People should drop passwords altogether - Page 1
Forum section: electronics / general

author: MrMobodies
author_rank: Super Contributor
timestamp: May 06, 2022, 07:34:17 pm
content: I found this news article which I found disturbing.https://www.gazettelive.co.uk/news/uk-world-news/people-should-drop-passwords-altogether-23867710QuoteIt sounds like an excuse, just because some may not be using reliable passwords they all need to drop it completely. I thought there were strict requirements with many sites when creating accounts and this 123456 or qwerty nonsense was stopped years ago. Isn't that the websites fault though for not enforcing restrictions to prevent easy to guess passwords?I am not happy using parts of my body as the only form of a password and verifcation that I can't change that everybody can see and trace and get hold off in plain sight.I think there should be passwords as well as biometrical stuff for some security stuff because a criminal is going to have to take longer to persuade a victim further for a memorial phrase than just presenting bits of their skin to a scanner.QuoteI can see the need for security but I don't know, it sounds to me like they up to something and some bullsh*t might be going on in saying all passwords are insecure. Maybe offloading the responsibility on the identity of the user effectively using them as a password.What do you think?

author: nctnico
author_rank: Super Contributor
timestamp: May 06, 2022, 07:45:52 pm
content: I think websites should drop passwords indeed and just send you a link to a website over email or other messaging service. Much more convenient.

author: TimFox
author_rank: Super Contributor
timestamp: May 06, 2022, 07:49:24 pm
content: Of course, to access my e-mail account I need a password.Am I the only one here who doesn't keep my phone next to my computer?

author: jpanhalt
author_rank: Super Contributor
timestamp: May 06, 2022, 07:56:46 pm
content: Agreed. There was a research article between 2006 and 2011 that concluded simply that passwords are designed to be hard to remember but easy for computers to break. I've complained many times about the ridiculous requirement for "special characters" as the presence of which is a flag to "this may be a password." In the real word, most data breaches that I have read about were due to human stupidity, such as inserting a thumb drive to see what was on it. A simple PIN should suffice.In my own field, Prof. Ray Bartlett (U Conn) long ago studied sources of errors in clinical laboratory testing. Such labs are required to run controls and test sample lots of new reagents. The most common cause of a control failure by far was the test, not the lot of reagent. Overall, bad reagents were something like 1/100,000 or less as frequent as human errors. I suspect the ratio of cracking "passwords" to obtaining such information by stupidity is similar.

author: Gyro
author_rank: Super Contributor
timestamp: May 06, 2022, 08:00:11 pm
content: I definitely feel more comfortable when an important site sends an sms verification code to my phone. One of the reasons that I don't have a banking app on my phone - I prefer it when there are two devices involved.Quote from: TimFox on May 06, 2022, 07:49:24 pmPossibly. My phone stays with me.

author: Benta
author_rank: Super Contributor
timestamp: May 06, 2022, 08:31:14 pm
content: Mr. Grahame Williams has a major flaw in his argument. That he's a spokesman for Thales frightens me.User name, fingerprint, face scan are all useful toidentifyyou.Fine.But a password is in your brain, and hopefully only there. It's at a much higher and personal security level. That some people use idiotic passwords istheirproblem.Mr. Williams' suggestion is equivalent to removing the lock from your apartment door. I hope he's only in marketing.

author: langwadt
author_rank: Super Contributor
timestamp: May 06, 2022, 08:37:13 pm
content: Quote from: Benta on May 06, 2022, 08:31:14 pmyeh no wrench neededhttps://xkcd.com/538/and if some biometric "password" is somehow compromised you can't just get a new and revoke the old one

author: SiliconWizard
author_rank: Super Contributor
timestamp: May 06, 2022, 08:42:44 pm
content: It's unfortunately coming. Google has already announced they wanted to get rid of passwords too. Most online services will likely follow.

author: DiTBho
author_rank: Super Contributor
timestamp: May 06, 2022, 08:55:00 pm
content: We should never eat snails ...... and as soon as we are born we should be implanted an RFID under the skin, which encodes the personal DNA, the type of blood, the encoded proteins, etc. Because it is also useful for media robots, useful for accessing the Internet.Old Cyberpunk novels. Philip Dick would also suggest to encode a sequence on the cornea of the eyes, like in BladeRunner 2049.Real world: passwords like "P@is%n1vy" are good to remember, hard to crack, good and nice.

author: Bud
author_rank: Super Contributor
timestamp: May 06, 2022, 09:08:20 pm
content: You can't get the password out of a dead man.As to fingerprints or other parts of tge dead body ....

author: TimFox
author_rank: Super Contributor
timestamp: May 06, 2022, 09:22:57 pm
content: Dead person's or severed fingers have been used in thriller novels--I don't know of any real-world use, but it is always possible.The Nazis tortured rich victims to learn their secret Swiss bank account numbers long before computer passwords.

author: tggzzz
author_rank: Super Contributor
timestamp: May 06, 2022, 09:28:48 pm
content: Infosec truism: ATM card PINs protect the bank, not the individual. "We received the correct PIN which only you know, therefore you authorised it. Case closed"Biometrics: just say no, due to the certificate revocation problem. When, not if, an ATM card is compromised, the bank revokes the card. Simple. What happens when, not if, my iris becomes compromised?

author: MrMobodies
author_rank: Super Contributor
timestamp: May 06, 2022, 09:31:57 pm
content: Quote from: SiliconWizard on May 06, 2022, 08:42:44 pmI don't depend on it, I'll close the account to move somewhere else.My concern wasn't about the multi factor authentication.I refuse under the grounds of privacy I should not need to submit private medical stuff relating my biology and identity just to use services.Sounds ridiculous to me.When I was paying for Youtube Premium, somewhere down for a lot of videos needed authentication that I was over a certain age.I think they wanted my driving license or passport. I thought forget it I don't want hand Google anymore of my personal information.I found this 11 year article just now:Quote

author: SiliconWizard
author_rank: Super Contributor
timestamp: May 06, 2022, 09:37:17 pm
content: Quote from: MrMobodies on May 06, 2022, 09:31:57 pmSure. Until they all do the same. Do you think they won't?https://www.firstpost.com/tech/news-analysis/explained-why-apple-microsoft-google-want-to-get-rid-of-passwords-10640151.html

author: MrMobodies
author_rank: Super Contributor
timestamp: May 06, 2022, 09:51:10 pm
content: I don't want my "password" to be in the form of a fingerprint left for anybody to look at or touch whether it be in a shop or the bar.Quote from: SiliconWizard on May 06, 2022, 09:37:17 pmWhich is why I am actually quite worried and said I found it quite disturbing.They all seem in unity about it, Microsoft, Apple, Google so I think they are up to something else.QuoteSo they are effectively going to shut people out if they don't give them their biometrical details.

author: SiliconWizard
author_rank: Super Contributor
timestamp: May 06, 2022, 09:54:39 pm
content: Yep. I think we know what this inevitably leads to. Whether this is intentional or not doesn't matter (much).

