaming the people. That's an entirely different mindset. This mindset is, we have to solve the problem that actually exists, with people that actually exist, with technologies that actually exist. Further, you read something other than what I wrote. I said that I don't know how to secure people, at all. Explaining why passwords don't work is evidence in my favor, not a reason why I'm wrong. The problem is, it's not as simple as just "throwing away passwords", you have to actually have a solution. After year of people chewing on the problem online and various solutions actually being deployed, I'm not convinced one exists. It's easy to snipe at deployed technologies and talk about how much better the ones that exist only in your head work. However, the track record on manifesting them is pretty dubious. Those of us with enough technology skills to use things like 2FA are sitting prettier than ever, but frankly we were already the ones that tended to be secure. The evidence that we've successfully pushed this out into the real world is pretty lacking. We can't even get website developers to stop requiring us to use 4-digit pins as passwords on our banking sites.
lalc 13y ago
At least now we have Mozilla Persona. Oh, and a shining example of good mobile fingerprint reader UX. Soon...
gambler 13y ago
How did we get there? By ignoring human nature and geeking out about the technical side of things? It doesn't matter how technically advanced and theoretically secure an auth solution is. If it has certain kinds of usability problems it will never be willingly adopted by large number of common people. I think to move forward with security we (engineers) need to simply accept this as a fact, and stop bitching about supposed user stupidity.

by aragot 13y ago

harshreality 13y ago

Browser side certificates only work in the browsers you install them in; the average computer user will need tech support to help them copy a key/cert pair to a new browser. The key is also probably not encrypted on disk (by default). Emailing a login token to a user every time they want to log in requires that their email is working and that they can get to their email, and would slow down the login process. It would waste everyone's time. I think it only makes sense as an additional authentication measure for high security applications where logging in at a moment's notice is not a necessity. Yubikey is okay for one or two sites if you have one[1]. They cost money, and serve no purpose other than improving security of logins. Compare to a smartphone running a TOTP app. Most people already have a handheld device, and a TOTP app and setup for a website is a free one-time install with one-time setup and no ongoing overhead. It also doesn't require working email or even working internet, which doesn't matter in the typical case but matters a lot in edge cases. Email might be down. SMS might be down. You might not have cell coverage at all. [1] Yubikey only has two slots, and so you can't store unique OATH seeds for more than two sites, right? How many yubikeys do you expect people to carry around? How many sites even implement HOTP rather than TOTP? If every site implementing 2FA implemented challenge/response for yubikey, then yubikey would be great. However, TOTP is the dominant form of 2FA, and that limits the usefulness of yubikey.

maxerickson 13y ago
Gregarious device use should sort of be on the decline. To the extent security matters, any ol' device is less and less of a good idea. Still, I'd like devices to be able to ask my cell phone for authorizations (maybe with a complicated enough UI that the cell phone can limit the valid time of the auth).
lstamour 13y ago
Have a look at Yubico Authenticator ;-)
aragot 13y ago
> browser-side certificates (...) the average computer user will need tech support That's an example of good security with a bad UI. It's an order of magnitude better than passwords. But history didn't make them sexy and it's too late to start.

yk 13y ago

Sadly, portability trumps everything. The thing is, most people will never experience a identity theft. But most people will want to lock in to some service from a friends computer at some point. So immediate experience, as opposed to analysis, favors passwords over your suggestions.

aragot 13y ago
"I agree but" ;) With a little head scratching, there are excellent solutions. In Luxembourg, I had a little hard-printed card with 52 letters. At each login to my bank, I would be asked for 3 of them, plus my password. With this kind of extremely-cheap-and-portable token, I would dare to login even from an untrusted country. Because I never have to type the full 52 letters. That's only for email. Every other service relies on email security. The problem is, it's the provider (fb, gmail, ...) who chooses how their authenticate you. I wish a system like Mozilla Persona would gain traction (looking at you Gmail), because it would trigger innovation. There are a lot of better alternatives to passwords and SMS for 2FAs.

jerf 13y ago

"I had a talk in 2005 and the person was saying passwords belonged to the past. 2014 and we're still there: Why?" Because passwords qua passwords are not the problem. The security skill of the median person is. I honestly don't know how to secure people in general, even making the blindingly optimistic assumption of perfectly secure authentication code. 2FA has the problem that to work properly, you must also print off one-time-use reset tokens and properly keep them. (If you can just reset via an email, well, you've just returned back to auth-by-email-account and the second factor is of dubious utility.) Specialized hardware is problematic because it really ought to be open to be secure, but if it's open, it's hard to make the profit enough to make it work... and users would still have to do something to properly prepare for losing their token which is going to be nontrivial. (Login by email tokens, BTW, is not a great idea in general; obtaining an email account fraudulently should not grant you access to everything the user has. That's a problem with the current system, not the solution.)

aragot 13y ago
> Because passwords qua passwords are not the problem. The security skill of the median person is. Not possible to blame the people, here's why: - You can't remember 50 different passwords for each site you're on, - You can't use password templates because hackers have pattern-matching attacks, - You can't rely on password managers. Imagine one piece of software that a million people have, which provides access to all their banks and mail and websites? How much is the bug bounty for 1Password? I'll give you the formula: risk occurrence x cost of a leak per user x number of users. That's a hell lot of 0's. Should the bug bounty be under that, it's worth selling your bug to the pirates. Passwords should have been thrown away in 2005.
- jerf 13y ago
  "Not possible to blame the people" It's not blaming the people. That's an entirely different mindset. This mindset is, we have to solve the problem that actually exists, with people that actually exist, with technologies that actually exist. Further, you read something other than what I wrote. I said that I don't know how to secure people, at all. Explaining why passwords don't work is evidence in my favor, not a reason why I'm wrong. The problem is, it's not as simple as just "throwing away passwords", you have to actually have a solution. After year of people chewing on the problem online and various solutions actually being deployed, I'm not convinced one exists. It's easy to snipe at deployed technologies and talk about how much better the ones that exist only in your head work. However, the track record on manifesting them is pretty dubious. Those of us with enough technology skills to use things like 2FA are sitting prettier than ever, but frankly we were already the ones that tended to be secure. The evidence that we've successfully pushed this out into the real world is pretty lacking. We can't even get website developers to stop requiring us to use 4-digit pins as passwords on our banking sites.

lalc 13y ago

At least now we have Mozilla Persona. Oh, and a shining example of good mobile fingerprint reader UX. Soon...

gambler 13y ago

How did we get there? By ignoring human nature and geeking out about the technical side of things? It doesn't matter how technically advanced and theoretically secure an auth solution is. If it has certain kinds of usability problems it will never be willingly adopted by large number of common people. I think to move forward with security we (engineers) need to simply accept this as a fact, and stop bitching about supposed user stupidity.