Hacker News Reader

Comment by valenterry | Hacker News Reader

I can't even register more than 1 yubikey in almost any service that I use. We are faaar away from easy, secure and also robust authentication in the web. On top of that, I don't like big central services to control my authentication and collect data about me.

Thank you, but until we arrive there, I'm happy to stick to my password manager. This post just comfirms my impressions.

View on HN

Oh and to expand on that. I like to be able to setup my own authentication without having having to rely on 3rd party software, just in case. Relying on cryptographic hashes (for password hashing) is already kind of bad, but at least there are open source libraries who are hopefully checked by professionals on regular basis.

I'm with you. Using a password manager is brain-dead simple nowadays. Gone are the days of syncing KeePass databases on cloud drives. Bitwarden is completely free and reliable, for example. Autofill works on all major browsers on both mobile and PC.

The real problem here is user ignorance and apathy. We can try to force things down users' throats but they literally do not care about robust account security practices. They'll just lose the dongle or key or whatever you give them anyway, which will force some kind of centralized approach that introduces its own drawbacks (e.g., being deplatformed or canceled).

Most places, I thought, finally allow multiple keys? Who is left not doing it?

All 3 of my (german) banks for example. One bank here (N26) even only allows a single(!) smartphone for 2FA. So if I lose my phone... well, screw me.

I was curious if it was going to be banks. I don't think any of my banks allow yubikeys, yet. Will have to look into that.

Banks are especially bad. I know one bank that has you memorize 7 digits access codes and for authentication asks 4 digits at random places each time.

Reply on news.ycombinator.com