8 ms·

How to Fix Authentication: Email as a Password Manager

10 points by homakov 12y ago

Xeoncross 12y ago
Sounds like you are ready to re-invent the browserID protocol. Might as well, Mozilla is done with it...
- homakov 12y ago
  By no means trying to invent/re-invent anything. Just making classic scheme safer by getting rid of passwords.
stephenr 12y ago
This article has two problems: a) password managers don't have to be terrible third party solutions. Safari has an amazing password manager with strong random suggestions, and it's just enabled out of the box for millions and millions of iOS and Mac users. b) this is ridiculously insecure - as soon as anyone breaches your email account they have access to any other service using this scheme, without any way to know (i.e no password reset by the attacker) a) is proof that this can be "solved" by browser vendors. b) is the reason this should be solved by browser vendors.
- homakov 12y ago
  >(i.e no password reset by the attacker) Login link = reset link. it's not different from classic scheme. Equally insecure. "What if" doesn't work, it's 2015 and the problem is still huge. "Use password manager" doesn't work anymore, unless you offer something dead simple as my idea.
  - stephenr 12y ago
    No, a reset link is not the same as a login link. If an attacker gets access to my email and resets the password, I know as soon as I try to use the service (because my password won't work) With your scheme all they have to do is delete the login email and I have no idea they've breached my account. Also, there is no what if. Safari's password management is absolute real world proof that a good solution is possible.
    - homakov 12y ago
      Ok, i thought you mean you will see an incoming email. Anyway, is it critical to know or not if your account was breached? If it's breached nothing else matters. Safari manager is probably great, like other managers. But my scheme is for developers not for end users. You can't make everyone use pw managers, but link on demand is super helpful This can added as an option. Some use password, some use on demand link. Everyone's happy
      - stephenr 12y ago
        > is it critical to know or not if your account was breached? If it's breached nothing else matters. This comment is terrifying, given that you are making claims and suggestions about security. In a normal system I can take action as soon as I know it's breached, to ensure the attacker doesn't have continued access to my account and check/fix damage caused. With your system an attacker could conceivably have complete access without my knowledge for weeks or months. Edit: > Safari manager is probably great, like other managers. Your entire argument is that password managers are not a good solution - now you're agreeing that they're great. Which is it? > But my scheme is for developers not for end users. You can't make everyone use pw managers, but link on demand is super helpful Except users cannot be trusted to make safe choices - our job is to make informed decisions for them, such as requiring passwords, storing password hashes, etc. > This can added as an option. Some use password, some use on demand link. Everyone's happy Anyone except the people who are affected by the inevitable breach caused by the use of this non-secure solution. Even if I choose to use a password, I could still be affected negatively by an attacker using someone else's account in a system.
        homakov 12y ago
        I will take it as a slight disadvantage. I personally never log out, so I would never know if someone else changed my password while I keep using it on my laptop. Also remember this scheme is not for advanced users (which care about "was i breached" at all). Advanced users can keep using old password scheme with pw managers. P.S. There is nothing you can do if your email is breached anyway. I can change it to new email right away.
  - Terretta 12y ago
    "Use a password manager" still seems to be the right answer for frictionless logins. "Easy" is requirement #1 to get people to use a thing. In fact, using it should be easier than not using it. If you use 1Password, it nails the password details that trip up the "shady" password managers you allude to. See this study about stealing passwords or credit cards from users of auto fill password managers: https://www.cs.utexas.edu/~suman/publications/suman_pwdmgr.pdf https://www.cs.utexas.edu/~suman/publications/suman_pwdmgr.p... Interestingly, the Safari built in keychain is better to protect cc.
    - homakov 12y ago
      you're free to use any password manager. my scheme is for developers to build better authentication
      - stephenr 12y ago
        but it just isn't better though. it's worse in the way that developers should be worried about most: security.
        homakov 12y ago
        How exactly is it worse if it's not different from classic scheme?
        stephenr 12y ago
        you're removing something which people basically understand the concept of - passwords: keep them fucking secret/safe - and trying to replace it with something that is built on top of a system never meant to work that way. If your system routinely sends out OTP emails, all it takes is someone to intercept those emails on their way from your SMTP server out to the wider internet, and every fucking user is breached. The only reason password reset links are at all acceptable is because they are used relatively rarely and it's not predictable when they will be used.

