Hacker News Reader

Comment by rglover | Hacker News Reader

Preach. Passwords + password manager are the more secure ideal.

Everything I've seen to replace or "fix" the problems with passwords just makes things worse.

My requirements are:

1. Nothing tied to a specific device, especially one that can be easily lost/stolen/broken like a cell phone or USB drive

2. No biometrics

3. It shouldn't permit anyone, outside the website I'm logging into, to know if, when, and/or how often I log into that site.

I'm pretty sure using passwords with an offline password manager is the only thing that satisfies that, but if someone comes up with something better that meets all my requirements I'd be all for it.

Other than a few awful providers such as AWS, 2FA isn't limited to a single device. Put it on your cell phone and your old phone you upgraded, or a cheap old phone, or multiple yubikeys, etc.

If one is lost you grab a second device.

yubikeys are interesting, basically not much different than a password manager in the case they get lost/stolen, but I worry about the privacy aspect. I assume using the app, or the use of yubicloud would allow yubico to know which sites I use, and perhaps when.

Why would you assume that? You don’t need to use their app.

It looks like it might be possible to avoid leaking a list of the sites you use with yubikeys, but I need to look closer at how they work on the website's end to make sure they aren't using YubiCloud or some other third party service for validation or key management, and to make sure nothing is trackable through it. It looks like Yubico OTP requires Yubicloud and using yubico-pam might use Yubicloud.

I deal with #1 by having two YubiKeys, and registering both

sqrl, but no one is using it because the big boys can't own it or sell it or use it for any sort of lock in or stickiness, and also probably because it's actually correct, which means there is no way to fix user F-ups

Yep. It's often users' magical thinking combined with charlatans trying to sell them a panacea.

1. Can't be tied to just one device - Must have backup codes or multiple devices that can act as the same to prevent lockout and aid legitimate recovery.

2. No biometrics - Doesn't survive rubber-hose cryptanalysis. Easily impersonated.

I would add the following:

4. Unable to operate without my interactive, explicit permission.

5. Not a device left online 24/7. Preferably detachable.

6. Not an NFC.

Congratulations, we've just reinvented the emperor's new clothes with very long CSHWRNG-generated passwords or key files, password managers, FIDO2 hardware devices, and backup codes.

> 2. No biometrics - Doesn't survive rubber-hose cryptanalysis. Easily impersonated.

Also, biometrics generally can't be revoked. Not nearly enough attention is paid to that, and it's very important, IMO.

In the extreme case, let's say you're using actual DNA. On the surface, that looks impregnable to anyone but maybe your identical twin (barring the "rubber hose" thing, of course).

In practice, anyone who's hacked a genealogy site (as happened quite recently with 23andMe, IIRC), or who's managed to grab your used coffee cup or cigarette butt pwns you forever.

Client side ssl certificates satisfy all your requirements and are phishing resistant.

I have MFA on for everything and I've about had enough. I'd rather have super non-memorable passwords for everything and have one MFA code for the password manager vault.

Passkeys should not require MFA either. I see a good enough future for me and it's:

1. Bitwarden with vault password and MFA

2. Everything else within, passkey

I'm completely unconvinced MFA is necessary if the "password manager at top + passkeys for services" mentality is ingrained in everyone. If you offer a service where I sign in with a passkey and also require MFA you better publish an extremely convincing security paper why, or have an infrastructure critical service that burns the world down if someone unauthorized gets in. There is no other justification for that level of security other than to be an asshole.

Yes and no. Many online services still have silly rules about password construction and length that preclude the random generated passwords that many password generators create. I often have to remove/substitute disallowed characters or shorten the generated passwords because the service has an arbitrary limit on the length of a password.

So yes, they are better but they are still often inconvenient at least when adding a new service.

Can’t stand this. I want to challenge the CTO of my bank to a public debate about password best practices.

And a double pox on those sites that disallow "paste" in their passwords fields.

Blowing my own horn a little, I have a Perl script that generates random passwords, with options to, for example, generate a 16-character password with lowercase letters, but with one uppercase letter, one digit, and one punctuation mark, all chosen randomly and placed at a random position:

    $ gen-password -len 16 -lower -1upper -1digit -1punct
    e$hmvcel9nyghAyw

Another script in the same project generates XKCD-style random passphrases.

https://github.com/Keith-S-Thompson/random-passwords

Password manager + MFA is a lot more secure. Password managers aren't impervious to attacks.

False dichotomy and less secure. Very long passwords + password managers + separate FIDO2 hardware. The point of MFA is that even with a compromised password manager or compromised password, that extra factor is required. The more damaging the loss of credentials would be, the greater the user costs of actual security (more factors) should be allowed to protect them in order to multiply the costs and trouble to potential attackers.

Reply on news.ycombinator.com