4 ms·

> Because passwords qua passwords are not the problem. The security skill of the median person is. Not possible to blame the people, here's why: - You can't r

by aragot 13y ago

> Because passwords qua passwords are not the problem. The security skill of the median person is. Not possible to blame the people, here's why: - You can't remember 50 different passwords for each site you're on, - You can't use password templates because hackers have pattern-matching attacks, - You can't rely on password managers. Imagine one piece of software that a million people have, which provides access to all their banks and mail and websites? How much is the bug bounty for 1Password? I'll give you the formula: risk occurrence x cost of a leak per user x number of users. That's a hell lot of 0's. Should the bug bounty be under that, it's worth selling your bug to the pirates. Passwords should have been thrown away in 2005.

jerf 13y ago
"Not possible to blame the people" It's not blaming the people. That's an entirely different mindset. This mindset is, we have to solve the problem that actually exists, with people that actually exist, with technologies that actually exist. Further, you read something other than what I wrote. I said that I don't know how to secure people, at all. Explaining why passwords don't work is evidence in my favor, not a reason why I'm wrong. The problem is, it's not as simple as just "throwing away passwords", you have to actually have a solution. After year of people chewing on the problem online and various solutions actually being deployed, I'm not convinced one exists. It's easy to snipe at deployed technologies and talk about how much better the ones that exist only in your head work. However, the track record on manifesting them is pretty dubious. Those of us with enough technology skills to use things like 2FA are sitting prettier than ever, but frankly we were already the ones that tended to be secure. The evidence that we've successfully pushed this out into the real world is pretty lacking. We can't even get website developers to stop requiring us to use 4-digit pins as passwords on our banking sites.
- aragot 13y ago
  Thanks for clarifying.

by aragot 13y ago

jerf 13y ago

"Not possible to blame the people" It's not blaming the people. That's an entirely different mindset. This mindset is, we have to solve the problem that actually exists, with people that actually exist, with technologies that actually exist. Further, you read something other than what I wrote. I said that I don't know how to secure people, at all. Explaining why passwords don't work is evidence in my favor, not a reason why I'm wrong. The problem is, it's not as simple as just "throwing away passwords", you have to actually have a solution. After year of people chewing on the problem online and various solutions actually being deployed, I'm not convinced one exists. It's easy to snipe at deployed technologies and talk about how much better the ones that exist only in your head work. However, the track record on manifesting them is pretty dubious. Those of us with enough technology skills to use things like 2FA are sitting prettier than ever, but frankly we were already the ones that tended to be secure. The evidence that we've successfully pushed this out into the real world is pretty lacking. We can't even get website developers to stop requiring us to use 4-digit pins as passwords on our banking sites.

aragot 13y ago
Thanks for clarifying.