author: golden_labels
author_rank: Super Contributor
timestamp: May 06, 2022, 10:02:17 pm
content: Not participating in the survey, as it misses the option I would chooseandis designed wrong.As an entertaining intro, today’s story. My mother received documents from an insurance copany, over my mailbox, in an encrypted PDF. The password — as explained in the email itself — is the last four digits of her PESEL number.(1)I hope I don’t need to explain, how strong a 4-digit password is and how long it stands a bruteforce attack; in particular if the penultimate digit is determined by gender and the last one is a checksum value. If that wasn’t enough, the number is semi-public. The company itself somehow doesn’t understand, that their own worker received something used as a password by simply asking for that. While certainly using even such a weak solution is better than plaintext(2), it shows something very important: a failure to understand security at even the most basic level by laypersons.Passwords must go. But the main reason is not their inherent weakness. It’s because of the users. For years now it is well known that:Users are horrible at inventing passwords.Not understanding fundamental things about security, people substitute their guesses for knowledge. Based on poorly founded heuristics, often on perception of threats derived from entertainment industry, using schemes not addressing the actual attack methods, falling into “it’s ok becauseIcan’t break it” theme and so on. Common examples: using simple words they think no one will know or substituting letters for look-alikes.Policies designed by ignorants or people not updating their knowledge are pushing users to invent even worse passwords.Password rotation, in particular over short periods, have been beaten to death already. Yet you will encounter that type of requirements introduced even now, when I write this post. Worse, there are people who will try to defend it. Both ignoring that no matter what their predictions are, the reality has shown it leads to worsening security, and not realizing that the primary reason for the policy in the first place was blind importing it from eras predating computers, where threat models were very different. Requiring particular characters in the password, which only introduces very predictable changes to whatever the user already had. Almost universally “1!” or one of a very few similar suffixes.Limited access to toolsleads to users engaging into insecure practices, even if otherwise they would not. Using a properly designed password manager raises the bar for the adversary so high that password-based attacks are doomed to fail in nearly all circumstances.(3)Yet most people will not use them. They do not even know they should. The tools are cumbersome to use; or are proprietary service-based solutions that effectively make you give away your passwords. Users fail to address database loss situations and opt for not having protection at all. Hardware HID keys are so rare that I can’t even recall any specific name. An average member of society has no option to securely generate a strong password. There is no infrastructure to share passwords: the reason the insurance company used the PESEL number is because there is no sane way to given them any password in the first place. All this worsens the situation even more.Secondary to the above, passwords have problems too. Even the strongest, most perfectly chosen password has them. They are inherently vulnerable to replay attacks. While not a limitation of the technology, the practical use of passwords often involves remembering them, which limits their quality. A password may easily be 256-bit strong (attacks not feasible), but in practice people employing diceware class of generators will obtain 48 to 64 bits, while the general population somewhere between 8 and 32 bits. Passwords are quite easy to acquire, because at least partially they must be transferred over insecure channels.But there is another issue. For two at least decades we have technologies that are sufficient to deliver much better solutions. Better in many aspects: security, convenience, privacy and freedom. They are widely deployed, so it’s not sci-fi. The problem is both the level of adoption and that they are often partial. Where something more convenient is offered, it’s a privacy nightmare and often involves passing a bit of control to some third party. Where solutions respect your privacy and freedom, using them in practice is a horror story.(1)An identifier inPESEL, a national database of all Polish residents. It’s a structured value, directly linked to the birth date and gender, with the last digit being almost universally valid checksum dependent on the other ten.(2)The adversary is required to put some minimum effort in the attack.(3)“Nearly all” because phishing attacks are still possible.

author: MrMobodies
author_rank: Super Contributor
timestamp: May 06, 2022, 10:12:47 pm
content: I don't mind if it is changed in other ways but my concern is just based on forcing everyone to use biometric revealing information about themselves.Quote from: golden_labels on May 06, 2022, 10:02:17 pmWhat would you like me to list as an option in the survey?I thought it was for the website to enforce password restrictions.Joke: Session hijacking... no problem just stick your finger here most of the time to make sure it is you.Quote from: jpanhalt on May 06, 2022, 07:56:46 pmIt will be interesting to see what the next level of scams are going to look like when this non password approach starts.

author: free_electron
author_rank: Super Contributor
timestamp: May 06, 2022, 10:37:56 pm
content: two pathway approach. Challenge gets sent over one path, answer thru another path. For example challenge goes over cellphone , cellphone applies key number one , shows result to user, user bridges that result to computer , computer applies key number two ( stored in secure module ) , sends back to server.that way if you intercept one of the hardware machines ,or compromise one you still can't find relation as the human is the bridge. original request and final response do not exist on same machine at any given point in time. they only exist in the human inbetween.( you read it and type it on another device.)

author: themadhippy
author_rank: Super Contributor
timestamp: May 06, 2022, 10:38:59 pm
content: Dear apple google and microsoft.and wot about us renegades who have decided the best place for there mobile phone was in the bin?

author: SiliconWizard
author_rank: Super Contributor
timestamp: May 06, 2022, 10:52:31 pm
content: Quote from: themadhippy on May 06, 2022, 10:38:59 pmWell, I guess they have unfortunately decided that the best place for people not willing to use mobile phones is in the bin.The question remains as to who is gonna win, or if everyone's gonna end up in the bin eventually.

author: golden_labels
author_rank: Super Contributor
timestamp: May 06, 2022, 11:00:39 pm
content: Quote from: MrMobodies on May 06, 2022, 10:12:47 pmThat would be serious concern to me too. Of course in therms of both privacy and freedom, but — perhaps unexpectedly — also because it’s a security issue. Biometric authentication is alluring, because it’s extremely convenient, but under the hood it’s a key generator. Better than user-invented passwords, but in many ways worse. It’s one-factor authentication, with a factor that can never be changed and, while possibly hard to copy,(1)it is still publicly available information.Quote from: MrMobodies on May 06, 2022, 10:12:47 pmUnless there is a well proven reason to do otherwise, any survey should have a “Refuse to answer” and “Other (specify)” options. In my case I would respond with either MFA or some alternative methods (signed challange for example).(1)I know that reports of successful copying are common. But so far no evidence of it being an inherent restriction of the technology itself. Rather failures in particular approaches. Of course that may change in the future, as contrary has not been proven either.

author: MrMobodies
author_rank: Super Contributor
timestamp: May 06, 2022, 11:38:06 pm
content: "Refuse to answer" and "signed challenge" added to survey.An "other specify" option would be nice maybe an idea for Gnif if that is something he willing to do in future.I just found something interesting when forcing it upon employees:https://www.abc.net.au/news/2019-05-21/fingerprints-biometric-data-worker-wins-unfair-dismissal-case/11129338QuoteSounds to me very intrusive and not very nice.

author: Marco
author_rank: Super Contributor
timestamp: May 07, 2022, 12:37:26 am
content: Quote from: golden_labels on May 06, 2022, 11:00:39 pmOn a phone it's effectively treated as half a factor, the pass code is still required after reboot and when the phone has been unused too long. So let's call biometric + pin a full factor. Then if you use a phone to authenticate on a laptop you have three factors, ownership of the phone, laptop and biometric + pin.

author: tggzzz
author_rank: Super Contributor
timestamp: May 07, 2022, 06:38:38 am
content: Two points about fingerprints:not everybody has fingerprints, e.g. those working collecting pineapples! Yes, this causes them some problemswhat happens when you cut your fingertip and it is covered with a plaster, or permanently scarred?Often the "exceptional case" recovery process can be much weaker than a decent password. Classic example is a forgotten password leading to manual intervention involving questions with "well known" answers. In one case a company even sent my (stored!) password in cleartext email. Yes, I had words with them.

