Hacker News Reader

Comment by jdthedisciple | Hacker News Reader

I've said it before and I'll say it again (and yes let it rain downvotes):

I don't understand this whole discussion and maligning of passwords.

You cannot save all people. Some fixed %-age of people will always become victims - either by choosing a terrible password or by being shot in the foot by some terribly complex 5FA device-based passphrase scheme that attempts to protect them but ends up betraying the user once they replace their phone or it breaks or for any other mundane reason.

User picked passwords (1FA) are and will always be the single best solution that has ever existed for authentication, considering everything from security to usability and practicality, wholistically.

If I sign up for some crappy service that I'll barely even remember a week later I should be good to go setting my password to "asdf" and that's everything I need to log in.

Fuck everything else. https://news.ycombinator.com/item?id=36717356

View on HN

You cannot save all people - too true. But remember that you, actually all of us, are indirectly the victim of other peoples' mistakes:

- we lose contact with people because they get locked out of their email

- we pay more in bank account fees to subsidise fraud compensation

- we have our personal information stolen because others chose weak passwords

Given how much we suffer from other peoples' poor choices, there is a huge incentive to somehow stop people from making poor choices. By analogy, we all benefit from fences by cliffs because the family of the unlucky soul who wandered off it, the emergency services and their funders all suffer too. If it weren't for values like personal freedom, aesthetics, financial cost and an apathy towards accidents, there would be no clifftop in the world without a fence by it.

>- we lose contact with people because they get locked out of their email

I've been locked out of my email because Google insists that "we don't recognize your device", and locked out of my other accounts because my phone was stolen, not because I didn't remember my password.

People forgetting passwords isn't a problem that's solved with other schemes. It's a problem that's exacerbated by them.

>- we pay more in bank account fees to subsidise fraud compensation

Bank account fees, seriously? I can't remember the last time I've paid any.

In any case, worrying about saving the banks a few bucks is dead last on my list of worries.

>- we have our personal information stolen because others chose weak passwords

If our info can be stolen because someone else chose a weak password, the weak password isn't the problem. It's the system that was badly designed in the first place.

>Given how much we suffer from other peoples' poor choices,..

We don't.

>By analogy, we all benefit from fences by cliffs

The analogy doesn't hold because you have to first show that alternatives to passwords are better for the users, even those in the category you mention.

> People forgetting passwords isn't a problem that's solved with other schemes.

Sorry, I should have clarified: that was in reference to users being unable to successfully use the parent's hypothetical 'terribly complex 5FA device-based passphrase scheme'. Passwords don't get any blame here.

> Bank account fees, seriously? I can't remember the last time I've paid any.

OK, fractionally lower interest growth then, or less frequent premium bond wins. In any case, the bank is going to find a way of passing the cost of business to you, so you have an indirect incentive for their business to be cheaper to them.

> If our info can be stolen because someone else chose a weak password, the weak password isn't the problem. It's the system that was badly designed in the first place.

That is correct for some kinds of personal information, like how storing documents on a 'cloud' without client-side encryption is a badly designed system for privacy. However, there are genuinely some occasions where a third-party needs to have access to (not just verification of) your information, but also has a responsibility to keep their copy secure. A hospital might need to see your medical records to do its job, for instance.

> The analogy doesn't hold because you have to first show that alternatives to passwords are better for the users, even those in the category you mention.

I completely agree with you. All I'm saying is that a lot of people will try to replace passwords (because we all have an incentive to improve the situation), even if their replacement fails at being better for users!

Ah, thank you for the clarifications! I agree with all of the above.

Re: bank account fees. I think OC was just making the point that one institutions’ lack of security practices gets passed to the entire system as a way to offset fraud costs, we all universally eat this stupid cost.

An example of this is chargeback fraud on marketplaces. The way the fraud works is someone buys a bunch of credit card numbers off of the dark web due to some websites’ bad security practices and a data breach. The fraudster then ATOs a merchant account on some marketplace platform or makes a fake account, e.g. Doordash, Airbnb, Shopify, etc. The ATO is usually possible because some subset of the merchants of the platform use the same passwords on another website that has been compromised, again, some data set is sold on the deep web. The fraudster then either has to change the payout method of the marketplace merchant account, which they can usually do by ATOing an acquiring bank that they can access the funds in some way, again due to another external institution with tenuous security practices.

Finally the fraudster charges all the stolen credit cards and in most cases leaves the platform taking the liability. This results in the platform pushing up take rates against their merchant accounts, which almost always gets passed back to the consumers of the service (us) by increasing the prices of the service.

The problem with passwords is that we expose ourselves to everyone else’s negligence. You might handle passwords with all the best security practices to be known but you expose yourself and your users to every other system’s incompetence. It wasn’t until I saw this play out, that I understood passwords aren’t just a disservice to the negligent compromised user but really to the whole ecosystem of the internet that partakes in password authentication.

Yes, there is always a trade off in security and friction. This has always been true. But if we know passwords are faulty and essentially useless, why continue with such a bad practice? To reduce friction to a maximal extent? By that logic we might as well throw out the concept of security altogether. Why not just make it so a user only has to enter their email/username and nothing else? Let me know how that goes for you. I think webauthn is likely the sustainable, long term solution but we’ve got a ways to go before some of the inane thinking around password preservation dies out.

