Hacker News Reader

Bad logic: author correctly notices that passwords are not the biggest problem in computer security right now, and yet somehow they should be eliminated. The weakest link is the the software running on the computer. Spyware, trojans, XSS, XSRF, all make your super secure authentication system irrelevant.

View on HN

The logic is sound if you take the stance that phishing is the biggest threat to security. I don't know whether it is or not, but XSS and CSRF at least are under the website developer's control. Malware and phishing are the head-scratchers for people who know how to build secure websites, and the information card system does partially address the phishing problem. It prevents the attacker from being able to log into your accounts, but it doesn't prevent you from telling him lots of other things.

If the information card also contained your public profile information, then a lot of phishing would be curtailed. The problem is that we are constantly asked for information. If this was largely automated, guarded by cryptographically secure means of identification, and attached to a physical device of some sort, then the number of times we're asked for information would be reduced tremendously.

Reply on news.ycombinator.com