Hacker News Reader

Comment by markkum | Hacker News Reader

Good article, though the whole premise of people being forced to manage passwords is screwed. We are working hard at Mepin - www.mepin.com - to get rid of passwords one by one. Our premise is that people are much more capable of managing a key - a physical key like a phone or a USB key. Care to agree?

View on HN

I'm obviously biased as I created KEYBOX, an iPhone app for easily managing passwords, amongst a whole host of other secrets.

So take my below answer with a grain of salt...

I'm surprised by all the attempts to replace the password with non-secret keys be they facial recognition (face prints?), fingerprints, or other...

I can login to your facial recognition screen just by holding up your photo. Fingerprints are little more difficult but the technology exists.

But if I am not in possession of your password I'm going to be spending a lifetime cracking it.

Conclusion: Keys are not secrets and can be easily copied. Passwords ARE secrets.

Yes, passwords can be difficult to remember but that's a different problem.

If you want to see secret/password management done right check my website ( http://www.jayfuerstenberg.com )

Umm ... your conclusion is kind of funny and wrong. You might not be familiar with cryptography, modern smartcard technologies, and how those can actually keep a secret.

I agree with your assessment on facial recognition and fingerprints, though the biggest problems with the fingerprint authentication are the lack of ubiquitous sensors and privacy issues.

But password manager software is better than nothing ;)

I'm quite familiar with cryptography and the principles of secret keeping. I am not as knowledgable about smartcards I admit.

Is there something that makes a smartcard based USB key work differently when held by a person other than its rightful owner?

My impression of them, perhaps incorrect, is that they are akin to Hanko ( http://en.wikipedia.org/wiki/Hanko_(stamp)#Japanese_usage ). Basically a system of using possession combined with a fairly unique set of data as a means of distinguishing and authenticating its owner. But in practice its far less than perfect.

Good smartcard in general cannot be copied and it will not work without the user's pin code. It can also lock itself if the pin code is entered wrong too many times. But most importantly, the keys/certificates inside the smartcard can be revoked remotely if the smartcard is lost. So even if the wrongful holder of the key has somehow got hold of the pin code, he cannot use the key for long.

Nothing is perfect of course. The risk/threat is very similar to someone stealing your phone and has somehow gotten to know your master password to your password management software. However, password management does not really solve neither the usability or the security problems of usernames and passwords ... although a good piece of software can certainly help.

Thanks for the thorough reply! It sounds promising.

Yes, people are good at managing physical things. The issue I'm guessing you'll run up against is the implementation. You have to convince every developer to adopt a new mechanism for authentication. I don't think passwords will be displaced very soon; they are just too easy to implement.

We currently support OpenID, so any site/service supporting OpenID works with the Mepin keys. Sadly there are a lot of shaky OpenID implementations out there, so yes the implementation is a challenge. And I do also agree that we will never get rid of all the passwords.

Not necessarily. All you need is browser extensions that mimic the built-in remember password functionality, and a hardware-encrypted USB key that serves as a data store for the browser extensions.

That does reduce the USB key to a single point of failure though. That risk could be mitigated with a proprietary key copier.

A standard way to generate key pairs for authentication would be a lot better though. (Really, there's no reason we couldn't use SSH private keys with some simple client and server plugins.)

Any physical key that is easily copied is too easily compromised to be a serious alternative to passwords. Just think of the last time you left your phone on a desk or something while going to the bathroom.

Our USB key cannot be easily, if at all, copied. It's based on smartcard technology used by banks and governments around the world. It's not a memory stick.

Our USB key cannot be easily, if at all, copied. It's based on smartcard technology used by banks and governments around the world.

There's an implied 'because' between these two sentences, which I think is problematic, since the first sentence does not necessarily follow from the second.

I couldn't care less about the second part, but the first is a great idea. When I visit the website in your profile, though, I don't see any mention of hardware, just software.

Is there more information available somewhere?

You are right. The sentences were hastily written.

The hardware key is in private beta and will be publicly available soon. We have evaluated half a dozen smartcard technology vendors and are partnering with a couple of them, so we can deliver a key with or without FIPS certification depending on your cost consciousness and security requirements. Please e-mail me for additional info.

USB keys aka dedicated devices are dead. Noone wants to carry around yet another gadget. Reuse a phone instead. Much more pervasive.

I agree with you and I made it so the iPhone you carry around everyday can be your password manager.

I'm honestly not trying to spam HN with links to my product but since it's on topic I'll just mention that I developed an iPhone app called KEYBOX ( http://www.jayfuerstenberg.com/keybox/ ). It securely manages passwords and other secrets without dongles or other devices.

USB keys are a good idea from a convenience perspective but what makes it convenient for you makes it equally so for a hacker (the nefarious kind) to break into whatever system you're trying to make secure.

We all carry keys. I use a key to get into my house, my car, my business. Keys aren't dead. A memory stick is certainly not secure, but one with the right smart card is relatively secure.

I'm not saying the device can't be secure. It' the inconvenience due to the physical impact and the fact that eventually you have to carry around a whole key chain.

I hope you give a couple of prototypes to Richard Clark for testing.

(http://www.cl.cam.ac.uk/~rnc1/)

(http://www.lightbluetouchpaper.org/)

Richard CLAYTON, not clark.

Reply on news.ycombinator.com