Hacker News Reader

Comment by Aerroon | Hacker News Reader

>Passwords in the traditional sense of "secret you have memorized" have never really worked well and we should get rid of them.

No, we shouldn't. Passwords, as they are allow me to use whatever means I choose to remember the key. I can memorize the password, I can use a password manager or I can even derive the password based on some rules I've made up. The choice is mine. A passwordless future is almost certainly going to remove that choice from me.

If you told me that in 30 years you need to insert your national ID card into your computer to log in or to browse the web, I would believe you. And I would much rather have broken things instead of that kind of dystopic future.

View on HN

It's a lovely illusion of choice, yes.

I'd personally rather see us invest time in "passwordless" systems that provide their own choices/alternatives, but in a collectively strong way where the weakest link in our security chains aren't bad password policies and massive password leaks from database compromises.

(How many banks still require passwords that have no symbols in them because they are overly afraid of injection hacks and would rather have users use weaker passwords? How sites in general still require tiny passwords because of choices in varchar(16) that haunt them to this day, or worse COBOL tools with exact sized binary fields that still need to have those passwords in them? How many sites do we need to see added to the database of something like pwnedpasswords/haveibeenpwned before enough is enough?)

I'm absolutely not saying that Microsoft's approach to "passwordless" is the best one, and certainly "national ID card" is a very scary straw-man that comes up a lot in these discussions!

I am saying that we have to start from the perspective of passwords are broken for us the power users (and our lovely workaround the modern password manager) just as much as for average users that don't understand what is going on technically. We need to get rid of passwords. If we work together today we can try to build standards that get rid of passwords and still provide (especially for power users) provider choice and hardware choice and all of the little things like that which matter to us.

Pretending passwords aren't broken isn't going to get us there, and is more likely to get you that future dystopia where you have no choice rather than appreciating today that passwords need to go and we should be working together on the solutions (twenty years ago) and rather than arguing to maintain the (broken) status quo, now is still a great time to explore and propose alternatives.

This sounds like corporate propaganda. The way I can tell is that it tries to convince people to surrender their freedom using arguments such as "What is freedom?", "There is no other option" or "Alternatives are illusions" - These narratives just try to brainwash us into a "Freedom is slavery" mindset described by Orwell.

> It's a lovely illusion of choice, yes.

It's not an illusion. There is no model where a 3rd party is involved that isn't pre-compromised, either legally (the government and civil actors via the courts), financially (stop paying, lose access), operationally (so sorry, your key expired), logistically (oh, sorry, our server is down. Can't load your keyring), or technically (um... this device thingy stopped working). Every one of these problems is really a showstopper when it comes down to it. Why? Because without perfect performance of third parties and/or hardware, the risk is your data being locked away forever (or even for a few days). We all accept some of these realities, but ultimately, I think most of us on HN have had one of the above happen to us (maybe all of the above).

> How many sites do we need to see added to the database of something like pwnedpasswords/haveibeenpwned before enough is enough?)

I'd love a way to get rid of the password, but the trade off is either having a third party control access to my computer or counting on flawless reliability of people and hardware. All of which can lead to a worse state than cracked: data lost forever.

Ultimately, disclosures are terrible, horrible and should be prevented. But permanent loss of access is even more horrible.

> There is no model where a 3rd party is involved that isn't pre-compromised, either legally (the government and civil actors via the courts), financially (stop paying, lose access), operationally (so sorry, your key expired), logistically (oh, sorry, our server is down. Can't load your keyring), or technically (um... this device thingy stopped working). Every one of these problems is really a showstopper when it comes down to it. Why? Because without perfect performance of third parties and/or hardware, the risk is your data being locked away forever (or even for a few days).

This is what I'm saying about password managers. We *are already* in a situation where the best advice we can give each other is to get a 3rd party involved to store our passwords for us because we have to use passwords that we physically cannot remember as humans. Those same 3rd parties have the same complicated issues and responsibilities/trust legally, financially, operationally, logistically, and technically!