author: DiTBho
author_rank: Super Contributor
timestamp: May 07, 2022, 07:21:36 am
content: rfid glass capsules with crypto channel implanted under your skinBasically this kind of capsules provides a password of 196 byte.is it good? let's check it outIt can uniquely identify a human around the world.It's time stable, doesn't react with the immune system, and doesn't cause cancer.It is chemically inert for humans, plants and animalsDoesn't need any battery, it's a true rfid low power system.It is not based on the physical characteristics of a human being.It can be easily applied with a pressure gun without anesthesia.Cannot be spoofed and cannot be cloned (not easily).You cannot forget it at home, it's always with you.It is more secure than fingerprint, facial recognition.It cannot be exploited to track your position.It's a contact-less device but antennas need to be at mm of distance rather than meters.But, where to implant?And ...... can it be damaged by XRAY or by computed axial tomography?mumbleImplanting sounds easy, but for sure replacing such a device requires mini-surgery.Nothing more serious than what a dentist does, anyway.(Ummmm, no, implanting such a rfid-capsule inside one in a dental capsule is probably not a good idea, even for how you would later authenticate, unless you like swallowing your smartphone and push it to the last molar tooth)

author: hans
author_rank: Super Contributor
timestamp: May 07, 2022, 07:47:19 am
content: ... and I can steal your digital identity/passwords on the next handshake we give.Also, I think we should investigate how reliable do we want our locks to be. Some people put a photograph online of their physical keychain with housekeys etc. not realizing that those tooths are measurable, and someone skilled can replicate that key. What would you do if think someone then has access to one of your keys, but you can't reasonably ask them to hand them over? Obviously, you change out all the locks.Good luck changing out bio-metric scans or RFID tags under skin. Or sometimes even phone numbers for 2FA verification (if you first need that number to login).Even though you physically need to "scan" you finger.. in the end that scan is all a bunch of 1s and 0s. You must then presume the platform is properly secured for some hacker not to just make a raw dump of your scan data, which he could use as a dummy to repeatedly keep using your biometrics. Good luck changing it.I honestly think virtually all the downsides to authentication nowadays are down to the users. Imagine if we lived in a world where everyone had a keypad doorlock with a 5 digit code to get in. What if half of the users had chosen "12345" or "00000" as their entry code? Or perhaps even "15951". Though luck you got hacked, but also don't choose a simple to guess code. I think no insurance company would pay out to any of those codes.

author: magic
author_rank: Super Contributor
timestamp: May 07, 2022, 09:02:34 am
content: Quote from: golden_labels on May 06, 2022, 10:02:17 pmThe users must go.Everybody who thinks otherwise is setting oneself up for a neverending game of whack-a-mole.Some of them are paid money for playing it, hence articles like the one found in the OP.

author: DiTBho
author_rank: Super Contributor
timestamp: May 07, 2022, 10:34:22 am
content: Quote from: hans on May 07, 2022, 07:47:19 amthe human wrist is not the best place to implant rfid capsule, not only because you could try to steal the digital identity on the next handshake, but also because the wrist itself is anatomically the worst place, especially in the metacamus area.I think the best place where to implant is the skull, under the ear, there is a dimple of adequate size, and the gesture you would make is of adequate size, and the gesture you make to identify yourself is the same as you do to answer the phone.Science fiction for now, but it makes sense for me.

author: Gyro
author_rank: Super Contributor
timestamp: May 07, 2022, 11:00:58 am
content: I have regular MRIs. I can't see them being happy about an RFID capsule being implanted in my head - I can't think of a an area of the body that somebody isn't going to need an MRI on at some point.

author: Brumby
author_rank: Unknown
timestamp: May 07, 2022, 11:51:46 am
content: Quote from: tggzzz on May 07, 2022, 06:38:38 amSome years ago I procured a HP laptop for someone - and it had a fingerprint reader. If I remember correctly, the user could record 3 different fingerprints. So I said they should do two fingers on one hand and one on the other, to cover this exact scenario.The concern I have is not so much the fingerprinting - but how reliably sensors can differentiate between the genuine input and fakes.

author: tooki
author_rank: Super Contributor
timestamp: May 07, 2022, 01:08:53 pm
content: I wish people would actually investigate what’s being donebeforedescending into outrage and hyperbole like so many posts in this thread.That password authentication (as a system) offers poor security is a fact.Whyis both complex and irrelevant. But if it were possible to make passwords into areliablysecure authentication method, you’d think we’d have figured that out over the last few decades. It’s reasonable to conclude that it can’t be done.So the alternative is to look to other ways of authenticating.But this doesn’t mean it has to be biometrics.(Not that biometrics have proven to be particularly vulnerable. They seem to be proving themselves as superior to passwords. Not perfect, merely superior.) Those are but one option. Mobile phone codes, authenticator apps, and hardware devices are all widespread now. Don’t want to rely on a phone? Get a hardware key.Anyhow, the actual thing all the big tech companies are getting behind is something called FIDO (which isn’t new, it was established a decade ago). Here’s the big press release about it:https://fidoalliance.org/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard-to-accelerate-availability-of-passwordless-sign-ins/All the big tech companies and all the big security companies are members. So it’s not as though Big Tech is doing something dumb in a bubble, this is something created with the involvement and support of serious security like RSA. The financial industry, which famously uses very tight security (and thus hasn’t relied on password logins for decades for employee logins!) is also involved.

author: PKTKS
author_rank: Super Contributor
timestamp: May 07, 2022, 01:25:32 pm
content: Quote from: Bud on May 06, 2022, 09:08:20 pmAgreed on that..You can use fingers eyes and even DNAs of someone else..Not with good old passwords..These changes are just excuses to implement a PATENTED BASED API nad security gizmos and chips.They will come of course.. and very very VERY overpriced we will beforcedto have themPaul

author: PKTKS
author_rank: Super Contributor
timestamp: May 07, 2022, 01:27:32 pm
content: My answer is PUBLIC.I REFUSE to answer as my option ofkeeping passwords alive and wellis not there..Reason being is that I will not feel more or less secure having 3 or 4 mega Corporations controlling my life.. my DNA my FACE my fingers..Just FUCK OFF with these "more secure" methods... bullshitPaul

author: tooki
author_rank: Super Contributor
timestamp: May 07, 2022, 01:32:24 pm
content: Quote from: PKTKS on May 07, 2022, 01:27:32 pmTheyaremore secure, and as I said, they are not all biometric. Perfect example of the uninformed hysteria I’m talking about.

author: ConKbot
author_rank: Super Contributor
timestamp: May 07, 2022, 01:32:46 pm
content: Quote from: tooki on May 07, 2022, 01:08:53 pmAhh yes, the "sign in with Google/Microsoft/etc" buttons. Aka "sign in and give us even better profile information to sell to advertisers"Those can fuck right off too.Email being in one place is bad enough, we don't need the whole logon to be handled by one company, so when the sweet hack goes off, they get the keys to the kingdom.

author: tooki
author_rank: Super Contributor
timestamp: May 07, 2022, 01:34:39 pm
content: Quote from: ConKbot on May 07, 2022, 01:32:46 pmAnd even more uninformed hysteria.Proving my point more: reacting without looking at what it is and isn’t. FIDO isn’t one company, and it’s not one standard.

author: ConKbot
author_rank: Super Contributor
timestamp: May 07, 2022, 01:40:53 pm
content: Yes, huge companies that sell advertisements also offering a SSO service, definitely won't track users, I'm totally being totally hysterical and unreasonable here. And it definitely doesn't provide a much nicer target for hacking.

author: PKTKS
author_rank: Super Contributor
timestamp: May 07, 2022, 01:46:34 pm
content: That boils down...These are just enforcement methods to SIGN IN everyone..Privatized API of services.. and the so calledbrowser..is now just 80% a JS engine to track users and sell ADVERTS...expecting to have 95% ofbrowsingjust to advert buz..Users forced to render their privacy to these APIs.Paul

author: tooki
author_rank: Super Contributor
timestamp: May 07, 2022, 02:51:45 pm
content: Omg, the stupid, it hurts…

author: madires
author_rank: Super Contributor
timestamp: May 07, 2022, 03:14:41 pm
content: Passwords have their place. It's hard to change biometrics when compromised. Relying on hardware tokens or apps (worse security than hardware tokens) isn't a good idea either, because they can be lost, be taken by someone (with force?), have a dead battery or simply break. So you need backup tokens/apps and a way to quickly disable lost/stolen tokens/apps (similar to debit/credit cards). MFA is good for critical stuff like home banking, still a bit cumbersome.

