Hacker News Reader

Comment by jayfuerstenberg | Hacker News Reader

I'm obviously biased as I created KEYBOX, an iPhone app for easily managing passwords, amongst a whole host of other secrets.

So take my below answer with a grain of salt...

I'm surprised by all the attempts to replace the password with non-secret keys be they facial recognition (face prints?), fingerprints, or other...

I can login to your facial recognition screen just by holding up your photo. Fingerprints are little more difficult but the technology exists.

But if I am not in possession of your password I'm going to be spending a lifetime cracking it.

Conclusion: Keys are not secrets and can be easily copied. Passwords ARE secrets.

Yes, passwords can be difficult to remember but that's a different problem.

If you want to see secret/password management done right check my website ( http://www.jayfuerstenberg.com )

View on HN

Umm ... your conclusion is kind of funny and wrong. You might not be familiar with cryptography, modern smartcard technologies, and how those can actually keep a secret.

I agree with your assessment on facial recognition and fingerprints, though the biggest problems with the fingerprint authentication are the lack of ubiquitous sensors and privacy issues.

But password manager software is better than nothing ;)

I'm quite familiar with cryptography and the principles of secret keeping. I am not as knowledgable about smartcards I admit.

Is there something that makes a smartcard based USB key work differently when held by a person other than its rightful owner?

My impression of them, perhaps incorrect, is that they are akin to Hanko ( http://en.wikipedia.org/wiki/Hanko_(stamp)#Japanese_usage ). Basically a system of using possession combined with a fairly unique set of data as a means of distinguishing and authenticating its owner. But in practice its far less than perfect.

Good smartcard in general cannot be copied and it will not work without the user's pin code. It can also lock itself if the pin code is entered wrong too many times. But most importantly, the keys/certificates inside the smartcard can be revoked remotely if the smartcard is lost. So even if the wrongful holder of the key has somehow got hold of the pin code, he cannot use the key for long.

Nothing is perfect of course. The risk/threat is very similar to someone stealing your phone and has somehow gotten to know your master password to your password management software. However, password management does not really solve neither the usability or the security problems of usernames and passwords ... although a good piece of software can certainly help.

Thanks for the thorough reply! It sounds promising.

Reply on news.ycombinator.com