Hacker News Reader

Comment by modeless | Hacker News Reader

This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be less secure overall. Because people simply wouldn't use the annoying password manager. Using a password manager without a master password is way more secure than not using a password manager at all.

If you are a business and you want your employees to be secure, forget about anything to do with passwords. You need hardware second factor tokens. Which I notice the article doesn't mention at all. An article about login security in 2022 that doesn't even mention hardware tokens for two factor authentication is not worth anyone's time.

View on HN

> You need hardware second factor tokens.

The recent targeted phishing attacks against Twilio and Cloudflare made this abundantly clear. Twilio didn't use hardware tokens and was hacked. Cloudflare reported they had 3 users who entered their username and password into the phishing site, but since all of their employees use hardware keys, they weren't hacked.

> You need hardware second factor tokens.

Be careful what you wish for. It's happening but not in the way you're envisioning. A lot of logins now require a phone app. That's the hardware offloading, and reduces overhead of having to manage dedicated hardware. Instead, users manage it themselves and the business piggybacks off it.

That’s great! Why not let the USERS have a choice of how to manage their own identity?

What would the alternative even be? Having the users keep a buch of different RSA keys?

You can use a single key (e.g. YubiKey), or the security key in a[n Android?] phone.

> Using a password manager without a master password is way more secure than not using a password manager at all.

I disagree, diceware AND hardware security keys, is stronger, no password manager needed at all.

However I agree the article is overblown. For most people, browser based password managers are probably a vast improvement, since most will likely never educate themselves on such things or accept the solutions as personally viable. The browser is right there and even prompts them into using it.

How does diceware reduce the need for password managers at all?

Because they are significantly more memorable than pw made from individually random chars without significantly reducing their strength.

I have a handful of diceware passwords for important accounts i need to remember, and find that pretty easy... the rest are throwaway level unimportant or I leave to email based login.

However I dictate password and security policies where I work, and don't have to adhere to stupid "change your pw every week" rules - so i realise this is not a solution for everyone working under different (stupid) conditions.

https://xkcd.com/936/

I have about 200ish passwords in my password manager. No matter how memorable any of those is individually, remembering 200 secure secrets is not practical. Nevermind the fact that many of those are used extremely rarely, good luck rembering diceware password that you use once in couple of years

That's fair, but I'd ask yourself: of those 200 how many are important enough to warrant a strong password? and of those how many are important and frequently used enough to need to be independent of email based authentication? Perhaps you don't need to remember as many as you think.

Safari already gates password autofill on the secure element (or enclave, I can never remember the difference) when such is available, which is what you're suggesting :D

That said you're absolutely correct, making autofill harder to use would mean people wouldn't use it, and would revert to predictable and reused passwords, and if you're a business you should be using token based authentication be they dongles or phone and PC's secure elements.

> you should be using token based authentication be they dongles or phone and PC's secure elements.

Phone? Really? I regard my smartphone as the least-secure piece of computing equipment in my posession. I certainly don't trust it to secure anything. A phone isn't a token; it happens to be "something you own", so some sites treat a phone as if it were a security token. This is a problem I encounter mainly on UK government sites (sites that I more-or-less have to use). These sites don't offer support for alternative hardware "tokens", nor for people who don't own a smartphone.

I had assumed that at this point all android phones have got some equivalent to the secure element present in all apple products produced in the last 5+ years, if they don't that's bananas.

Assuming that, a phone is likely one of the most secure devices that you own.

Having a "secure element", enclave or whatever, doesn't mean that some rando TPA app is using it. I'm not qualified to inspect the source-code of Android apps. As far as I'm conceerned, these enclaves aren't for my protection; they're there to protect the interests of the device's owners (which isn't me).

A smartphone OS runs under the supervision of another OS, which is proprietary - source-code not supplied. A lot of the hardware is also proprietary, each component having its own (opaque) firmware blob. The device has telephony and internet connectivity. The connectivity providers behave as if they own the device, install software without warning, and surreptitiously inject content.

If I'm not competent to analyse the device myself (and I'm not), then I'm dependent on third-parties to confirm the device is secure. How many smartphone reviews have you read recently that focused on security, rather than how shiny the device is, how good the cameras are, or how good the screen is? I don't recall ever seeing a review that paid any attention to security.

These are opaque devices, with a huge attack surface. It makes no sense to me to describe it as "one of the most secure devices that you own".

I agree on the TPA not using the secure element on the phone is an issue, but I wasn't addressing low quality authenticator apps, but for apps or for tokens you're assuming that the developers haven't cheaped out.

> A smartphone OS ...

Yes, and the same applies to tokens albeit with simpler logic, and the same applies to any PC. So at some point you're saying "I trust that the company producing the product I'm using is not lying in their security documentation".

> .. Reviews ...

Correct, because reviewers are talking about feature set, competent phone companies provide extensive documentation of the security architecture of the devices. Security researchers periodically write up their investigations.

> These are opaque devices, with a huge attack surface.

No, by the standards you have presented all your devices are opaque, but unlike every other device you own the default security model of a well designed phone is far stronger than any other device you have. They don't run arbitrary code, they don't support loading code into kernel space, user partitions are completely separated from the read only system partitions, etc.

> all your devices are opaque

Point taken.

I'd take a maximum transparency keyfob-type device. By "maximum transparency", I mean I'd have to be able to assemble it myself, from COTS components, and understand any software it runs. But I have no idea how to make such a thing (I've tinkered a bit with microcontrollers and TTL).

The closest I'm aware of is the fob my bank gave me; it has a number-pad and a display, you read a challenge off the screen, and trype it into the keypad. It displays numeric response, and you type it into the website form.

That seems cool, if I could build the device myself, or even know what it does.

That's because this is low-effort blog spam to advertise their security consulting business.

Reply on news.ycombinator.com