author: BravoV
author_rank: Super Contributor
timestamp: May 07, 2022, 03:49:20 pm
content: What they're going after is for you to give up what in the 2FA ... particularly at "what you know/memorize (inside your brain)" as the 2nd part of 2FA on what you have physically (e. phone for OTP ... including your body parts like finger/retina (eye balls) etc) are "easily retrieval-able".This idea only makes sense or valid, once "they" have discovered how to retrieve your password from your brain that probably they managed to yank out of your head.

author: ConKbot
author_rank: Super Contributor
timestamp: May 07, 2022, 04:46:19 pm
content: Quote from: tooki on May 07, 2022, 02:51:45 pmI'm not the one suggesting a free service from an advertising company (which makes you the product) makes for a better login method than a good password or other 2FA method.

author: SiliconWizard
author_rank: Super Contributor
timestamp: May 07, 2022, 04:54:37 pm
content: Quote from: PKTKS on May 07, 2022, 01:46:34 pmIndeed. =)

author: TimFox
author_rank: Super Contributor
timestamp: May 07, 2022, 05:22:44 pm
content: Of course, this was all foretold by St John the Theologian, as revealed to him on the island of Patmos.Revelation, chapter 13: verses 16 and 17. And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads: And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name.

author: David Hess
author_rank: Super Contributor
timestamp: May 07, 2022, 05:31:20 pm
content: So we should replace passwords which *may* be insecure, with something that *is* insecure.

author: SiliconWizard
author_rank: Super Contributor
timestamp: May 07, 2022, 05:54:03 pm
content: Quote from: David Hess on May 07, 2022, 05:31:20 pmIs it really for security reasons anyway? Or, at least, individual security?Makes me think of the expression: "se jeter à l'eau de peur d'être mouillé". (Roughly meaning: to jump right into the water for fear of getting wet."

author: james_s
author_rank: Super Contributor
timestamp: May 07, 2022, 05:55:49 pm
content: I like passwords, they're just fine if you put some effort into coming up with one that is easy to remember but difficult to guess. Unfortunately many sites have stupid (and often conflicting between sites) requirements that are not conducive to this, and a lot of people are idiots and use the same password for everything.

author: tszaboo
author_rank: Super Contributor
timestamp: May 07, 2022, 06:18:20 pm
content: Actually, in cryptocurrencies, there is a concept, called "zero knowledge proof" which you can use to provide proof that you know the solution to a problem, without giving away the solution.This problem can be used to verify your identity.

author: Marco
author_rank: Super Contributor
timestamp: May 07, 2022, 07:37:43 pm
content: Quote from: tszaboo on May 07, 2022, 06:18:20 pmPKI works fine for that. There's some tangential problems where zero knowledge proofs are useful, Cloudflare uses it for attestation that a token is certified for instance, but that's a separate matter (attestation is not essential, webauthn allows self attestation for instance).

author: David Hess
author_rank: Super Contributor
timestamp: May 07, 2022, 08:23:29 pm
content: Quote from: tszaboo on May 07, 2022, 06:18:20 pmIn practice that means a public key encryption exchange or similar which at best becomes "something that you have", because nobody is doing to memorize their private key and do the math by hand.

author: rsjsouza
author_rank: Super Contributor
timestamp: May 07, 2022, 08:52:25 pm
content: From what I understood from the press release, FIDO seems to be a "login once" system that creates one or more tokens for the various websites that require authentication - something functionally similar to what browsers do with cookies and "password wallets", but perhaps across several apps.Given the severe overreach of the last years and eagerness to track anyone's movements on the digital highway, I can't say that exchanging the insecurity of passwords with this digital footprint is a fair exchange.

author: Simon
author_rank: Unknown
timestamp: May 07, 2022, 09:35:05 pm
content: Your survey is a waste of time as it does not include keeping passwords or enforcing secure passwords. I use 16 character passwords individually generated for each site. If your stupid enough to use insecure ones then more fool you. I believe there are 64 characters available but lets say it's 32, 32^16 = 1.2 E24..... I rest my case.

author: MrMobodies
author_rank: Super Contributor
timestamp: May 08, 2022, 12:26:02 am
content: Quote from: Simon on May 07, 2022, 09:35:05 pmAdded to survey.I can now see now that I poorly though out the survey.

author: tooki
author_rank: Super Contributor
timestamp: May 08, 2022, 02:35:16 pm
content: Quote from: ConKbot on May 07, 2022, 04:46:19 pmNor am I, which you’d understand if you actually looked at the information I posted.

author: tooki
author_rank: Super Contributor
timestamp: May 08, 2022, 02:39:59 pm
content: Quote from: David Hess on May 07, 2022, 05:31:20 pmAn individual password may or may not be secure. A secure password, used in an insecure system, still means an insecure system. But a truly secure passwordfrom the point of view of a password cracking systemis a password a human is categorically incapable of remembering. That is,everypassword a human can remember is trivial for a modern computer to break, if given half a chance.The whole point of non-password logins is to take a weak security system and replace it with a less weak one.Biometrics spam a wide range of technologies and security levels, but for the umpteenth time, they’re not the only option!

author: tooki
author_rank: Super Contributor
timestamp: May 08, 2022, 02:51:33 pm
content: Quote from: MrMobodies on May 08, 2022, 12:26:02 amYou still are lacking a “keep the status quo” option, as you’ve only added the option to use stricter passwords.But paradoxically, requiring stricter passwords results in overallworsesecurity, because as soon as passwords become too difficult to memorize (including too-frequent changes), people start writing them down or storing them in a Word file. (Most people won’t use password wallets, even if told to do so.)This is why things are moving towards biometrics (which are imperfect but better than passwords on the whole), or 2FA, often using a simple PIN instead of a complex password.

author: magic
author_rank: Super Contributor
timestamp: May 08, 2022, 03:30:25 pm
content: Quote from: tooki on May 08, 2022, 02:39:59 pmCould you elaborate what do you even mean by "being able to crack a password" and why should it be so trivial and what would make a password not susceptible to that?Not hoping for much, but...

author: Simon
author_rank: Unknown
timestamp: May 08, 2022, 03:46:55 pm
content: Quote from: magic on May 08, 2022, 03:30:25 pmA memorable password means words, there are only so many words around so the first thing a hacker tries is a "dictionary" attack. That has less combinations than the 1200000000000000000000000 combinations available in a 16 character random string. Also humans have habits when they use words so that reduces the pool further.Yes I have my passwords written down, but they are on encrypted media. There are no unsecure copies, you have to have access to my computers to get them.

author: tooki
author_rank: Super Contributor
timestamp: May 08, 2022, 04:28:56 pm
content: Precisely that. Anything evenremotelyhuman-memorable is what the dictionary attacks go for first. (And yes, they’re smart enough to substitute “!” for 1 and all the other common substitutions. They know we append sequential numbers or years to words. They know all the tricks we use to meet “strong” password criteria while still remaining even vaguely memorable.)If you care, you can Google for explanations by security researchers as to why password security is so much lower than people think it is. Even most supposedly tech-savvy people who think they’re using “strong” passwords don’t realize they’re weak passwords in reality. (The password strength indicators on some websites are absolutely dumb, and think adding some punctuation and numbers makes it “strong”. It doesn’t.) I’m not a mathematician, security expert, or computer scientist, but I have read up enough to understand that passwords are like standard 5-tumbler domestic door locks: enough to stop a typical passerby, and to tell your insurance “I wasn’t negligent, I locked my doors”, but completely useless against even a moderately skilled attack.

