Hacker News Reader

Comment by autoexec | Hacker News Reader

Everything I've seen to replace or "fix" the problems with passwords just makes things worse.

My requirements are:

1. Nothing tied to a specific device, especially one that can be easily lost/stolen/broken like a cell phone or USB drive

2. No biometrics

3. It shouldn't permit anyone, outside the website I'm logging into, to know if, when, and/or how often I log into that site.

I'm pretty sure using passwords with an offline password manager is the only thing that satisfies that, but if someone comes up with something better that meets all my requirements I'd be all for it.

View on HN

Client side ssl certificates satisfy all your requirements and are phishing resistant.

Yep. It's often users' magical thinking combined with charlatans trying to sell them a panacea.

1. Can't be tied to just one device - Must have backup codes or multiple devices that can act as the same to prevent lockout and aid legitimate recovery.

2. No biometrics - Doesn't survive rubber-hose cryptanalysis. Easily impersonated.

I would add the following:

4. Unable to operate without my interactive, explicit permission.

5. Not a device left online 24/7. Preferably detachable.

6. Not an NFC.

Congratulations, we've just reinvented the emperor's new clothes with very long CSHWRNG-generated passwords or key files, password managers, FIDO2 hardware devices, and backup codes.

> 2. No biometrics - Doesn't survive rubber-hose cryptanalysis. Easily impersonated.

Also, biometrics generally can't be revoked. Not nearly enough attention is paid to that, and it's very important, IMO.

In the extreme case, let's say you're using actual DNA. On the surface, that looks impregnable to anyone but maybe your identical twin (barring the "rubber hose" thing, of course).

In practice, anyone who's hacked a genealogy site (as happened quite recently with 23andMe, IIRC), or who's managed to grab your used coffee cup or cigarette butt pwns you forever.

sqrl, but no one is using it because the big boys can't own it or sell it or use it for any sort of lock in or stickiness, and also probably because it's actually correct, which means there is no way to fix user F-ups

Other than a few awful providers such as AWS, 2FA isn't limited to a single device. Put it on your cell phone and your old phone you upgraded, or a cheap old phone, or multiple yubikeys, etc.

If one is lost you grab a second device.

yubikeys are interesting, basically not much different than a password manager in the case they get lost/stolen, but I worry about the privacy aspect. I assume using the app, or the use of yubicloud would allow yubico to know which sites I use, and perhaps when.

Why would you assume that? You don’t need to use their app.

It looks like it might be possible to avoid leaking a list of the sites you use with yubikeys, but I need to look closer at how they work on the website's end to make sure they aren't using YubiCloud or some other third party service for validation or key management, and to make sure nothing is trackable through it. It looks like Yubico OTP requires Yubicloud and using yubico-pam might use Yubicloud.

I deal with #1 by having two YubiKeys, and registering both

Reply on news.ycombinator.com