Even how many of use Keepass or one of its forks: we accept some technical trade-offs ("It's open source!") for some massive legal ones. I tried to describe Keepass to my father and as an attorney he shivered in horror at the thought that there was no legal entity to hold accountable (through the courts if need be, through the Better Business Bureau and the court of public opinion at the very least) should things go wrong. My father wasn't wrong about that, and I've thought about that additional perspective for years now without good answers.

That's also why I describe the above "choice" as an illusion of choice: our best security advice is that the safest passwords are already out of physical human memory (between minimum complexity requirements to avoid spray attacks and minimum uniqueness complexity to avoid reuse attacks) so remembering all of our passwords is just out. There are plenty of HN posts about algorithmic "passwords" that people can sort of memorize, but no algorithm can match the practical problem of the wide variety of different password policies across the web. The only real, practical option we have as a best practice is Password Managers. Which I want to make clear are already "3rd Party passwordless": and there we do have real choices right now between 3rd Party providers. I want to make it clear that just because I think passwords are broken I don't think choice is bad: I want us to understand as a group that the real fight isn't between "password managers" and "passwordless", because "password managers" are a workaround/hack towards "passwordless". The existing diversity in password managers is good, I don't know how we keep that in more "passwordless" systems, but I don't think we get there by championing for the "password" status quo. We can try to throw out the "password" bath water without throwing out the "password manager" baby, but mostly only if we start by agreeing that "passwords" are broken.

>This is what I'm saying about password managers. We are already in a situation where the best advice we can give each other is to get a 3rd party involved to store our passwords for us because we have to use passwords that we physically cannot remember as humans

Nope. Not the case. I'm pretty sure I log into my password manager with.... a password.

This is an extremely bad take. Instead of standing up a hypothetical strawman, let's look at what Microsoft has actually replaced the password with. There are quite a few, ahem, choices.

From the blog post the article cites, those options are: Microsoft Authenticator app, Windows Hello, a security key, or a verification code sent to your phone or email. Note that Windows hello is also carrying a lot of water here, as that's facial recognition, pin, pattern, or fingerprint.

The biggest place that the password argument falls apart is, these choices are not exclusive. You can use any combination of them that you want. You can use multiple of the same option i.e. security keys or fingerprints.

> From the blog post the article cites, those options are: Microsoft Authenticator app, Windows Hello, a security key, or a verification code sent to your phone or email.

Mmm, yup that all sounds terrible. I agree with GP, I like the ability to decide how to manage logging in.

Passwords are a "least worst" kind of system.

Passwords are a lowest common denominator kind of system. They're an unstructured primitive that people can add structure to in order to create a system. Everyone ad-hoc creates their own and most people are really bad at it. Whether it's memorization, deriving them from some other key, storing them in a HSM, or in a password manager.

Exactly, they are the primitives of security systems. If passwords are broken, then every other security system is suspect. If users can't be trusted with passwords because most people are really bad at it, and people are bad at it because they are human, why should I trust MS's human developers to do any better? Why should I trust anyone to do better? Exploitable software has resulted in far more economic damage than bad passwords.

It seems like a massive XY problem where somehow many people have come to the Y "let's get rid of passwords" as the solution, when the X is a mixture of solved problems:

- "people are bad at entropy" (password gens, sensible entropy rules)

- "people are bad at memorizing orthogonal unique strings" (password management schemes and systems)

- "passwords leak" (detect wild passwords and facilitate rotation)

The humble "secure string" allows the implementation gamut from "hunter2" to kilobits of noise, stored in a browser, chip, or post-it. Just prevent the worst incarnations. Passwords are not broken.

Indeed. Shit, just this year Microsoft signed a kernel driver containing a rootkit and didn't notice until third parties alerted them three months later. Those are the people you want in control of all your online accounts?

But if you're worried about Microsoft, you shouldn't want a shared secret such as a password. The whole problem with shared secrets is that the other party might lose it.

For WebAuthn, even if Microsoft literally makes a web site "Get tialaramex's authentication credentials here" solely to reveal the credentials they have for me, it doesn't help bad guys at all. Completely useless. The credentials only help Microsoft, and only to verify me.