author: madires
author_rank: Super Contributor
timestamp: May 08, 2022, 05:12:00 pm
content: There are some very useful tools called password managers. They even generate complex and long passwords.

author: Marco
author_rank: Super Contributor
timestamp: May 08, 2022, 05:42:22 pm
content: In principle I like the concept of a dongle, but the actual implementation of FIDO not so much. Not exposing private keys even to the user rubs me the wrong way, I want to make a paper backup. I know it compromises their idea of security, but their idea is not mine.Generate all the keypairs (or passwords for non webauthn sites) from a combination of rootkey/domain (and login for non webauthn sites) and on a special keypress combo on the dongle let me read out the private key so I can make a paper backup. Then I'll consider using it.

author: magic
author_rank: Super Contributor
timestamp: May 08, 2022, 06:00:05 pm
content: Dictionary attacks are not viable against a remotely competently designed system which rate limits login attempts.Even offline attacks against leaked hashes can be effectively rate limited by making the hash hard to verify.Search space grows exponentially with the number of words, like it does with the number of letters.So yeah, do elaborate how you envision "cracking" someone's bank account password or stuff like that.Competent hackers use phishing.

author: magic
author_rank: Super Contributor
timestamp: May 08, 2022, 06:03:47 pm
content: Quote from: Marco on May 08, 2022, 05:42:22 pmThese aren't systems to protect you. They are systems to reduce your service provider's customer support and insurance costs.Your service provider will not consider a dongle which lets you take the keys out of it because they consider you an idiot (and, statistically, in 90% of cases they aren't even wrong).

author: golden_labels
author_rank: Super Contributor
timestamp: May 08, 2022, 06:08:17 pm
content: Breaking mosthuman-generatedpasswords is feasible. But not every human-memorizable. A 5-word password chosen randomly from a 8k word list is over 64 bits. Currently there aren’t many actors capable of even iterating over that, much less calculating a KDF for even local attacks. Remote attacks have even higher price tag attached.64-bit keys become an issue when a threat can be considered at a mass scale. That is: when the question turns from “can one attack a pre-selected target” to “can we be successful at attacking at least one of targets”. That is a valid concern then. But it is not just for any attack scenario.And now, the continuation of the story I delivered earlier! Mother failed to enter the password (reasons unknown) and asked me for help. But I was lazy, so instead of searching for her PESEL number in documents I just pdfcracked it. Seriously: if entering a valid password by a person that has legal access to it takes more effort than actually breaking it, someone has failed hard at security.

author: Simon
author_rank: Unknown
timestamp: May 08, 2022, 06:12:08 pm
content: If you are paranoid just use a "password" as a username where it does not have to be publicly visible or your email address or use an email address that has a random string as the username. Most systems will stop you attempting more than a certain amount of logins at a time, this make guessing a proper password not even worth the effort which as mentioned above is why phishing and other email related attacks are common, instead of trying to attack the system, they go for the weakest link - you - the human.

author: tszaboo
author_rank: Super Contributor
timestamp: May 09, 2022, 12:56:21 pm
content: Quote from: David Hess on May 07, 2022, 08:23:29 pmYou need a crypto wallet, write down the 12 word mnemonic, and when logging in on a website, the website verifies the wallet.This is like 100% solved when it comes to cryptocurrency. There is only one person who can sign transactions to it.

author: madires
author_rank: Super Contributor
timestamp: May 09, 2022, 01:08:20 pm
content: A news article with some hints about potential issues:Your Phone May Soon Replace Many of Your Passwords:https://krebsonsecurity.com/2022/05/your-phone-may-soon-replace-many-of-your-passwords/#more-59727Your life will depend on a smartphone!

author: cdev
author_rank: Super Contributor
timestamp: May 09, 2022, 01:11:30 pm
content: Quote from: golden_labels on May 08, 2022, 06:08:17 pmAll three of those accidents were caused byloss of the ultimate heatsink.. which in those cases was provided by water in those fission reactors.. So they need continuous cold water to be provided, and then power for cooling. Or they "melt down" Thats what caused the big problems. It hasnt been fixed in any other technology.Fusion, not fission, may be cleaner when its developed. But right now I don't trust them. I'd rather pay less for gas generated electricity. And get rid of nuclear fission plants. Until they have better ways to store waste.I don't want them to lie to us any more. Stop the corporate bait and switch.

author: cdev
author_rank: Super Contributor
timestamp: May 09, 2022, 01:15:18 pm
content: Quote from: madires on May 09, 2022, 01:08:20 pmThey can only do that if they make the phone free or where is democracy, its gone.. But then they will track your every move.Considering how Uruguay Round effectively ended democracy one can see why they are accusingeverybody elseof malfeasance..Its actually them who are taking over the world.-- This should be a crime."Trust us we're experts!" Ha! Experts at ripping humanity off!Read Shoshanna Zuboffs new book on "surveillance capitalism"Eliminate cash for total surveillance over everybody for their coup. (Their test demonetization/test project in India stripped poor people of billions..).

author: cdev
author_rank: Super Contributor
timestamp: May 09, 2022, 01:26:36 pm
content: The chance of somebody randomly guessing an assword should be trillions to one. Simon had he right idea. Make your password very long and utterly random. Learn about and use real cryptography all the time. A lot. Not just on importnt messages.This is why I am perpetually interested in random number generation. All passwords should come from random sources for example, RF noise. You can use it to generate your keys. Make them insanely long. They will be virtually impossible to guess.You're not a criminal for wanting privacy. They are for trying to end it.QuoteCome on tooki, you are smarter than that.You should download and learn to use GnuPG on whatever platform you use. I do and in fact Ive used it since literally when it first came out. I think that everybody should. Could you imagine only sending post cards for everything? Thats what most email is today.

author: TimFox
author_rank: Super Contributor
timestamp: May 09, 2022, 01:35:10 pm
content: Normal software random number generators start from a "seed".In order to test the overall software, it is common to freeze this seed to allow verification of the computation, and then use something sort-of-random, such as time of day, to generate a seed for the pseuco-random process.Many years ago, I saw someone use a Lava LampTMas a physical random process to generate the seed, but I don't remember how it was encoded.

author: cdev
author_rank: Super Contributor
timestamp: May 09, 2022, 01:38:17 pm
content: Quote from: tszaboo on May 09, 2022, 12:56:21 pmYou can make a wallet card , and use a simple cipher to encode the keys you write on that card. Put the key somewhere safe, elsewhere, so if you lose the card, some finder wont be able to use them. Or you can use gnuk. And an STlink 2 clone donglehttps://nx3d.org/gnuk-st-link-v2/People should drop some Internet companies altogether.The company you mentioned was the late and great SGI company, of Mountain View, CA.Indeed they did use lava lamps. Because they are random. Lets see you try to predict the motion of them? The photo is not of SGI, its years later at a cloudflare vendor. What a great publicity stunt.What would be a better VID and similar when you build the gnuk software!?

