Comment by imiric | Hacker News Reader

Comment by imiric | Hacker News Reader

Parent Full thread

No offense, but this is such a hacker solution. :) And as mentioned, already exists in many forms.

Passwords and login credentials are dead. No user wants to deal with them. Password managers are a solution to somewhat sanely and securely manage this complexity, and not something that the average user wants to think about. In that sense, they don't improve security overall, and introduce many other issues (a centralized honeypot, in the case of services like LastPass).

The industry has been trending towards OTP, FIDO, WebAuthn, and all sorts of identity solutions, instead for years now. It's clear that nobody wants to manage credentials, and having a separate security device is not something mainstream audiences will adopt, so maybe by integrating it with smartphones, this will finally catch on.

It will likely take years for most of the industry to move away from passwords, and we'll likely still require traditional credentials in some cases. The myriad of standards out there is a hurdle for adoption, but it feels like we're settling on something that might be usable for everyone.

Considering that 99% of web app password authentication reduces to email authentication via ‘forgot password’, a good first step would be dropping the password and just using emailed tokens (or links) directly.

When I was studying we had to use the computers in uni when presenting homework.

It gets really annoying when you want to sign into $service on those machines, but you need to use a magic link. Because the you need to login into your gmail, which requires an additional 2fa (and you can’t receive sms in a building that has 6 stories but no femto cells).

Unfortunately google requires either their app or SMS. They dropped pure totp for some reason.

Awful experience.

> Unfortunately google requires either their app or SMS. They dropped pure totp for some reason.

Gmail TOTP still works fine?

Yup, but it seems it will default to "click the notification on your phone" as soon as you've signed in on a phone. You need to click "try another way", even if you've explicitly told them that TOTP is your preferred default.

If you first enable app or sms then you can add totp (that was my experience at least)

Also hardware keys work just fine with Google.

> Unfortunately google requires either their app or SMS. They dropped pure totp for some reason.

I use TOTP with my Google Account all the time. If you have a phone registered with that Google Account it will default to the push notification system first (it might even be possible to make this no longer the default, I'm not sure), but you can always click the button to switch to alternative 2FA options.

> for some reason

Google plainly dropped totp wherever possible in order to confirm everyone's identity.

Totp was an open standard that didn't help them spy on anyone, and they regret releasing it bigtime.

>Unfortunately google requires either their app or SMS. They dropped pure totp for some reason.

You have to add a phone number, turn that on for 2fa.

Then you can add TOTP.

Then you can disable SMS.

SMS will still work for at least a week because fuck you.

I hope not. Not only is this often frustratingly slow, it really complicates things for people who use devices where they don't receive email. Myself, I only receive email on my computer and one mobile device. I have several devices where having to click a link in an email to log into a site means annoying gyrations trying to transfer links from one device to the next. This is especially annoying when whatever mechanism you use to transfer the link does link previews and the login link is one-time-use. :D

> means annoying gyrations trying to transfer links from one device to the next

There are alternatives to this, such as typing a code into the login prompt instead of following a link (which will be submitting that code). This does limit the size of token that can be used because it needs to not be too inconvenient for the user to type, but if the code's validity is sufficiently short-lived, and properly unguessable, this can be done without compromising security any more than it already is by involving SMTP in the process.

Of course the other problem with email-only password resets is that users often receive email on the same device they are trying to authenticate – so if someone has left a machine unlocked with their mail account logged in, an attacker can gain access to any site/app that uses this password reset mechanism. One of the reasons that email and SMS are not great choices for a second factor, and even less good choices for what is sometimes effectively the only factor.

Agreed. This is one reason I limit the number of devices that have my email credentials. Using 2FA everywhere is sadly not practical yet, so there are a nontrivial number of accounts that are, as you point out, effectively owned by anyone who can access my email.

I actually occasionally fantasize about implementing a mechanism that I could use from my desktop (where my password manager is) to send passwords as needed (e.g. one at a time) to my devices (I really like not worrying about syncing whole vaults). Encrypt the password using an epehemeral key (gets deleted after 60 seconds, for example) on the transfer service and a local key derived from a random six digit number. Display the number, send a url to the device, and anyone hitting that URL has 60 seconds to enter the six digit code and it decrypts the password and drops it on the device clipboard. This is about 1000 times better (and over-engineered, naturally) than my current practice of "paste it in a slack message to myself."

except this is not good UX when sometimes the email links take minutes to arrive, if they arrive at all.

This does seem to be the latest trend - passswordless authentication or "magic links."

FIDO, UTF, WebAuthn. It can't get here fast enough.

User authentication has been a hot mess for at least two decades. Passwords need to go.

Reply on news.ycombinator.com