That's the "scary" passwordless future, authentication that actually works and can't be weaponised against you, terrifying...

> Exactly, they are the primitives of security systems. If passwords are broken, then every other security system is suspect. If users can't be trusted with passwords because most people are really bad at it, and people are bad at it because they are human, why should I trust MS's human developers to do any better?

Passwords that are managed by hand are broken. If you’re already using an automated password manager, then you’re probably fine. Humans can build tools that do stuff better than unassisted humans can do it. Cars are faster than humans, even though humans built them. Dice are better at generating random numbers than unassisted humans, and they’re literally just marked cubes.

Of course, the Windows end-users could build software-based password managers instead of doing it by hand, and some have. But it’s not the default, so many don’t.

> Why should I trust anyone to do better? Exploitable software has resulted in far more economic damage than bad passwords.

You seem to be underestimating the amount of economic damage caused by phishing and password reuse, both of which can be largely chalked up to manual password management. But am willing to be corrected on this. [citation needed]

Numbers are a bit loose, but even a Fermi style estimation suggests malware in general is worse than phishing. Phishing is on the order of tens of millions [1] to a few billion [2]. Ransomware alone probably causes upwards of many billions [3]. Equifax breach (XML exploit) alone has cost billions. Heartbleed, spectre, meltdown, those are at least 1B each.

[1] https://www.cybersecuritydive.com/news/phishing-cost-enterpr... [2] https://www.proofpoint.com/us/corporate-blog/post/fbi-report... [3] https://cybersecurityventures.com/global-ransomware-damage-c...

Ransomware isn't necessarily spread by software exploits. A lot of them use nothing fancier than "My File.pdf.exe" attached to an email, like CryptoLocker and its many clones [1]. Sure, WannaCry used an actual software exploit, but most ransomware gangs don't have leaked NSA cyberweapons to work with.

[1]: https://www.arnnet.com.au/article/556598/australia-specifica...

Also, a lot of breaches that are caused by vulnerabilities, like large forums having their databases leaked, are bigger problems than they should be thanks to password reuse.

But I hadn't thought of Equifax. That company's database held so much economic value that, all in one fell swoop, this single exploit may have tipped the scale so that vulnerable software cost more than password reuse.

How is TOTP terrible? How are security keys terrible?

Parent could be talking more about vendor lock-in rather than protocols.

At least that's my bug bear with this. I know 2FA SMS is less secure, but I'm sticking with it as long as MS require a MS app (or I'm forced off SMS 2FA).

MS doesn’t require a MS app unless they’ve changed something recently.

Oh FFS! It's a hidden menu option when you go to [1]. Have to click Configure App Without Notifications once you click Setup Authenticator App.

Two years of misery and stubbornness. One hidden menu option.

[1]: https://account.activedirectory.windowsazure.com/proofup.asp...

Any TOTP works fine, they just advertise their own obviously, and it has extra conveniences for their own accounts.

Ah, ok. They make it sound like it _has_ to be their flavor of OTP.

That's...slightly better, I guess. I still want passwords though as the base level.

Ugh. I just spent the whole day screwing around trying to debug SAML SSO for setting up a VPN on AWS. Brain is fried and I feel no closer to my goal. I realize that's somewhat unrelated to passwords, but my point is "Identify management is _hard_".

Passwords just kinda work. That's the _opposite_ of broken. We just need to train out the bad habits (storing plaintext, allowing dictionary words, etc).

Okay, and I don't want to install an app, don't want "Windows Hello" to have my face, don't have a "security key" and don't want to give Microsoft my phone number.

All of these options seem to have a damning tendency to compromise your privacy in one way or another.

Passwords remain the best option for privacy, especially when a company refuses to implement TOTP.

I'm OK with having a security key, and actually have one (YubiKey).

But MS went out of their way to only allow using it under Windows for some reason. If you want to log in to Azure/Office 365 from a different OS, you have to use some other way.

> especially when a company refuses to implement TOTP.