author: tooki
author_rank: Super Contributor
timestamp: May 09, 2022, 04:44:35 pm
content: Quote from: cdev on May 09, 2022, 01:00:56 pmTo anyone else reading this, please note that the bold text above is absolutely TERRIBLE advice. A password manager is arguably thebestthing you can do to get the most out of password security. (And if you’re paranoid/delusional like cdev, you can still get a password manager from a third party that’s not your browser developer. I’m pretty sure there are open source ones, too.)cdev, you need to take off the tinfoil hat, seriously.1. If browsers sent our passwords to the browser developers, security researchers would have noticed long ago.2. What would they even want with your passwords? They’re not useful for tracking and advertising. Furthermore, only one of the major browser developers (Google) has a significant interest in advertising. For the others (Microsoft, Apple, and Mozilla), advertising is either an insignificant business area, or not one at all, while privacy absolutely is. So there’s no incentive for any of them to gather your passwords.

author: tooki
author_rank: Super Contributor
timestamp: May 09, 2022, 04:47:05 pm
content: Quote from: cdev on May 09, 2022, 03:06:55 pmPlease, get professional help. Paranoia is not healthy.

author: Simon
author_rank: Unknown
timestamp: May 09, 2022, 06:10:24 pm
content: Quote from: David Hess on May 07, 2022, 08:23:29 pmI thought this was a rather old concept that a government employee in the mostly secret section came up with one night and had to memorize as he was forbidden to write any of it down outside of work. It now forms the basis of most encryption. I send you a key and encrypted key, you unencrypt it and send it back re-encrypted and I verify, or something like that. The principle is that the math is reversable and at no time is the actual key transmitted.

author: madires
author_rank: Super Contributor
timestamp: May 09, 2022, 06:40:39 pm
content: Do you mean classic DH (https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange)?

author: David Hess
author_rank: Super Contributor
timestamp: May 09, 2022, 06:51:14 pm
content: Quote from: Simon on May 09, 2022, 06:10:24 pmThere is nothing inherently wrong with it for authentication, but relying on using a phone for it which has its own security vulnerabilities can compromise it. At least it would be better than using a phone as a side channel which is so easily compromised. I would have no complaints about a USB security key fob but for instance Google's recent requirements exclude them. I wonder why Google would exclude something more secure, but I know the answer; Google is not interested in security for others.A security key fob has all of the disadvantages of a physical key. It can be lost, stolen, or broken. At least it should be much more difficult to copy.

author: Simon
author_rank: Unknown
timestamp: May 09, 2022, 08:51:58 pm
content: Companies will only be interested in their own security and making it your fault. People who are not actual expects will probably make such policy decisions based on their own biased misunderstandings rather than trust experts who advise them.

author: SiliconWizard
author_rank: Super Contributor
timestamp: May 09, 2022, 09:22:31 pm
content: Quote from: Simon on May 09, 2022, 08:51:58 pmYes.And "experts" is a vague term. If said "experts" are paid by those companies only interested in themselves, their biased expertise has little value.Independent experts are few and far between.

author: tooki
author_rank: Super Contributor
timestamp: May 10, 2022, 08:38:31 am
content: I think the point most people here are missing is this: nobody is claiming these alternatives provide flawless security. The point is that theydoprovide better security than passwords doin practice. Passwords aren’t bad when everything is done perfectly, from back end to end user. But it rarely is, so the real-world security of them is miserable. That’s the bar we’re seeking to exceed.

author: Simon
author_rank: Unknown
timestamp: May 10, 2022, 12:04:28 pm
content: Yes, things like 2FA are just to solve poor password and human error problems. Often it is forced on users unnecessarily. My university forced 2FA, I mean reaslly, what does a hacker want to do? upload my assignments for me?

author: David Hess
author_rank: Super Contributor
timestamp: May 10, 2022, 12:32:24 pm
content: Quote from: tooki on May 10, 2022, 08:38:31 amMy experience is that existing 2FA is less secure than passwords. I have lost access to several accounts because of 2FA which was compromised, but never because a password was compromised. I can make any effort to secure my own passwords, but can do nothing to secure 2FA which relies on third parties for security.

author: madires
author_rank: Super Contributor
timestamp: May 10, 2022, 01:56:21 pm
content: 2FA can be easily messed up with stupid things like sending codes via SMS to a cell phone. SIM swapping has become a mass sport in the US.

author: PKTKS
author_rank: Super Contributor
timestamp: May 10, 2022, 02:19:53 pm
content: Quote from: David Hess on May 10, 2022, 12:32:24 pm2x Me too.To say the least ... I could not authorize email clients like Claws and Mutt..The interface (CLOUD) is obviously meant as enforcement to sign in every user and force the use of own API and applets..Never saw such a waste of time and effort to just set a email polling.."THE" worst piece of shit I ve seen last 30y to access POP/IMAP services...They have brain damaged people on this..Paul

author: tooki
author_rank: Super Contributor
timestamp: May 10, 2022, 07:15:20 pm
content: Quote from: David Hess on May 10, 2022, 12:32:24 pm…which is precisely the point of creating industry-wide standards for it, so people stop rolling their own, which is far more likely to be shit.

author: gmb42
author_rank: Frequent Contributor
timestamp: May 11, 2022, 05:12:47 am
content: Quote from: tooki on May 10, 2022, 07:15:20 pmTime to give up beating this dead horse, some folks just don't get it.

author: tggzzz
author_rank: Super Contributor
timestamp: May 11, 2022, 08:48:15 am
content: Quote from: tooki on May 10, 2022, 07:15:20 pm... thus creating a single point of failure for all malefactors to attackIt is all shades of grey; choose your poison

author: magic
author_rank: Super Contributor
timestamp: May 11, 2022, 10:48:09 am
content: Trust experts to choose your poison - that's the 21st century version

author: tggzzz
author_rank: Super Contributor
timestamp: May 11, 2022, 10:56:46 am
content: Quote from: magic on May 11, 2022, 10:48:09 amNot quiteTrustself-proclaimedexperts to choose your poison - that's the 21st century version.Alternatively, trust Dunning-Kruger sufferers to choose your poision, while they decry experts.

author: madires
author_rank: Super Contributor
timestamp: May 11, 2022, 12:49:05 pm
content: Quote from: gmb42 on May 11, 2022, 05:12:47 amGood standards are great! But who wants to establish a specific standard? And for which purpose (the 2FA could be just the shiny wrapping paper)?

author: xrunner
author_rank: Super Contributor
timestamp: May 11, 2022, 12:54:33 pm
content: FromThe RegisterQuote

author: madires
author_rank: Super Contributor
timestamp: May 11, 2022, 01:25:24 pm
content: When you go for hardware tokens or apps (or have to) make sure that you have spares and that they are registered with all the websites. If you have just one and something goes wrong, you'll have a nasty surprise. It's like losing the only key for your front door.

author: Bassman59
author_rank: Super Contributor
timestamp: June 10, 2022, 05:37:51 am
content: Password managers, anyone?Let the password manager create and store the different random passwords used for each website and be done with it.Oh, yeah, web sites that ask the usual "easily guessed personal information" like "name of first dog" really need to die in a fire.

author: BradC
author_rank: Super Contributor
timestamp: June 10, 2022, 08:31:00 am
content: Quote from: Bassman59 on June 10, 2022, 05:37:51 amYes, they do. The notes field in the password manager is a great place to store the questions and respective random keyboard mashing that you put in for an answer to each question.It's also a great place to note down your "date of birth" and other fictional information you use to complete the mandatory sign-up questions.

author: madires
author_rank: Super Contributor
timestamp: June 10, 2022, 10:10:06 am
content: Quote from: Bassman59 on June 10, 2022, 05:37:51 amOf course! How could you manage all the passwords without one?

