Hacker News Reader

Comment by orblivion | Hacker News Reader

If nobody understands anything other than passwords, how has 2FA taken off at all? How have password managers taken off at all?

What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers? How could that _possibly_ be more friction? It would be strictly less. Hell, it could be done without even informing the user that this new feature was being rolled out, and they sure as hell wouldn't complain about inconvenience because of a step removed from the login process.

Asking people to deal with more and more and longer and longer passwords is a usability nightmare. It's a absurdity.

View on HN

I wouldn’t say 2FA or password managers have “taken off”. I don’t have numbers, but just from my small sample of friends/family, only people who are technically advanced or who I have forced (my wife ;) use password managers.

Well hey, it's a start. They've got more adoption than Troy claims any of the niche experimental password replacers do.

Where does 2fa replace passwords? It's two FA after all.

And I'd assert that password managers haven't exactly taken off; I'd be curious about their numbers, but the dozen or so people I know who use one are all software engineers. Also, they don't really replace passwords - they're based on them!

2fa doesn't replace passwords but it is added friction that people willingly take on for added security.

Password managers are a separate program that (some) people are willing to use as part of their login process. Perhaps whatever adoption it has is based on the fact that people understand passwords. But once they're used to using a program to log them in, I'd argue that's a potential hook into something more secure. Even something as simple as the API I described would mitigate (I'll stop short of saying eliminate) phishing attacks.

Only people on this site have willingly enabled 2fa (to a decent first order estimate). The remainder are forced to by tenant administrators or the occasional application owner who understands they gate important data (eg NuGet requires 2fa for some package owners).

"2fa" as traditionally thought of is a bit of a detour though - what's more important is strong authentication, with passwords being worst and a UAF key being best for now. Authenticator apps satisfy 2FA with a single authentication, but that freaks out plenty of smart people (phone PIN lock + device bound cert = something you know/are + you have) - purely due to years of training that 2FA means 2 authentication.

The claim wasn't that nobody understands anything other than passwords, it was that everyone understands passwords.

The claim was that nothing else will take off. 2FA and password maangers at least are used out there beyond a niche thing nobody ever heard of (which is how he described the viability of other schemes he didn't bother naming)

The claim was that nothing else will take off to the point of becoming a password killer.

2FA doesn't try to replace passwords.

For one 2FA is (often) an addition to password and almost always it is required only at registration time (e.g. email confirmation)

> Asking people to deal with more and more and longer and longer passwords is a usability nightmare. It's a absurdity.

I fully agree with you, but an anecdote.

I find long password to be easy to remember if they are just long lower case strings instead of having wierd symbol-number combinations.

> What if the password manager were in charge of logging you in _directly_, through some new protocol between browsers and PW managers?

FYI, this is exactly what WebAuthn is. The standard was just finalized in August. All we need now is some implementations.

Reply on news.ycombinator.com