Hacker News Reader

Comment by willtheperson | Hacker News Reader

I wish there was (or maybe there is) a protocol for updating your password. Then managers like lastpass and 1Password could more easily update your password. Maybe, behind the scenes they could rotate your password every x days automatically. Having a protocol in place would also make breach notices an easy "update all passwords" click away.

There's probably a reason this is a bad idea. Let's hear it! :)

View on HN

It discourages two-factor auth for password change requests (such as site username and access to your email account), it adds an additional point of failure, and it would make it easier for attackers to lock you out of your account once they gain entry.

Plus, if any changes are to be made to the authentication process it should be migrating to two-factor auth across all services.

Authenticator tokens are pretty robust systems. I'd like to see more services start to make use of them.

Definitely, as long as there was a common standard (and open source, of course). Have a keychain token that you can link to accounts, then enter a password on that and it gives you a (time limited) key to use to login.

there are some obvious discouragements, as outlined by grrowl in another comment, but I agree with you that it would be nice. Security and convenience have a well known relationship.

I've thought it would be nice to consolidate 2-factor authentication methods in a single service, then require a single, 2nd factor authenticator for access to the service or vault. So a yubi-key like authenticator with your lastpass that then authenticates using 2-factor protocols of some sort automatically; again, trading security for convenience, but would also allow for things like auto-changing of all passwords (which happening more often couldn't hurt security) while still under protection of a 2-factor authentication.

Reply on news.ycombinator.com