author: tooki
author_rank: Super Contributor
timestamp: June 10, 2022, 01:59:16 pm
content: Quote from: madires on June 10, 2022, 10:10:06 amMost people’s solution is a combination of reusing the same 2 or 3 passwords all over the place, often combined with a sheet of paper, notebook, or Word document listing them all. They adamantly refuse to use password managers even if told to do so. Which of course is precisely why the industry is trying to get away from passwords: humanity has proven that truly strong security using passwords is impossible at population scale. Secure, non-reused passwords are impossible to remember, and most people simply won’t use a password manager, which is the only good way to store secure passwords.

author: madires
author_rank: Super Contributor
timestamp: June 10, 2022, 03:11:56 pm
content: And you can't fix stupidy by replacing passwords with something else. Neither should you force users with a password manager to use a different method, just because you think it's idiot-proof.

author: tggzzz
author_rank: Super Contributor
timestamp: June 10, 2022, 04:19:28 pm
content: Quote from: madires on June 10, 2022, 03:11:56 pmAnd you shouldn't use biometric certificates, because when (not if) they become compromised, the user has zero alternatives and becomes disenfranchised!It is worth noting that the retailers and card settlement industries don't attempt to authorise based on identity and entitlement, because it it so damn difficult to get right. They do authorise individual transactions.

author: golden_labels
author_rank: Super Contributor
timestamp: June 10, 2022, 10:28:31 pm
content: It should also be noted that card payment authorization is a bit different than authentication, as it serves somewhat opposite purpose. Authentication protect a person against other parties. Payment authorization protects other parties (merchants, acquirers, issuers) against the person authorizating the transaction. Of course the security mechanism employed may stay similar, but finer details differ.

author: tooki
author_rank: Super Contributor
timestamp: June 11, 2022, 08:55:35 am
content: Quote from: tggzzz on June 10, 2022, 04:19:28 pmJust a reminder, for the hundredth time, that the standard in question does NOT mandate biometric authentication.

author: tooki
author_rank: Super Contributor
timestamp: June 11, 2022, 08:57:29 am
content: Quote from: madires on June 10, 2022, 03:11:56 pmNothing is ever going to be perfect. But moving from something that has proven itself to be bad in practice, to something that has proven itself to bebetterin practice makes sense.

author: Someone
author_rank: Super Contributor
timestamp: June 11, 2022, 10:39:02 am
content: Quote from: tooki on June 11, 2022, 08:55:35 amWhich standard specifically? This topic rapidly gets into political level doublespeak.FIDO UAF does have mechanisms for requiring biometric methods, given that option some services/platforms will use it to mandate biometric authentication.

author: gmb42
author_rank: Frequent Contributor
timestamp: June 11, 2022, 10:45:00 am
content: Quote from: Someone on June 11, 2022, 10:39:02 amI quite happily use FIDO2 keys for MFA without any requirement for biometrics whatsoever, so any claim that they are required is just FUD mongering.Authentication implementers can, if they wish, choose methods that do require biometrics, which then leaves users a choice on whether to use such a service or not.

author: Someone
author_rank: Super Contributor
timestamp: June 11, 2022, 11:05:54 am
content: Quote from: gmb42 on June 11, 2022, 10:45:00 amYes, that's the point, the service/platform gets to decide what is/inst acceptable for their users. FIDO is a method by which they can start requiring biometrics. The standard its self does not mandate biometrics on any/all systems, but has mechanisms for biometrics to be mandated in implementations.using FIDO* as a login method does not mandate biometric authenticationusing FIDO* as a login method does not prevent mandate of biometric authenticationThe user may not have a choice to go somewhere else when that platform/service is a government service.

author: tooki
author_rank: Super Contributor
timestamp: June 11, 2022, 02:02:32 pm
content: Quote from: gmb42 on June 11, 2022, 10:45:00 amThis.FIDO makes it possible to rely on biometrics, but does not mandate it. There are alternatives, and countless people in this thread actively ignore this fact and instead devolve into hysteria about biometrics.

author: Peabody
author_rank: Super Contributor
timestamp: June 11, 2022, 03:05:24 pm
content: It makes no difference to the user whether the FIDO standard requires biometric authentication, or the server using FIDO elects to require it. In either case his biometric data is now part of the login process, even if only on his phone, and potentially subject to compromise.But on a different subject, Steve Gibson (Spinrite) spent several years developing a password alternative called SQRL (Secure Quick Reliable Login) which uses a method similar to FIDO2, but is simpler, and offers the user the option of printing out as text or QR code his master key. Each user has only one master key, not one for each site. The elliptic curve private key for a site is a hash of the master key and the site's name, modified slightly to make the hash a valid private key. Since it can be calculated on each visit to the site, there is no need to save each one. Then the public key is calculated from the private key, and given to the website. At login, the usual cryptographic exchange takes place, which verifies that the person logging in has the private key, but without revealing the private key.There is no third party backup of the master key, and no third party involvement in the login. Since each user has a written copy of his master key, recovery from lost or dead phones, or transfer to new devices, is straightforward. Access to the master key on the device is available only after the user logs into his SQRL app - in whatever manner provides the most security the user can tolerate, which may be very little, at the user's option.My understanding of FIDO2 is that a separate random key pair is generated for each site, which means that a user may have hundreds of them. And FIDO2 does not allow the user know them or to make a copy of them. That means that Apple, if it chooses, can limit transfer of the keys only to other Apple devices, which would make it impossible to switch to an Android phone. Do we know yet what the major players' intentions are in this regard? Are we going to have FIDO2 silos?

author: madires
author_rank: Super Contributor
timestamp: June 11, 2022, 03:10:08 pm
content: Quote from: tooki on June 11, 2022, 08:55:35 amUnfortunately multiple companies are going that direction. One payment card vendor just started something like "pay with your smile". So POS terminals get a webcam too.

author: madires
author_rank: Super Contributor
timestamp: June 11, 2022, 03:16:16 pm
content: Quote from: tooki on June 11, 2022, 08:57:29 amI fully agree. However, so far any other solution comes with new/other problems. A lot of tradeoffs, but nothing really better.

author: tooki
author_rank: Super Contributor
timestamp: June 11, 2022, 03:21:44 pm
content: Quote from: Peabody on June 11, 2022, 03:05:24 pmWell, it does offer the possibility of choosing an alternative product/service, at least.Quote from: Peabody on June 11, 2022, 03:05:24 pmAmusingly, I was just reading about Spinrite, and how it seems pretty much settled that there is no way Spinrite can work on modern storage devices. The fact Gibson still sells it and still makes the same grandiose claims about it makes me extremely skeptical of his integrity.Quote from: Peabody on June 11, 2022, 03:05:24 pmGood question.

author: tooki
author_rank: Super Contributor
timestamp: June 11, 2022, 03:24:47 pm
content: Quote from: madires on June 11, 2022, 03:10:08 pmBut… why?Quote from: madires on June 11, 2022, 03:16:16 pmWell that remains to be seen. I think most of the people dismissing the new systems (and fawning over passwords) don’t actually know what they’re talking about. I’m not a cryptography or security researcher, so I defer to those who are. My feelings aren’t equivalent to their experience and expertise — a sentiment I wish more people would embrace.

author: madires
author_rank: Super Contributor
timestamp: June 11, 2022, 06:10:49 pm
content: Quote from: tooki on June 11, 2022, 03:24:47 pmBecause someone at that company thinks it's a good idea?

