Hacker News Reader

Comment by brennenHN | Hacker News Reader

This is why we're storing important user credentials on a user's phone instead of all on a central server! (https://clef.io)

View on HN

Is this just thinly veiled spam for that site? I can't tell if you work for them or not but, if you do, it's not in your profile. If so, I think it's pretty tacky when companies to take every possible opportunity to get their name out there...

Profile updated. Thanks, didn't mean to be disingenuous. Its okay to call me tacky - I actually think this stuff matters.

I think ScottWhigham was talking about brennanHN rather than you. Nothing tacky about your submission.

Hmm...that seems to have potential, but it requires custom integration and users to use your app.

Is there an open protocol for this?

Looks like you're doing something similar to the mutual auth that wikid does...a whitepaper or two with more depth would be useful on the site

This is pointless. Solutions like keepass are just as good and don't require existing services to hook into new authentication API's. In fact, they're better because they don't run the risk of opening a whole new central attack surface.

What happens if your phone gets stolen?

Then wouldn't that be the user's fault/problem?

Sure, but designing around the inherent riskiness of user behavior/forgetfulness is an important part of security systems. Users want to be protected, not for blame to be shifted to them.

Then one user's password gets stolen, as opposed to thousands.

Yes, it certainly mitigates the scale of a potential breach and I like that the reduced scale/potential value makes it a less attractive target to hackers (assuming the server side is also built in a secure way). I havent investigated, but it makes me nervous to think that if my phone is stolen, the thief gets my data too.

0.0000014286% of the damage that happens when Sony's database gets hacked (assuming equal payload).

As a consumer though, I could change my password on a server if it gets stolen. But how would I reset it after my phone was stolen if authentication is all stored client side?

Use a PIN, and if possible, encrypt your phone. It won't completely mitigate the risk, but it will reduce your surface area.

Reply on news.ycombinator.com