They do have TOTP, though. It's called "Authenticator app". The one that does the push notification and is MS-only is called "Microsoft authenticator" in their list. This works both on my personal, basic "outlook.com" account and on my work Azure / Office 365 one.

---

What I find funny is that for the personal account, the push notification seems better implemented: they send a code that's also on the screen, so you can know that you're approving the action you're currently doing. On the Office 365 subscription, I just get an "approve / cancel" box. This could probably be abused by someone knowing that I'm about to log in, since I have no way of knowing what I'm approving.

> But MS went out of their way to only allow using it under Windows for some reason. If you want to log in to Azure/Office 365 from a different OS, you have to use some other way.

According to Microsoft’s documentation, windows, macOS and Linux are all supported, but only edge and chrome on macOS and only chrome on Linux. https://docs.microsoft.com/en-us/azure/active-directory/auth...

When we implemented this lately, we did find another somewhat annoying speedbump: If you use SAML-based SSO and log in with a yubikey, some SSO breaks since the application at the other end requires explicit password-based authentication. Fixing this requires assistance from the application provider who may be unwilling to fix this.

Interesting, can confirm Chrome works on Linux.

What's weird is that Teams on Linux does show the "sign in with security key" but it doesn't do anything.

Windows Hello is basically the same thing as how you unlock your phone with Apple or Android. --Your biometric data doesn't leave your device, instead it's used to unlock a certificate in a TPM. I'm not sure how that's supposed to compromise your privacy.

Though it can easily fall prey to the same problem as the security key: my machine doesn't have any biometric inputs, so I'm at least back to "buy something."

PIN, pattern, phone app.

If those are three different things, and I can choose one of those, why a four number PIN code would be safer than a password?

Microsoft's "PIN" is not a four-number digit code, it's an arbitrary-length device passphrase that can include all symbols found on your keyboard. The only reason they don't call it a password is because you already have a (global) account password, and the PIN only serves to unlock that device. If you have two devices, you can have a different PIN for both, that will still log you into the same account.

Critically they don't know the PIN and so can't lose it. When you use your global Microsoft account login they know the password. Now, if they're careful they immediately forget it after verifying it, and it's hard to steal the authentication credentials they keep, and so on. But you're relying on them being unfailingly careful there. Whereas, for the PIN even if Microsoft screws up they don't know it and can't lose it.

FIDO 2FA is safer because both factors stay where you are, the FIDO device promises it checked the other factor. The FIDO device is something you have, while your other factor (like a PIN, something you know, or a fingerprint, something you are) it vouches for by signing a bitflag labelled UV User Verified. This flag says, I promise I verified this is the same human that we originally enrolled. Which human? Not something the FIDO device knows or cares about and so it can't tell the Relying Party anything they didn't already tell it about who was enrolled. How did it check? Not revealed to the Relying Party.

Because it is tied to a specific device and is not global like a password is.

> Windows Hello is basically the same thing as how you unlock your phone with Apple or Android.

People have option to use codes.

Windows Hello supports PINs and/or patterns in addition to biometrics.

PIN.

The argument that Microsoft is somehow to blame for wanting you to either give them your phone number or buy a $10 security key before giving you access to their free online email and services is...weird?

Like, it's pretty normal for such services to demand phone numbers. Like Signal does.

If you don't like it, you can use something else? I fail to see what the big deal is here.

Microsoft owns the computer industry. "Use something else" is quite a weak argument in markets dominated by oligopolies and especially in this one. At the very most, the argument would be "use the other one".

Passwords are broken, now give us your face for facial recognition. Facial recognition is broken, now etc etc

This is a strange argument, to me. I don't have any devices made by Microsoft, and have not for years. And I'm lazy and disinclined towards "linux on the desktop" neckbeardism. ;)

Congratulations. Microsoft Windows, Microsoft Exchange, Microsoft Word, Microsoft Teams, Microsoft Excel, etc etc.

MacOS/Chrome os, iCloud/Gmail, Google docs, zoom/whatever Hangouts is called today/discord, Google sheets.

