Hacker News Reader

Comment by wly_cdgr | Hacker News Reader

Stop trying to make no passwords happen. It won't happen

It sort of has happened for Apple users.

For all sites whenever you signup for a website a random password is generated. And then when you re-visit the site you use FaceID/TouchID to automatically pre-populate the password. At that point it really isn't a password in the traditional sense.

And for an increasing number of sites it bypasses this step entirely and just lets me use FaceID/TouchID.

Why single out apple? This is the experience for anyone who uses a modern password manager

Most people don’t and won’t change if change requires effort. In contrast by making a password manager functionality the default on Mac/iOS, Apple carries the average user into better security.

  > really isn't a password in the traditional sense.

Can it be sniffed out with XSS? Can it be sniffed out over the wire on the university Mitm'd network? Can it be stored on the server in plain text?

The user experience might have changed, but many of the security aspects have not.

I'm pretty sure that poor passwords ("password1!") and password reuse combined dwarf basically all other password-related security issues, thus getting users to use a randomly generated password on every website is a magnitude of order more secure.

On top of that, in cases of XSS or a MiTM you've probably already lost and no password alternative will help you.

Webauthn is secure even in the case of XSS and Mitm, in the sense that the attackers still cannot access the credentials without user intervention. It tool a long time to convince me, too.

https://webauthn.me/introduction

True but mostly meaningless. XSS and MiTM allow attackers to take over and pretend to be the user after a legit user logs in. The attacker cannot store the credentials and use them later, but they have full access in the moment.

The only reason for (consumer) passwords you have to remember is lack of an accepted good universal id in general. Here in Sweden it's provided by the banks and has a 94% share of smartphone users, if you look east you have other bigger markets with similar stats. Most passwords already have disappeared or are disappearing, the laggard cases will catch up too, I'd love a similar one for my "work persona".

"But people will never let their on-prem servers go into an obscure, shared Cloud".

Password reset is almost as good as no passwords but with the added benefit of MFA.

It can happen, I've seen many Lightning Network applications that do account creation/login and identity verification using LN wallets/nodes/etc.

I wouldn't consider those solutions passwords in the traditional sense.

Public key authentication would be a great replacement for most passwords.

Email a login link or temp pw. Passwords gone.

Depends on how often you’ll be logging in and out though

I share accounts (legally) with friends and my wife. How are we going to log in separately?

Forward the email ;-)

Or just add an extra email to the account

Forwarding the email is not a good solution. I don’t want to be checking emails at all times just because someone wants to login somewhere.

Adding an extra email account is not always possible. The option is not provided.

Maybe I'm missing something. You're just replacing the "password" by asking the user to login their email. It doesn't move us any closer to a "no password" world, unless there is also a proposal on how to make email password-less?

https://www.google.com/amp/s/www.theverge.com/platform/amp/2...

How do you login to your email?

Magic text message with an 8-digit code. ;-)

For anyone thinking about it: Please don't make it happen.

What if you are logging into something on a device that doesn't have your email on it? So called magic links are an absolute nightmare.

Ok...so on to more inconvenient methods? Medium tried it. A real drag.

Reply on news.ycombinator.com