Hacker News Reader

Comment by fmakunbound | Hacker News Reader

Reading through the threads here: If the HN can't articulate FIDO and differences between it and the now decades old password model to each other, I think regular jack-offs are going to have trouble.

People have the mental model that their secret is stored in their gray matter/post-it note/password manager, and now you're telling them it's in their phone, and somewhat related to the phone's security model, or maybe a "yubikey", or behind biometrics, or maybe not, it depends, and Big Co. has copy, of something, and it's synced, and one possibly "migrates" between Big Co. and Big Co. might deliberately/accidentally disable all your websites, or losing your device/yubikey/piece of paper means you're screwed, possibly...

View on HN

Unrelated to what you wrote, but it is actually jagoff or jag-off. It is not related to jacking off.

Yeah, well what I want is a (physical, literal) membership card like I have at the gym or library. I think "regular" people can learn to use USB tokens, and that they might make more intuitive sense than passwords. These places don't challenge me for the "secret password" when I come in, I just present or scan my card.

It's very tricky obviously, in terms of engineering and operations, for an internet based company to arrange anything similar. But I don't think it's too mentally foreign for the user (assuming we develop good standards).

So cards make sense to me. Way more sense than passwords. Maybe someone else feels more comfortable with the details living inside their phone, but that doesn't affect my mental model. Users don't need to understand or be taught the entire standard.

As you will have seen in lots of other posts to this topic, people want privacy and "I just show my membership ID everywhere, what's the problem?" unsurprisingly is not what they had in mind.

So, FIDO preserves privacy by minting unique credentials for each site where you use it. This is invisible to the user of course, for them it's just the case that you use your FIDO authenticator everywhere (that it works) and now it's secure.

I understand that. I was responding to the idea that hardware tokens like yubikey, in fact all alternatives to passwords, are too complicated for regular people to understand. And also saying that multiple options, to accommodate different people/scenarios, are fine and don't have to be complicated from the user's perspective. By way of analogy (admittedly I didn't make that very clear).

FIDO is an authentication standard. It doesn't care where your secrets are, it just mandates a way to use them to log in to websites. You can still use a password manager, it will just basically contain a single encryption key for all sites.

Reply on news.ycombinator.com