It's not even that hard to avoid Microsoft.

It's difficult in corporations, but not at home.

I don't think I've used a single microsoft product in like six or seven years. Docs has replaced Word and Excel. I own a Mac and prior to that I owned a linux machine. I use Zoom and FaceTime for video calls. I don't even use github.

>Like, it's pretty normal for such services to demand phone numbers. Like Signal does.

>If you don't like it, you can use something else?

We can also demand that they keep using passwords. Signal, for example, is a complete non-starter for me because of that phone number requirement. As long as they have that requirement I will never use their service.

Also, that $10 security key is just a step away from being your national ID card. That's how bank logins work here. No passwords allowed.

> Also, that $10 security key is just a step away from being your national ID card. That's how bank logins work here. No passwords allowed.

Er, wouldn't that be a good thing? Identities cannot be linked to the same physical FIDO key across multiple relying parties, so what's the concern?

> Identities cannot be linked

Yes, they can. Quite obviously they can and all it takes is even a modicum of cooperation. We have already extensively seen corporations love to cooperate when it comes to compromising information that belongs to you.

Compliant FIDO2 keys guarantee unlinkability even against colluding relying parties. See https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-se..., specifically "security goal 4", and the unique authentication keys requirement.

Against any two, not any number.

Did you look at how this is actually achieved?

Attackers (even if they control several major outfits like say Microsoft) are not going to succeed in a correlation attack. Roughly what they're doing is like trying to guess the AES keys.

This is in stark contrast to passwords of course, where correlation is so high that haveibeenpwned is worth existing...

Seriously?

Please, explain to me how an arbitrary number of RPs can collude to link a FIDO2 identity.

Yes, that is how the crypto works from a technical perspective.

But the places that want to know your identity for casual surveillance will not settle for just a pseudonymous FIDO exchange. What will happen is there will be a handful of companies that you directly authenticate to with FIDO (eg Google), who require a bunch of personal information to create an account, that then vouch for your larger identity to third parties.

The problem is not technical - there are many ways to replace website auth passwords that would be better. The problem is the business desires all but guarantee newly developed methods will leak more of our personal information. Is a business more likely to do the work of implementing FIDO themselves, or to tie into Sign in with Bigcorp? Given what is already happening, that answer is clear.

Simple per-site passwords continue to exist due to the momentum of everyone understanding them, despite their drawbacks for the surveillance industry. Regardless of what other methods are offered, we should aim to preserve the existence of the password method as at least one of the choices, such that we can freely decide whether those other methods actually benefit us. The growing insistence on snake oil "2FA" is already bad enough.

To restate, I think your argument is that by making authn more complex, standards like WebAuthn will push towards "Identity as a Service" platforms like Firebase, Okta, etc, and that this concentrates power in the hands of those providers.

To an extent I think this is a fair argument, but it strikes me as somewhat of a Luddite one as well: yes, the better technology is also more complex, but most of the time users are simply more secure by developers choosing IaaS providers!

At the limit, you could argue against developer guidelines to use SSL or salted password storage, because those are "complex" and "encourage adoption of common providers." I don't think these security mechanisms are significant drivers of tech consolidation, and of all the things to complain about, the payoff for users--increased security--is hard to oppose!

When it comes to surveillance companies developing software, I am a Luddite by default. They can't help but incorporate biases that destroy end user autonomy, because they're only concerned about advancing their own perspective. In general, I don't view "security" under the wing of a company as a goal worth striving for, because companies are the long-term attackers we need to worry about!

If it was guaranteed that say FIDO would stop sites demanding phone numbers to do snake oil "2FA", then I'd be fully supportive. But from what I've witnessed surveillace companies won't take steps that don't benefit them - why would they ever stop demanding phone numbers now that they can? And so whatever it turns out being, I can only imagine that "passwordless" will be similarly abused ("never let a good crisis go to waste"). At the very least it will create another configuration speed bump that interrupts workflows based around trying to compartmentalize the surveillance industry (eg I only run web browsers in VMs).