10 points by homakov 12y ago

Xeoncross 12y ago

Sounds like you are ready to re-invent the browserID protocol. Might as well, Mozilla is done with it...

homakov 12y ago
By no means trying to invent/re-invent anything. Just making classic scheme safer by getting rid of passwords.

stephenr 12y ago

This article has two problems: a) password managers don't have to be terrible third party solutions. Safari has an amazing password manager with strong random suggestions, and it's just enabled out of the box for millions and millions of iOS and Mac users. b) this is ridiculously insecure - as soon as anyone breaches your email account they have access to any other service using this scheme, without any way to know (i.e no password reset by the attacker) a) is proof that this can be "solved" by browser vendors. b) is the reason this should be solved by browser vendors.

homakov 12y ago
>(i.e no password reset by the attacker) Login link = reset link. it's not different from classic scheme. Equally insecure. "What if" doesn't work, it's 2015 and the problem is still huge. "Use password manager" doesn't work anymore, unless you offer something dead simple as my idea.
- stephenr 12y ago
  No, a reset link is not the same as a login link. If an attacker gets access to my email and resets the password, I know as soon as I try to use the service (because my password won't work) With your scheme all they have to do is delete the login email and I have no idea they've breached my account. Also, there is no what if. Safari's password management is absolute real world proof that a good solution is possible.
  - homakov 12y ago
    Ok, i thought you mean you will see an incoming email. Anyway, is it critical to know or not if your account was breached? If it's breached nothing else matters. Safari manager is probably great, like other managers. But my scheme is for developers not for end users. You can't make everyone use pw managers, but link on demand is super helpful This can added as an option. Some use password, some use on demand link. Everyone's happy
    - stephenr 12y ago
      > is it critical to know or not if your account was breached? If it's breached nothing else matters. This comment is terrifying, given that you are making claims and suggestions about security. In a normal system I can take action as soon as I know it's breached, to ensure the attacker doesn't have continued access to my account and check/fix damage caused. With your system an attacker could conceivably have complete access without my knowledge for weeks or months. Edit: > Safari manager is probably great, like other managers. Your entire argument is that password managers are not a good solution - now you're agreeing that they're great. Which is it? > But my scheme is for developers not for end users. You can't make everyone use pw managers, but link on demand is super helpful Except users cannot be trusted to make safe choices - our job is to make informed decisions for them, such as requiring passwords, storing password hashes, etc. > This can added as an option. Some use password, some use on demand link. Everyone's happy Anyone except the people who are affected by the inevitable breach caused by the use of this non-secure solution. Even if I choose to use a password, I could still be affected negatively by an attacker using someone else's account in a system.
      - homakov 12y ago
        I will take it as a slight disadvantage. I personally never log out, so I would never know if someone else changed my password while I keep using it on my laptop. Also remember this scheme is not for advanced users (which care about "was i breached" at all). Advanced users can keep using old password scheme with pw managers. P.S. There is nothing you can do if your email is breached anyway. I can change it to new email right away.
- Terretta 12y ago
  "Use a password manager" still seems to be the right answer for frictionless logins. "Easy" is requirement #1 to get people to use a thing. In fact, using it should be easier than not using it. If you use 1Password, it nails the password details that trip up the "shady" password managers you allude to. See this study about stealing passwords or credit cards from users of auto fill password managers: https://www.cs.utexas.edu/~suman/publications/suman_pwdmgr.pdf https://www.cs.utexas.edu/~suman/publications/suman_pwdmgr.p... Interestingly, the Safari built in keychain is better to protect cc.
  - homakov 12y ago
    you're free to use any password manager. my scheme is for developers to build better authentication
    - stephenr 12y ago
      but it just isn't better though. it's worse in the way that developers should be worried about most: security.
      - homakov 12y ago
        How exactly is it worse if it's not different from classic scheme?
        stephenr 12y ago
        you're removing something which people basically understand the concept of - passwords: keep them fucking secret/safe - and trying to replace it with something that is built on top of a system never meant to work that way. If your system routinely sends out OTP emails, all it takes is someone to intercept those emails on their way from your SMTP server out to the wider internet, and every fucking user is breached. The only reason password reset links are at all acceptable is because they are used relatively rarely and it's not predictable when they will be used.