[HN Gopher] Your phone may soon replace many of your passwords
___________________________________________________________________
Your phone may soon replace many of your passwords
Author : todsacerdoti
Score : 90 points
Date : 2022-05-07 13:35 UTC (9 hours ago)
(HTM) web link (krebsonsecurity.com)
(TXT) w3m dump (krebsonsecurity.com)
| gomjabbar wrote:
| Personally I think this is a huge breakthrough that brings huge
| phishing resistance to billions of people's accounts.
|
| While it's good to be suspicious of something so critical like
| authentication, particularly coming from a big tech alliance,
| what about the positives? Consider the number one issue for most
| people is still phishing, and under this system there's no
| password to be phished anymore. Also consider that this system is
| likely using Bluetooth for the PC to phone challenge/response,
| avoiding current issues with passwordless MFA apps (i.e.
| Microsoft's right now) where the user could be still be social
| engineered to confirm a logon by a remote attacker. The Google
| smart lock app works like this today using BT and FIDO, so we
| know it works.
|
| Plus the core tech is from what I can tell, just tried and tested
| asymmetric crypto, with the private key on your phone. The public
| key is on registered on every web service you want to use it on.
| Second factor is the phone PIN/Biometric. Sure, Apple will let
| you store the key in iCloud, but we aren't talking standard
| iCloud backup here, this is iCloud Keychain where it's protected
| by your device passwcode which Apple does not know. And if none
| of this is for you, just use a Yubikey, it's the same tech. And
| if you do choose to use it, while you are at it, add several
| Yubikeys as backups to every service, that's standard practice
| and how it works now.
| alpinemeadow wrote:
| I am really concerned about people with disabilities with this
| approach, if it becomes the main way to log in, and the options
| are there but super painful to set. In fact, all the minorities
| that for some reason or another can't or it's too hard to use a
| touchscreen smartphone.
| notacoward wrote:
| All these claims about how FIDO prevents phishing seem very
| suspect to me. AFAICT the phishing protection is specific to U2F,
| which is only one of many interrelated (and IMO very poorly
| described) FIDO specs. Absent U2F, it seems like most forms of
| phishing are still entirely possible. Am I missing something? Is
| the operative definition of "phishing" much more limited than how
| a normal person would interpret it?
| tialaramex wrote:
| I mean, FIDO itself doesn't care about the web, and so doesn't
| care about phishing. But, in the context of the web you'd use
| WebAuthn, which replaced U2F (because it's an actual W3C
| standard with multiple implementations) and yes that's
| protected from phishing.
|
| Specifically, FIDO binds credentials to a "Relying Party ID".
| For WebAuthn that's effectively the DNS name of your server,
| which is why it's protected from phishing.
|
| The W3C publishes the entire WebAuthn spec. so if you care you
| can read it and see how it works.
|
| If you're using FIDO in some other context (e.g. smartphone
| apps can do this via Android or iOS APIs) your RPID is based on
| that context, so e.g. the real Hacker News Android phone app
| (if such a thing existed) can't be impersonated by a dozen
| third party knock-off "Hack-a-News" and "News for Hackers"
| apps.
| account-5 wrote:
| I commented on another thread about this FIDO thing. I really
| don't get what benefit this has fir me.
|
| I use keepassxc, so I'm not reusing passwords. I'm currently
| forced to use less secure SMS OTPs for some sites because they
| won't allow me to use TOTP in keepassxc.
|
| Now I'm expected to tie everything to one device that could be
| easily lost, stolen, or damaged, and back up my secure key to
| some random cloud store just in case that happens?? Cloud storage
| in control of companies that at a whim could lock you out.
|
| I don't think so.
| betwixthewires wrote:
| Can someone explain to me how this is a better approach than,
| say, a password manager and TOTP 2FA?
|
| I can think of a few downsides: 1) in the US at least, being
| compelled to provide biometric identification for _all_ accounts,
| 2) single hardware device point of failure, on top of that being
| the most often lost, stolen or damaged hardware device. And all
| the benefits I can see with it are already served by password
| managers and TOTP, which the manufacturers can just ship by
| default if they want to, the tools are there already. And I can
| back it up in whatever way I choose, securely.
|
| So what's the upside?
| bertman wrote:
| I quite like the "phone as hardware token" via Webauthn as 2FA.
| However, I've never used "Sign in with Google" and the likes
| because I don't want all the sites I'm using to get my "real"
| email address.
|
| So I really hope Google et. al. will offer some kind of email
| address cloaking like Apple do with their private relay stuff.
| Knowing Google, they sure as heck won't, though.
| matja wrote:
| It's depends on the site that uses OpenID Connect federated
| sign-in if they ask for your email address from the identity
| provider.
|
| An application/site can optionally request the "email" scope
| during OpenID Connect sign-in, but if it is not requested (only
| the "openid" scope instead) then the provider must not return
| an email address in the ID token, or an OAuth access token
| which is authorized for an API method which returns the user's
| email address (OpenID Connect Core 1.0 section 5.4 -
| "Requesting Claims using Scope Values").
|
| Google implement this (https://developers.google.com/identity/p
| rotocols/oauth2/open...), by returning only a unique numeric
| user ID in the returned id_token. I haven't checked other
| OpenID Connect providers.
| bertman wrote:
| Thanks! This is great info.