If you really want to drive adoption of FIDO, then instead of pushing hardware tokens (and corresponding heavyweight process), Mozilla should create a software FIDO key within the browser. That is something that I can see evolving features that help users rather than restrict them. It would then be up to an end user whether to use a hardware token in place of that, iff they determine that a given account is that important.

There's nothing that stands in the way of anyone implementing a software FIDO2 key (though some RPs can reject self-signed attestation certs if they want to, but it's not common AFAIK).

See https://github.blog/2017-07-20-soft-u2f/ for an example.

I didn't say there was, and I figured there had to be, given the amount of open implementations. I was speaking more to adoption path and resulting customs rather than what is technically possible. Like for example to use "FIDO authentication", if I have to plug in a specific USB key, pass it through to a VM, etc, then that extra effort isn't worth it for 90% of my accounts (although that won't stop them from insisting that it is!). Whereas if Firefox can handle it in software by default, and I can easily backup/restore its keying material with standard shell scripts, then I'm much more likely to see it as a benefit.

FWIW do you know if the server can reliably determine what brand of authenticator is being used (eg through a pubkey signature)? I haven't studied the protocol enough to know if it contains those kind of anti-features.

There's a concept of "batch attestation", by which the manufacturer builds in a key that attests to a batch (with a minimum batch size, to avoid identifying a single USB key--either 10k or 100k but I forget offhand which).

This is (AFAICT) intended to be used by, say, an enterprise who wants to restrict their employees to some trusted brand, but some banks and similar have also used it.

This is somewhat discouraged and annoying. In general, most places you can use a "self-signed" authenticator, which could be software and nobody would know.

Damn. That's the exactly the type of long-term security vulnerability that I'm concerned about.

What you're describing is only today's present conditions. They're allowed to continue because adoption is low, and so businesses aren't trying to add even more "security". This is like IP before DPI, or when people considered Bitcoin anonymous.

Once FIDO keys become popular, and especially if software-only keys become popular, companies will most certainly restrict their services to only work with trusted brands.

Eh. They don’t have a big incentive to, right?

It’s a risk, and I believe the batch attestation was controversial as a result. But the use cases are compelling.

My point is that it's not a "risk", but rather an extremely slow developing inevitability.

Think forward to when most everyone is using security keys, and 90% of users use one from one of the big brands. Then someone tells a bank's security chief "did you know users can defeat our security by installing a piece of software?"

They'll look for a solution to that, and the solution will be using the feature to restrict keys to trusted brands. The only downside will be annoying a small segment of customers. But at that point they won't care, because those customers don't conform to their security mold anyway.

For a contemporary situation playing out right now, many websites have decided to outright block or CAPTCHA-harass connections from datacenter IP addresses. In their mind, all such connections are fraud and abuse rather than legitimate paying customers that happen to have custom network setups.

And of course the use cases seem compelling in the corporate context, because corporations are authoritarian organizations where top-down control is simply accepted. The problem is that they push their authoritarian desire for control into technical standards, which then unleash that centralizing control onto the outside world.

Authoritarian, or utilitarian?

Authoritarian - a corporation is directed in a completely top-down manner, with singular authority vesting in the executive.

They obviously exist within a larger society where workers are free to quit, have some rights that can't be taken away, are bound by agreements, etc. But the organizational structure itself is strictly hierarchical.

The problem comes when these assumptions are baked into systems that are supposed to serve wider society. A corporation can tell their employees that they must use only certain computers to do their work, modify those devices, revoke access on a whim, etc. Whereas in wider society, relationships should be that of independent peers interacting through well-defined protocols, with each party free to make their own choices.

Oh, for sure that‘s true (with respect to telling employees “use these devices or you’re fired”). But I thought we were talking about the corporate relationship with society and the company’s users/customers.

In that broader context, I’m surprised that so many folks in this thread are arguing, essentially, that companies have a strong incentive to push (potentially needless, or costly from a privacy-perspective[1]) features on their users.

