Hacker News Reader

Comment by thurn | Hacker News Reader

Requiring users to create passwords continues to be an engineering failure in our industry. There are some promising alternatives, but we need to realize that users are not at fault for picking poor passwords. We are at fault for not giving them better options.

View on HN

We did, and they didn't want it. SSL client certs, maybe. There's Login with twitter, Login with Facebook. Login with Random Site X. Oh, don't like centralized third-party authentication? The only thing you know about security is that there needs to be a lock icon? Try something else, here's OpenID: distributed, federated, customizable. Oh, too hard to understand? Confused because the address bar changes? Why are you asserting your identity on site X when you want to access to site Y? Don't even know, or want to take the time to, understand what "asserting your identity" means? Well then we'll just let you log in with a username and password.

Oh, did you forget your username? Is your caps lock key on?

Even (edit: fake) celebrities known for crazy beards and drunken movies have an opinion on login security: http://twitter.com/GALIFlANAKIS/status/77372216957861888

that isn't his real account, some of "his" latest tweets: http://twitter.com/#!/GALIFlANAKIS/status/77450156102004736 http://twitter.com/#!/GALIFlANAKIS/status/77620921766129664 real account: http://twitter.com/#!/GALIFIANAKISZ they're using different letters and case. I = l, i = L

Good point. I forgot to check for the "verified" icon (since twitter refuses to consider me worth "verifying"). I'll edit to reflect that.

What would you suggest as better options and what are some examples of the ones you've alluded to? The way I see it, any shift away from the current common scheme would cause problems with either of both compatability and ease of use. It'd be awesome if everyone had a pgp key or something, but that's unrealistic. Some new voodoo scheme gets concocted and I worry for security rigor and whether it'll fit within existing systems.

Maybe the two-step auth method by Google (and by banks before) recently or a tweak of it is the way to go?

You know what I want? I want a small, cheap USB dongle that I just plug into the PC, that magically makes all logins and passwords go away.

I don't care how it works. Just make it work, because this is stupid.

Whoever does that, and manages to get the major players behind it, is going to be the next Mark Shuttleworth, if not Mark Zuckerberg.

YubiKey[1] serves a similar purpose. I use it as the second factor of authentication for my LastPass account, which stores completely random passwords for individual sites. Of course the biggest problem is always adoption, but Yubico were smart enough to make both the protocol and the server component open.

http://www.yubico.com/yubikey

That's great, now what about my iPad? And iPhone? And Android device? And etc. and etc.

what about public computers and malware? stealing the auth tokens stored on this usb dongle idea seems somewhat trivial to me.

The key wouldn't have to ever leave the dongle. The computer could send it a payload to sign, and the dongle sends back the signature.

Until you lose it.

At which point I call the company that makes the dongle and request another one. At the same time, they log into every site I use and create a new random password for that site.

The hardware key is just a token... it doesn't even need to be hardware. There just needs to be some trusted third party who can vouch that user U is at machine M at time T, and field all login requests on U's behalf without a lot of manual labor or memory work on U's part.

For those cases where I don't want persistent representation, the service could be configured to ask me to enter a password when I first try to access any of the sites they handle for me, and every half-hour thereafter, or whatever.

Facebook will be in a good position to do something like this before long, if they aren't already. I don't want to use Facebook logins for this because the company has far too much baggage in other areas. It needs to be a Verisign-type company that does nothing but logins and stores nothing but username/password pairs.

>At the same time, they log into every site I use and create a new random password for that site.

Uh, wait. This means they can log in into every account of yours. How secure you think that is?

It had better be very damned secure, obviously. There should be a process in place for ensuring (not to mention insuring) that. If not, well, that's part of the problem to be solved, isn't it?

This is _so_ close to existing already - if I could hook Google's Authenticator app into 1Password with it's Dropbox integration, I'd have pretty much exactly what you're describing.

Having said that, 1Password and Dropbox sync running on my phone, iPad, laptop, and desktop is actually a _very_ useable "single strong passphrase" multiple password management solution.

Does anyone know how secure my iPassword database is when stored on the key-shared-with-anyone-Dropbox-allows encrypted S3 buckets? (or in my not-all-that-unlikely-to-get-lost-or-stolen phone/ipad/laptop.) Their page says they use openssl with 128bit keys, and I use an 18 character password (upper & lower case, spaces and punctuation, but with 3 dictionary words separated with punc/spaces). I'm reasonably happy that's "secure enough" for me - if anyone's going to get my passwords it'll most likely be by court order (or rubber hose cryptography)

Of course, it's a closed-source app, so it'd take a fair bit of work to _prove_ to yourself that they're actually "doing the right thing" with the password database crypto.

Call the company? Why can't you just log into their site and request a new one? :)

Maybe you have to actually show up physically and give a DNA sample. Oh dang, you have an evil identical twin?

Curious for the reason behind the downvotes. Questions:

- Do you guys actually think the current situation is OK, with respect to the way Joe Sixpack and Jane Boxwine manage their security credentials?

- Do you think the situation will magically get better on its own without some significant centralization?

- Do you think social networking companies like Facebook or advertising companies like Google -- neither of whom consider end users to be their actual customers -- are the right ones to assume such a role?

I can attest that entering a ~32-character-long ~base64 password on PSN is a real pain in the ass. :)

This. The problem with secure passwords that I use (I switched to mainly unique passwords after the gawker incident) is that they are pain to type on things like xbox, android, etc.

Not only that, but some sites won't accept special characters in the password... now what do I do? I break out some crappy password that I have a chance in hell remembering.

Case in point, Discover Bank doesn't allow special characters in the password. Really now?

A bunch of banks don't allow special characters, some people have said it is so you can enter it over the phone (something I've never come across but I kind of doubt that.

If that really is the case, they are probably throwing out whether each character is upper or lowercase as well :/

You could just plug in any standard USB keyboard...

Maybe we should just send them the password in the "welcome to random service X you just signed up for" that new users always seem to get.

Okay that came out wrong - what I wanted to say was that we should generate a password for the user and send it in the email the welcome email.

Wait, that's not an attempt at humor? Okay, how do you solve the chicken-and-egg problem with the fact that your e-mail service also uses a password? Not to mention that e-mail generally travels in plain text.

I wouldn't use this for an email service, but otherwise it would remove the issue of dublicated passwords and mean that the advantage to hacking the service was very low.

Reply on news.ycombinator.com