4 ms·

> potentially ZERO indication to the end user that their account has been compromised It's not exactly zero. For example you can generate new "security image"

by homakov 12y ago

> potentially ZERO indication to the end user that their account has been compromised It's not exactly zero. For example you can generate new "security image" every time user logs in. If last time it was some cat and now it's dog, then someone logged in meanwhile. And that's, frankly, is not as terrifying to me as reused passwords. >Please stop making claims as if you have any fucking idea about security. I would be excited to see links to your security write ups, please share :)

stephenr 12y ago
You keep making suggestions on the fly which clearly shows you haven't thought this through, and can't accept that its just a fucking terrible idea. A "security image" doesn't work if it changes every time. First off - you're putting the burden of maintaining security onto the user - how the fuck am I supposed to remember what random picture you showed me? You can consider this entire discussion thread my fucking security write up. The comments on your own show that anyone else who listens to you has the same reaction, so it's no surprise you resort to ad hominem attacks implying that only someone with published security write ups is qualified to call your idea fucking stupid.
- homakov 12y ago
  I made it on the fly because "know that you've been hacked" is not important at all for regular users. They can't remember a random picture - true, but they also don't care if their password doesn't work anymore. That's all your (and everyone else's) reasoning so far. Why can't you accept that if your email was hacked you will learn about it pretty quickly anyway? (because your paypal funds are stolen). > that only someone with published security write ups is qualified to call your idea fucking stupid I didn't say that, your answers are on spot and questions raised are valid, however I am surprised you prioritize "password was changed" issue over entire reused passwords problem for normal users. To make it clear: you dont care that people reuse passwords and it is a #1 problem, you only care if email account is compromised and if attackers decide to silently spy on one of your other accounts instead of getting the profit now. If that's true we just have different opinions and there's nothing to discuss here.
  - stephenr 12y ago
    > "not important at all for regular users" You keep saying that but I just don't believe you. People LOST THEIR SHIT when a heap of celebrity nude photos were leaked, and that wasn't even their own accounts or information. Major sites being breached etc are not uncommon on mainstream news reports now. But no, you're right, no one fucking cares about that. > I am surprised you prioritize "password was changed" issue over entire reused passwords problem for normal users > To make it clear: you dont care that people reuse passwords and it is a #1 problem, you only care if email account is compromised and if attackers decide to silently spy on one of your other accounts instead of getting the profit now. No, not at all. Normal users have the very real, very safe option to use a password manager. They can work across devices and solve the problems of remembering and re-using passwords. This means they can have reasonably GOOD security, and can use it EASILY. That system (the one that exists and works right now) has the extra BENEFIT that users will know as soon as they try to access their account, if it's been compromised via a password reset attack. Your "solution" instead pushes all immediate security onto email and the users mailbox, which you freely admit IS NOT SECURE. Any requirement for any semblance of account integrity is then pushed onto the user apparently? Edit: So just to make sure it's crystal clear: I'm not saying password re-use is not a problem, it is. I'm saying the solution to that problem is improving the tools (i.e password management in browsers) that already exist, where necessary.

by homakov 12y ago

stephenr 12y ago

You keep making suggestions on the fly which clearly shows you haven't thought this through, and can't accept that its just a fucking terrible idea. A "security image" doesn't work if it changes every time. First off - you're putting the burden of maintaining security onto the user - how the fuck am I supposed to remember what random picture you showed me? You can consider this entire discussion thread my fucking security write up. The comments on your own show that anyone else who listens to you has the same reaction, so it's no surprise you resort to ad hominem attacks implying that only someone with published security write ups is qualified to call your idea fucking stupid.

homakov 12y ago
I made it on the fly because "know that you've been hacked" is not important at all for regular users. They can't remember a random picture - true, but they also don't care if their password doesn't work anymore. That's all your (and everyone else's) reasoning so far. Why can't you accept that if your email was hacked you will learn about it pretty quickly anyway? (because your paypal funds are stolen). > that only someone with published security write ups is qualified to call your idea fucking stupid I didn't say that, your answers are on spot and questions raised are valid, however I am surprised you prioritize "password was changed" issue over entire reused passwords problem for normal users. To make it clear: you dont care that people reuse passwords and it is a #1 problem, you only care if email account is compromised and if attackers decide to silently spy on one of your other accounts instead of getting the profit now. If that's true we just have different opinions and there's nothing to discuss here.
- stephenr 12y ago
  > "not important at all for regular users" You keep saying that but I just don't believe you. People LOST THEIR SHIT when a heap of celebrity nude photos were leaked, and that wasn't even their own accounts or information. Major sites being breached etc are not uncommon on mainstream news reports now. But no, you're right, no one fucking cares about that. > I am surprised you prioritize "password was changed" issue over entire reused passwords problem for normal users > To make it clear: you dont care that people reuse passwords and it is a #1 problem, you only care if email account is compromised and if attackers decide to silently spy on one of your other accounts instead of getting the profit now. No, not at all. Normal users have the very real, very safe option to use a password manager. They can work across devices and solve the problems of remembering and re-using passwords. This means they can have reasonably GOOD security, and can use it EASILY. That system (the one that exists and works right now) has the extra BENEFIT that users will know as soon as they try to access their account, if it's been compromised via a password reset attack. Your "solution" instead pushes all immediate security onto email and the users mailbox, which you freely admit IS NOT SECURE. Any requirement for any semblance of account integrity is then pushed onto the user apparently? Edit: So just to make sure it's crystal clear: I'm not saying password re-use is not a problem, it is. I'm saying the solution to that problem is improving the tools (i.e password management in browsers) that already exist, where necessary.