4 ms·
> This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented. Yes, because we've basically realized that m
by curun1r 12y ago
> This sort of objection is raised whenever basically any mechanism for remembering strong passwords is presented.
Yes, because we've basically realized that memorizing passwords isn't a workable solution. We should be recommending password managers that generate/store strong passwords and MFA for any account that needs to be secure. That these password generators themselves can now be unlocked using both memorized information and biometrics (TouchID and such) makes them all the more secure.
Moreover, this is the only solution that's capable of dealing with all the asinine password requirements that get imposed on users...solutions like this card fail hard when the password requirements prohibit certain characters and/or other characteristics of these passwords (repeated characters, length, etc.) Until the world gets together and standardizes what constitutes a secure password, memorized passwords will always be a flawed solution.
- fat0wl 12y agoyea a coworker uses YubiKey... it generates extremely strong one-time-use passwords (essentially just meaning it auto-generates a different one for every site?) & auto-enters them through a browser add-on when the device is in USB (I believe?) seems like solutions like that are a bit easier than typing in a bunch of keys you are looking up on a card and really solve the issue of web-based attacks.... it really only leaves you vulnerable to people who have physical access to the USB device, and even then i can imagine simple ways to make even that a hassle (have another password layer as master sign-in? would be enough to deter most of your acquaintances from being able to use your device)
- danieldk 12y agoA normal Yubikey is still vulnerable to MITM and phishing attacks. The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key. Also, AFAIR, Yubikey OTP requires the use of a Yubikey server which knows the shared secret, which may be problematic.
- Nullabillity 12y agoYou can replace the Yubikey's OTP seed with your own to bypass their server. https://www.yubico.com/applications/internet-services/gmail/ https://www.yubico.com/applications/internet-services/gmail/
- danieldk 12y agoYes, but then it won't be supported by many sites that support Yubikey OTP and rely on Yubico's servers for authentication.
- bigbugbag 12y agoI'll go even a step further and say: passwords are a flawed solution They have been through history and way before the industrialized world, not only that but what was considered secure yesterday may be compromised today or tomorrow. This is not going away any time soon and you have to design security taking this into account. Another problem with password, it's that those web services we use password for collect way too much sensitive information that they should not be given in the first place.
- marssaxman 12y agoPeople keep saying that passwords are flawed, but what else is there? Authentication depends on secret information, does it not?
- aragot 12y ago> Memorizing passwords isn't a workable solution Correct analysis, > recommend password managers No! Passwords should never be considered as secure material, period. Centralizing in a password manager centralizes the burden. There are half a dozen other workable solutions, among which authentication by email (What else is the reset-by-email link?), Mozilla Persona and all kinds of asymetric keys.
- decisiveness 12y ago> Centralizing in a password manager centralizes the burden. So does using a single email account for everything.