Hacker News Reader

Comment by AndrewKemendo | Hacker News Reader

This is wrong though because unless you have the same password for everything (you shouldn't) the process isn't the single serving:

click login box, type, tab, type, enter

It is moreso:

click login box, type one of passwords 1-10, tab, type, enter

Which assumes you remember each one. It's an even better use case scenario if you are the guy with only one password for everything.

View on HN

I would think something like lastpass is an even better workflow however.

1. click login button 2. there is no step 2

Lastpass used to work like that for me. Now it causes me about as much hassle as it saves me. It does not do a wonderful job of handling multiple accounts on single sites; I frequently find multiple entries in the vault for single accounts, only one of which has the correct password (and usually the username is missing), and there are a number of sites whose presentation seems to baffle Lastpass, either in the login screen or in form-filling.

Also, Lastpass doesn't seem to offer to do as much for me anymore. Maybe I screwed something up in my config, but I don't see an AutoLogin option anymore.

So I'm just about ready to abandon Lastpass if anything else comes along that gives me a user experience like Lastpass used to give me. I don't know whether Clef is that service, but I'm at least glad that someone is exploring the space.

+1 for LastPass. Saves a bunch of time. They're pretty damn persistent about doing security the right way -- they don't have the key to open your data.

Except that's a bandaid over existing solutions. It's hard to imagine in 50 years we'll still require people to remember both a user identifier plus a password.

It's a tough problem. Human memories are fallible, yet it's with you always. Passwords can be given to others, which can be convenient in many situations (something bio recognition can't do). Bio markers like fingerprints are left everywhere as CCC has demonstrated, or the markers themselves can change such as with Macular degeneration in eyes. Phones can be stolen or run out of battery, physical key cards lost, and centralized systems like RSA's SecurID hacked.

In a lot of ways the banks have it done best, with combining a replaceable physical object (loanable) with a short PIN (sharable and more memorable), and then throwing fraud detection on top of it. It's the last piece that's the best and also the least available for others to do easily.

The problem would be better addressed by having a turn-key solution that any company can easily plug into their code to detect fraud attempts on short passwords. Big hole waiting for a startup to fill...

Plus the notion of "which of my ten passwords did I use for 'xyz.com?", you end up exposing your other nine passwords to 'xyz.com. Not as bad as using the same password everywhere, but still. I wouldn't want to accidentally give my bank password to, say, a crappy online forum.

BTW, what about the security implication of this password-test-runs? Users are essentially giving their "other" passwords to the site, right?

Obviously a benevolent site will NOT save/process those failed passwords, it may even take care to have them NOT stored in any logs...

An malevolent site on the other hand may even trick you into providing it some of your other passwords to it...

...cache invalidation, naming things and secure authentication for a broad public

I don't think it's any more accurate to say the average case is having to cycle through ten passwords to login to a site. Generally, I remember my passwords for most sites, and for the few I don't get right on the first try, I'm usually able to get in by the second. And yes, I have more than two passwords I use.

Reply on news.ycombinator.com