Hacker News Reader

Comment by MetaWhirledPeas | Hacker News Reader

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places.

- OS sees the device as a keyboard

- Two versions. One with bluetooth, and one with only USB for a little more security.

- Open source software package to sync your collection of PSDs

- Open source browser extension to autofill passwords

- Tiny keyboard on the device (detachable to share between your collection?)

Usage:

1. Install browser extension

2. Navigate to a password field

3. Follow prompt to populate password

Alternate usage:

1. Manually search for password using the device keyboard

2. Click into password field in browser

3. Press button on device to have it type the password

Or of course you could just view the password on the device if you prefer.

View on HN

No offense, but this is such a hacker solution. :) And as mentioned, already exists in many forms.

Passwords and login credentials are dead. No user wants to deal with them. Password managers are a solution to somewhat sanely and securely manage this complexity, and not something that the average user wants to think about. In that sense, they don't improve security overall, and introduce many other issues (a centralized honeypot, in the case of services like LastPass).

The industry has been trending towards OTP, FIDO, WebAuthn, and all sorts of identity solutions, instead for years now. It's clear that nobody wants to manage credentials, and having a separate security device is not something mainstream audiences will adopt, so maybe by integrating it with smartphones, this will finally catch on.

It will likely take years for most of the industry to move away from passwords, and we'll likely still require traditional credentials in some cases. The myriad of standards out there is a hurdle for adoption, but it feels like we're settling on something that might be usable for everyone.

Considering that 99% of web app password authentication reduces to email authentication via ‘forgot password’, a good first step would be dropping the password and just using emailed tokens (or links) directly.

When I was studying we had to use the computers in uni when presenting homework.

It gets really annoying when you want to sign into $service on those machines, but you need to use a magic link. Because the you need to login into your gmail, which requires an additional 2fa (and you can’t receive sms in a building that has 6 stories but no femto cells).

Unfortunately google requires either their app or SMS. They dropped pure totp for some reason.

Awful experience.

> Unfortunately google requires either their app or SMS. They dropped pure totp for some reason.

Gmail TOTP still works fine?

Yup, but it seems it will default to "click the notification on your phone" as soon as you've signed in on a phone. You need to click "try another way", even if you've explicitly told them that TOTP is your preferred default.

If you first enable app or sms then you can add totp (that was my experience at least)

Also hardware keys work just fine with Google.

> Unfortunately google requires either their app or SMS. They dropped pure totp for some reason.

I use TOTP with my Google Account all the time. If you have a phone registered with that Google Account it will default to the push notification system first (it might even be possible to make this no longer the default, I'm not sure), but you can always click the button to switch to alternative 2FA options.

> for some reason

Google plainly dropped totp wherever possible in order to confirm everyone's identity.

Totp was an open standard that didn't help them spy on anyone, and they regret releasing it bigtime.

>Unfortunately google requires either their app or SMS. They dropped pure totp for some reason.

You have to add a phone number, turn that on for 2fa.

Then you can add TOTP.

Then you can disable SMS.

SMS will still work for at least a week because fuck you.

I hope not. Not only is this often frustratingly slow, it really complicates things for people who use devices where they don't receive email. Myself, I only receive email on my computer and one mobile device. I have several devices where having to click a link in an email to log into a site means annoying gyrations trying to transfer links from one device to the next. This is especially annoying when whatever mechanism you use to transfer the link does link previews and the login link is one-time-use. :D

> means annoying gyrations trying to transfer links from one device to the next

There are alternatives to this, such as typing a code into the login prompt instead of following a link (which will be submitting that code). This does limit the size of token that can be used because it needs to not be too inconvenient for the user to type, but if the code's validity is sufficiently short-lived, and properly unguessable, this can be done without compromising security any more than it already is by involving SMTP in the process.

Of course the other problem with email-only password resets is that users often receive email on the same device they are trying to authenticate – so if someone has left a machine unlocked with their mail account logged in, an attacker can gain access to any site/app that uses this password reset mechanism. One of the reasons that email and SMS are not great choices for a second factor, and even less good choices for what is sometimes effectively the only factor.

Agreed. This is one reason I limit the number of devices that have my email credentials. Using 2FA everywhere is sadly not practical yet, so there are a nontrivial number of accounts that are, as you point out, effectively owned by anyone who can access my email.

I actually occasionally fantasize about implementing a mechanism that I could use from my desktop (where my password manager is) to send passwords as needed (e.g. one at a time) to my devices (I really like not worrying about syncing whole vaults). Encrypt the password using an epehemeral key (gets deleted after 60 seconds, for example) on the transfer service and a local key derived from a random six digit number. Display the number, send a url to the device, and anyone hitting that URL has 60 seconds to enter the six digit code and it decrypts the password and drops it on the device clipboard. This is about 1000 times better (and over-engineered, naturally) than my current practice of "paste it in a slack message to myself."

except this is not good UX when sometimes the email links take minutes to arrive, if they arrive at all.

This does seem to be the latest trend - passswordless authentication or "magic links."

FIDO, UTF, WebAuthn. It can't get here fast enough.

User authentication has been a hot mess for at least two decades. Passwords need to go.

The Precursor should tick your boxes, and with an FPGA-based SOC.

https://www.crowdsupply.com/sutajio-kosagi/precursor/updates...

By bunnie too, so you know it'll be good :)

I love the price on that.

You would also likely need a way to get this to work on a mobile phone too. I know from personal experience that there is plenty of times nowadays that I end up logging in to various places using my password manager (not lastpass) on mobile.

The phone would still see the device as a Bluetooth or USB keyboard and the "alternate usage" should work.

Android and iOS work with Bluetooth keyboards.

But not _as_ bluetooth keyboards, which is what the proposed feature requires.

You could have it MITM between your keyboard and computer. Depending on the mode it records your key presses to an entry, or replays an entry. Otherwise it just passes through.

Probably just needs a screen and like 3 buttons: record/play/navigate mode (use your keyboard to actually navigate).

That model (with record) would need me to come up with passwords and type them. Seems like a hassle and a security problem.

Needs an “insert random text and record” button too I guess.

You can use the Trezor as a password manager. Passwords are not stored on the device, but the key and all encryption/decryption happens on the device.

I won't lie but I lost you in the steps mentioned here. Finally, IMO, people just want auto-fill/auto-logged in instances without having to enter OTP/type password/do 2FA etc. No matter how you slice it, that's the way people want. Now, how do I compress all these requirements within the boundaries of what is acceptable as a provable source of identity, it becomes a harder problem than you describe.

PS: I have worked in computer security and I am drunk. Eat your salt

Isn’t this a yubikey? Except a yubikey can also do a lot more, primarily sign tokens without private key ever leaving the device.

Which, as someone else explained below, is far superior to plain text passwords.

Yubikey is really great, but it's for 2FA, not password storage. My thought was to replace cloud password managers.

You can set static password for yubikey double click. But then it is only a single factor - something you own and just doubleclick to input that key. https://www.yubico.com/resources/glossary/static-password/

such as this open source device? https://hackaday.com/tag/mooltipass/

Yeah that's pretty close to it. It has some unexpected features though, like automatic logout. Weird!

Reply on news.ycombinator.com