author: BradC
author_rank: Super Contributor
timestamp: June 12, 2022, 02:18:22 am
content: Quote from: tooki on June 11, 2022, 03:21:44 pmIt does do one thing that nothing else does, which is the thing he calls "Dynastat". Repeated reads to the device where it returns the read data whether its correct or not. It does this thousands of times and builds a statistical picture of each bit in the sector (ie, is that bit likely to be a 1 or 0 based on what it returned over the last 1000 reads).This is becoming increasingly less useful as drives technology improves, and if you look at it with a critical eye you'll see it's guessing the contents of the sector and then writing it back, calling it recovered.In practice on smaller drives it does a reasonable job, particularly when you have a 4k sector size of which one 512 byte chunk is flaky. It can make the difference between "The word document is complete garbage vs only slightly corrupted".I bought it many, many years ago. Would I buy it now? Probably not.

author: madires
author_rank: Super Contributor
timestamp: June 12, 2022, 10:17:31 am
content: Quote from: BradC on June 12, 2022, 02:18:22 amI don't think that feature is unique to Spinrite. It's a logical thing to do for old HDD technology, and I wouldn't be surprised if data recovery companies had that feature in their homegrown tools for a lomg time too.

author: Peabody
author_rank: Super Contributor
timestamp: June 12, 2022, 01:39:06 pm
content: I don't think it guesses at anything. It keeps trying until it gets a result where all the error correction works, so the read is valid. If it can't ever get that, it reports the sector as unrecoverable.In any case, it's currently under a complete rewrite to deal with today's huge drives in a more reasonable time. The new version will be free to current owners of version 6.Anway, back on topic, I still wonder how someone's FIDO2 key pairs will be transferred between devices made by different manufacturers. Is there anything in the FIDO2 documents addressing that?

author: gmb42
author_rank: Frequent Contributor
timestamp: June 12, 2022, 02:37:19 pm
content: Quote from: Someone on June 11, 2022, 11:05:54 amWhat factors an authentication provider requires to use the service has very little bearing on the technology used in the authentication service. Comingling biometrics where they aren't required is just more FUD.

author: tooki
author_rank: Super Contributor
timestamp: June 12, 2022, 07:47:22 pm
content: Quote from: BradC on June 12, 2022, 02:18:22 amYes, that’s the “feature” that chews up hard drives that are already failing. Much better to attempt to copy everything to another drive first, THEN go back and try and re-read. (That’s what real recovery software does.)Bear in mind that people more knowledgeable than me concluded ages ago that this functioncan’tdo what it says because drives don’t evenhavean ATA command to output the raw data. The drives already (automatically) perform heroic measures to recover data, more than SpinRite could ever do.So if others don’t actually do this, it’s because it’s a) not possible, and b) pretending to do it endangers data by thrashing an already-failing drive.

author: Someone
author_rank: Super Contributor
timestamp: June 13, 2022, 12:05:16 am
content: Quote from: Peabody on June 12, 2022, 01:39:06 pmThe approach I would be taking is to always register multiple clients against any service/provider. Lose/destroy/revoke a specific device? you've got another ready to go, immediately setting up the new primary client to always retain at least 2 sets of keys for any service.Platforms/services really hate this with a passion, they want you to have a single client (for their misguided reasons) which we already see with RFC 6238 authentication implementations.

author: Someone
author_rank: Super Contributor
timestamp: June 13, 2022, 12:12:37 am
content: Quote from: gmb42 on June 12, 2022, 02:37:19 pmIt isn't FUD, when the new incoming standard requires biometrics (to meet certain "levels"). And those biometric enabled devices will be widely deployed its pretty certain all sorts of providers will jump on the bandwagon and require unnecessarily "secure" authentication just because its zero/no cost to them. We have already seen this with mandated 2FA for students, oh you want to go to school? you must have a XXX or XXX brand mobile device with OS XX.X or newer and XXX biometric features, coming soon!

author: Peabody
author_rank: Super Contributor
timestamp: June 13, 2022, 04:37:48 am
content: Quote from: Someone on June 13, 2022, 12:05:16 amI don't think multiple personalities is a good option. In the first place, it might work for lose/destroy/revoke, but what about adding a device? Also, if the site is a forum like this one, I want to have only one identity. As I understand it, if you have multiple key pairs set up on a site, you have multiple identities there.Well, there needs to be a uniform protocol to export and import your FIDO2 stuff to/from a different device. I just haven't seen that yet, and will be reluctant to use FIDO2 without it.

author: Someone
author_rank: Super Contributor
timestamp: June 13, 2022, 07:04:27 am
content: Quote from: Peabody on June 13, 2022, 04:37:48 amBut that is purely a platform choice. Some places happily let you (once confirming your identity with client A) register/enrol device/client B to the same identity on the platform. But there is this push from other platforms that you may only have one secret key to use and you may never transfer/back it up (because SecURIty HoLEs !!$$@). Its that bit which is so infuriating, given that losing access to a key is something that will happen.I lost a captive/hidden RFC 6238 key and had to abandon the identity associated with it, starting from scratch to build up a new trust and new identity (basic government services access) so its a real problem that just gets shrugged off as part of necessary "security".

author: Peabody
author_rank: Super Contributor
timestamp: June 13, 2022, 02:19:29 pm
content: Well it will be interesting to see what they end up doing. But somehow I am not optimistic that they will pass up the opportunity to build silos.

author: tooki
author_rank: Super Contributor
timestamp: June 14, 2022, 09:36:04 am
content: For what it’s worth, it appears Apple’s upcoming implementation will sync the saved keys using iCloud Keychain, just as they do now for saved passwords. (FYI, the key syncing happens peer-to-peer between a user’s devices. More recently, they added a keychain recovery function, which obviously necessitates it being stored on a server. I haven’t had a chance to look into exactly how it works.) Since Apple already offers iCloud for Windows, and it supports the password manager functionality via a browser plug-in, I don’t think there’s any evidence that Apple would actively try and silo users now.

author: gmb42
author_rank: Frequent Contributor
timestamp: June 14, 2022, 10:27:05 am
content: The FIDO Alliance announced in May theirplans, supported by Apple, Google and MS, to allow users to use credentials on multiple devices without having to re-enrol. Not entirely certain this fixes the issue if your "primary" device (phone, key etc.) is lost\stolen.Allow users to automatically access their FIDO sign-in credentials (referred to by some as a “passkey”) on many of their devices, even new ones, without having to re-enroll every account.Enable users to use FIDO authentication on their mobile device to sign in to an app or website on a nearby device, regardless of the OS platform or browser they are running.

author: Marco
author_rank: Super Contributor
timestamp: June 18, 2022, 06:23:28 am
content: Quote from: Peabody on June 11, 2022, 03:05:24 pmI wonder if it would be possible to fake a FIDO2 device, but generate the keys with SQRL. Obviously wouldn't work when attestation is required, but I don't think most websites require that.

author: Someone
author_rank: Super Contributor
timestamp: June 18, 2022, 07:24:35 am
content: Quote from: Marco on June 18, 2022, 06:23:28 amThat's part of the problem, FIDO has information from the device/client/authenticator to verify that it has a valid (model specific) certificate, a certificate that can be revoked if the FIDO organisation doesn't feel that it is meeting their requirements. If they say you can't have the user transferring certain types of keys, then anything letting the user transfer those keys could be revoked.This discussion ends up rather convoluted and difficult as there are different type/functional "keys" within the proposed systems. So while there are cute projects to help users take control of keys:https://dicekeys.com/other keys are not for users to see/backup/transfer.

author: Peabody
author_rank: Super Contributor
timestamp: June 18, 2022, 03:22:00 pm
content: My understanding is that FIDO2 generates a random private key for each site. But if it's the client that generates the keys, then in theory you could just as easily use the key generated by SQRL. The server would have no way of knowing the difference. In fact, I believe FIDO2 uses, or optionally can use, the same elliptic curve that SQRL uses. But as Someone says, FIDO2 may have ways to prevent that.