Historically, my feeling—-and I think that of many in the security industry—-was that the market does not reward pushing security, especially not security that customers can’t see; as a result, there’s some chunk of security theater, but real security features are often under-rewarded.

shrug

[1] To be clear, I disagree that most of these things have a severe privacy cost, hence my point that FIDO allows strong pseudonymity.

You are compromising security here.

> you can use something else

This is quite simply not true, Microsoft is a monopolist.

> $10 security key

You're implying this is somehow little, even though spending $10 to comply with another weird demand from yet another US corp that feels I have to spend or compromise myself to conform to their demands is too much. Any amount of money is too much, and any amount of compromise is too.

>any amount of compromise is too

I would argue you _are_ compromising. You're accepting the drawbacks of passwords in exchange for not having to use any of the alternatives.

Anything that is free choice is fine. Something Microsoft mandates because they believe they should dictate how the world works is not.

How is this not free choice? Are you saying Microsoft shouldn't be able to impose mandates to use their online service?

Genuinely curious.

It's actually a good take. They pointed out that you don't need an extra piece of software or device.

PIN.

In two years: PIN deprecated.

Microsoft still supports SMBv1 released in 2003. For the love of God don't use it, but you could.

That's true. But also, how's your Kin/Windows 8 RT device/Windows Phone/Surface Neo/Microsoft eBooks/PlaysForSure music collection?

:-)

To me a weird part where these hit hard is on shared access to common resources.

The two options I see are either:

- Have shared access baked in the service and each user has its own account, with its own auth means

- Go through elaborate schemes to somewhat share a single account's credentials.

Shared access with multiple accounts is currently a PITA in most services. Apple for instance still doesn't really understand how families work. Google is also suboptimal, even for cases like common photo libraries (not albums, whole libraries), and their weird separation of standard accounts getting access to all services under the sun, and GSuite/Workplace "second class" accounts doesn't help at all. I don't see Microsoft being better on most of its services, but I don't use them enough to have a strong opinion.

So the remaining way to handle these fairly common issues is to have a master account shared among two or more people, and most of these auth options rely on biometrics or fairly personal services. If that's the path forward, I wish they'd clear the surrounding issues first.

You can enroll multiple fingers, you can enroll multiple security keys, you can enroll multiple phone numbers, and you can create and share an account PIN. Choose any combination of these authenticators.

Microsoft also has very mature permissions for all of their web properties like OneDrive and SharePoint/Teams. So you can also give people their own logins and then share stuff between them.

So if you lose your phone or are unconscious, say goodbye to your accounts.

Huh? Did you miss the part where you can have multiple options setup at the same time, and use whichever you want whenever you want?

Can I use a password?

This comment reminds me of all the people that open PR in php projects to replace various hashing algorithm with md5, because that one is built-in and obviously superior

Especially in web context the new authentication APIs such as webauthn are long overdue and I'm looking forward to the next generation of password managers that will hopefully keep these generated keys synchronized between devices

MD5 is relatively secure for many applications. You can substitute a few bytes without changing the hash so that leaves some applications for manipulation. It is correct to not use it anymore, but you should know about the specific pitfalls. There is nothing like this for passwords or do you want to elaborate further? A password can even offer superior security in some cases.

You can gladly use webauthn if the service supports it. I just want to keep options. I also dislike synchronizing devices in some cases because that can be a security problem. I also like to compartmentalize some things.

> MD5 is relatively secure for many applications

This is pure gold.

Finding m' from m with the same hash even with an old md5 is not trivial. It has been memed as such, but it is not the case. Don't use it anyway for any application because there are problems and you would need to talk to walls to explain why it can be safe for certain applications. There is a theoretical solution preimage attacks too, but I don't think it was ever demonstrated.

I know this is a lost discussion, but it is technically correct. End of comment.

You are incorrect. Collisions are trivially easy to create, there is no situation where md5 is a good choice.

Here are sample PIN requirements (you can change them):

Must be a at least 4 characters long. Cannot be longer than 127 characters. Uppercase letters are permitted. Lowercase letters are required. May include digits. Special characters are possible. Cannot be an obvious number pattern (such as 123456 or 111111).