> - we lose contact with people because they get locked out of their email

This is a temporary condition, and they can create another email or communicate via other means. If some part of your life is highly dependent on a single email address remaining 100% available, you've made a mistake already.

> - we pay more in bank account fees to subsidise fraud compensation

I have a feeling that if you got rid of passwords, new forms of fraud would become prevalent, and the fees would remain. Humans are humans, taking away the password does not insulate them from their own basic nature.

> - we have our personal information stolen because others chose weak passwords

It's the same issue as above. Your information has value, so it will be sought out by people who wish to exploit it. Social engineering exists and won't go away just because we got rid of a single token based mechanism.

> Given how much we suffer from other peoples' poor choices,

It's a poor choice to be dependent on email or to give your personal information away to every single form that asks for it. You can balk at the external factors if you like, but you won't solve anything by it.

I think they're talking about social interactions leading to exchange of personal information, and so a private person is still known by the ripples they leave in their social circles.

For instance if grandma wishes me happy birthday, and she gets hacked, now they know my birthday. Grandma also probably gave away my mother's maiden name as well.

I don't understand your point.

Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The population there is hardly uneducated, yet they still had quite a few break-ins. Some of the companies have also nearly removed passwords, changing the minimum length requirement to something like 5 lowercase characters. They still experience a near zero, or zero, phishing success rates.

Sure, you could even reduce phishing attack success rates to nearly 0% by having users authenticate with a sample of their DNA.

Does that mean it's a great idea?

What about losing the yubikey?

In any case it's a different matter when it comes to high stake scenarios, in which case I don't mind something slightly more sophisticated.

But not as the default for everything.

>having users authenticate with a sample of their DNA.

I know it's not your point and I agree with everything you're saying in this thread 100%, but DNA based login would be a username, not a password. Like all biometrics. And it'd have a really bad false positive rate if you're just doing restriction enzyme cut location tests like lots of "police work". A full exome scan ~$300-500/per might do it.

And as you point out, the problem with biometrics is that once they're stolen or copied, there's no changing them. Particularly your DNA.

> What about losing the yubikey?

I have 5 yubikeys on multiple continents. If I lose one I can log in with the others and remove login access with the compromised yubikey.

> I have 5 yubikeys on multiple continents

Are you actually retarded or just disingenuous? This is hardly a workable solution even for security nuts, let alone the average person.

> Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys?

The actual question is: "Did they see an INCREASE in other types of attacks after using yubikeys?"

To presume that these actors who were willing to go to some illegal lengths to get this information in the first place just "gave up" because "yubikeys exist" is a dangerous way to process these facts.

> Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys?

His point (my emphasis):

> User picked passwords (1FA) are and will always be the single best solution that has ever existed for authentication, _considering everything from security to usability and practicality, wholistically_

So his point is that if you consider all aspects wholistically, including usability and practicality, passwords are the best solution.

I'm not saying I agree, but a 100% reduction of successful phishing attacks after introducing Yubikeys only considers security, and not the other factors.

Based.

It's trivially easy to generate passwords with 128 bits of entropy and have them managed by a password manager.

Until the password manager gets hacked. Well, tough shit. If your primary device gets hacked, the hacker just has to wait until the next time you log in with the bullshit gazillion factor authentication.

And it always collapses to 1FA for the lost password recovery process, which you're gonna have to provide if you want customers.

> Until the password manager gets hacked. Well, tough shit. If your primary device gets hacked, the hacker just has to wait until the next time you log in with the bullshit gazillion factor authentication.

Can you elaborate? This scenario assumes that a) the primary device is the only 2FA option b) there is no one-time codes and c) the attacker persistently waits until a 2FA request comes through then somehow hijacks it with their own connection request?

Nah, he just hijacks your session directly.

I kind of see where you are coming from, because it's true that every alternative to passwords that seems to be gaining traction right now is horribly complicated. Webauthn and passkeys are like the IPv6 of security upgrades. Waaaaay, way more than is needed to improve upon the security of passwords.

Now, the rest of your argument kinda sucks, sorry to say. There are things we can do to make everyone's personal information more secure. Using childhood clubhouse password "technology" is not cutting it. We can definitely do better than shared secrets that get leaked to the whole internet on the regular. We can be more secure with an easier to use UI. Yes, people will still get pwned, but less people will, the bad guys will have to work harder.

Hard agree.

I can count on one hand the services that are critically important enough to warrant unique passwords and good practices anyway.

All the other services I have accounts for? I literally can't care if some yahoo in WhereTheHellistan wants to and does get in, there's nothing valuable in there. They all get the same, simple, short password because that's the value of the things behind the password.

Yes, this means all of you reading this are quite welcome to try and steal this HN account guarded by the same, simple, short password. I don't care, all you'll be getting are worthless shitposts and things of similar value in any other services you can find and breach with the same credentials.

It costs the company in support costs to deal with lockouts, and the newbie does want their cake and to eat it to, thus the entire push to passkeys.

Reply on news.ycombinator.com