What are my choices for accessing a service that uses Microsoft's "identity platform" / "modern authentication" / (whatever they're calling it now) from a cross-platform desktop client application?

From what I can tell from their ADAL/MSAL documentation, the choices seem to be 1) using Windows with Windows Integrated Authentication (i.e., not cross-platform) or 2) building a web app that redirects to their web-based authentication flow (i.e, not a desktop app).

Something that is unguessable, uniquely yours, and also without the need to memorize or type it in seemed ideal to at least as early as 15 years ago. Biometrics seemed like the obvious choice. I got my little brother a laptop with a fingerprint scanner in 2008. Oh well.

I'm still not unconvinced (in biometrics), but I think carrying something like an electronic keychain (one that I have full control over) is more ideal today.

The problem with biometrics is that you cannot change them once they're compromised. On top of that, we leave biometric data lying around all the time - your phone is full of your fingerprints. While there might not be great systems to abuse that yet, it does make me hesitate whether biometrics are the way to go.

Biometric data not getting as much legal protection as a password can also cause issues.

> While there might not be great systems to abuse that yet,

Except I distinctly remember unlocking an iphone with a piece of sellotape a few years ago.

We should get rid of passwords. Maybe everyone has 1 password to unlock their hardware password manager / login token.

I agree with this 100%. Passwords are awesome. I've never had any security issues related to passwords. They are perfectly secure for almost everyone.

Just because a tiny handful of multi-millionaires feel that passwords are not secure enough for them, doesn't mean that the rest of us should be forced to use a dumb alternative which surrenders control to some third party.

Rule-based passwords are great. I never had any issues. If the rule is secret and complex enough and maps to a different password for each service, this is very secure.

I recommend having a separate rule for different security levels. I have 3 security levels.

- For low security, I use the same rule on 100s of different websites. I don't really care if they all get hacked. (Actually I might use password manager for that security level because I'm lazy and I don't care if some employees at some big company install a backdoor in the password manager steal that password. I'm willing to take that risk.).

- For medium security sites, I use the same rule for around 5 different, highly trustworthy sites... There are literally only 5 sites which I consider 'medium security'.

- For high security, I memorize a unique password or passphrase for each service. I only have 2 services which fit this description of 'high security' - They're financial in nature,.

It's not difficult at all for me to memorize 2 rules and 2 passwords. I don't need to trust any third-party piece of software with my passwords except for my operating system and my browser (both of which are open source BTW).

The idea of password managers is idiotic... You're trusting a single entity with all your passwords! You're assuming that they will never introduce any bug in their code which will leak your passwords to their employees. You're assuming that these companies will never hire malicious developers who will add backdoors to the password manager's code to steal your passwords... No foreign state will try to hack that service... Hackers will hack into gas pipeline companies, but they won't try to hack a massive centralized repository containing everyones' passwords? Think people, think! It's basic common sense.

[EDIT] BTW, the fact that this comment is being downvoted suggests that there may be a corporate agenda behind moving everyone to centralized password managers... Why would the powers that be want to do that?

FYI, the reason I downvoted was because of your claim that downvoters must be part of some corporate conspiracy to silence you. That's ridiculous.

The truth is that we observe very very clearly that people, as a whole, cannot use sound methods of password management without a password manager. They revert to password reuse. Just because you can do it and it is easy for you does not make this a functional system for ensuring that all users are doing the right thing.

Corporations hire hundreds of thousands or even millions of people in management positions whose main purpose is to think about how to increase market share in a world where those corporations already have far more market share than they deserve based on their production ability.

Given this, I think it's normal to expect political manipulation and conspiracies to arise as an alternative to value creation to extract wealth. Remember when Google and Apple agreed not to poach each other's employees? It's irrational to assume that hundreds of thousands of managers just sit around all day doing nothing. It's also irrational to assume that all of these managers are honest, virtuous people. Surely some of them are conspiring with each other across different companies to give themselves an unfair advantage within their respective companies.

Reply on news.ycombinator.com