|
| I didn't know the details about different scopes and had
| always assumed the sites would obtain at least the name and
| email address, because all I ever saw was the prompt "To
| continue, Google will share your name, email address,
| language preference, and profile picture with <site>."
| Eddy_Viscosity2 wrote:
| How does this work for people who primarily use old-style desktop
| computers, and several of them at that?
| dwaite wrote:
| You can always use a hardware key like a Yubikey.
|
| The additional options discussed in this article are are to:
|
| 1. use a platform feature to have the TPM or Secure Enclave in
| the device itself work as an authenticator as an alternative to
| a hardware dongle. 2. synchronize across devices within an
| ecosystem (e.g. all Apple devices) using a mechanism on top of
| the platform account (aka AppleID + iCloud Keychain). 3. allow
| a phone to be used to authenticate to a desktop, even across
| ecosystems.
|
| The previous way would be to use a hardware key like a yubikey.
| If your platform supports #1, most sites _should_ support user
| management of a set of appropriate authentication mechanisms,
| and may even prompt on a windows desktop "would you like to use
| Windows Hello to sign in more quickly in the future?"
|
| A version of Windows has support for #2 might let you instead
| have that credential be added to every windows desktop or
| laptop on your account.
|
| Due to the variability of Linux, my suspicion is that each
| browser will fill some of the gaps there as well.
| akomtu wrote:
| So a remotely controlled device built primarily for surveillance
| of the end user is going to have access to all your passwords.
| Wonderful idea.
| [deleted]
| autoexec wrote:
| Cell phones cannot be secured or trusted. You have no access to
| secure them either. Using them for anything private is already a
| terrible idea. This is just one more way for companies to take
| more of your data and insert themselves as a middleman in another
| aspect of your life that they can then control. A "feature" like
| this will only put your security at greater risk.
| kaba0 wrote:
| Mobile phones are orders of magnitudes safer than any desktop
| OS available currently, that's a fact.
| autoexec wrote:
| Not true. Depending on your OS (sorry Windows users) your OS
| isn't collecting your personal data at every opportunity, and
| hopefully doesn't allow 3rd parties to push code to your
| devices without notice to you about what's been changed, and
| without any option for you to opt out of those changes.
|
| You must have zero trust in a device where 3rd parties have
| full access to change whatever they want at any time and for
| any reason without your knowledge or consent. That's not
| happening for the linux server in my closet. It's probably
| happening for the windows 10 system in the living room, and
| it's absolutely the case for the phone next to me.
| kaba0 wrote:
| Safety != privacy at all.
| [deleted]
| OttPeterR wrote:
| While I would rather use a password manager myself to keep
| accounts separate and not reliant on a single big tech account,
| I'm sure your average user would love the convenience of this and
| its overall security benefit would be a positive
| pedro2 wrote:
| Voted for reasonability.
|
| Did you see Demolition Man? What do you think about the
| beginning?
| OttPeterR wrote:
| I haven't seen it but I skimmed the plot on Wikipedia and I
| don't see exactly how it's related - could you elaborate?
| pedro2 wrote:
| The villain is locked in in a room which requires a retinal
| scan from the guard to leave. So he proceeds to stab the
| eye globe of the guard with a pen to be able to unlock the
| door.
|
| As such I tend to prefer cloneable credentials. Everything
| that is unique (cellphone, ...) would imply that access
| credentials could be stolen (as in, actually stolen, not
| copied), which could imply the threat of violence to
| succeed.
| filoleg wrote:
| I would much rather someone attempt to steal my phone
| irl, as opposed to someone on the other side of the globe
| cloning my method of accessing my accounts without me
| even being aware until it's too late.
|
| To clarify, this wasn't meant as an attempt at a "tough
| guy" acting. If someone tries to coerce my phone out of
| me irl by threats of violence, they will get the phone.
| But this being done irl at least has much easier path to
| being able to trace the criminal, actually prosecute
| them, and to minimize the damage to my accounts.
|
| Not even mentioning that it is much more risky for them
| to attempt, given it would have to be done somewhere
| around a public place with other people and law
| enforcement around. Meanwhile, some guy from an eastern
| european country cloning my access credentials to
| compromise my accounts will almost certainly never be
| traced, and 100% won't get prosecuted (and that's on top
| of me not being able to be aware of that happening until
| after the fact).
| xeeeeeeeeeeenu wrote:
| >on a single big tech account,
|
| And those big tech companies are free to lock you out from your
| account for no reason with no recourse.
| OttPeterR wrote:
| Yeah it's definitely not for me, but for your average user
| who isn't tech savvy and uses the same password for
| everything: this is an improvement
| BruiseLee wrote:
| Being locked out is an improvement?
| jlund-molfese wrote:
| It's much more likely for the average user to forget
| their password than have their account banned
| deliberately. This would, overall, reduce friction when
| logging in.
| tempodox wrote:
| ... and consumer protection regulation may never arrive,
| while the feudal digital fiefdoms gain ever more power.
| Krisjohn wrote:
| I had two phones fail in quick succession and I nearly lost all
| my MFA. This is not the way to move forward.
| pedro2 wrote:
| Please don't. I saw Demolition Man.
|
| Just let Password Managers do their job easily.
| _fat_santa wrote:
| The problem isn't folks like us that use password managers. The
| problem is all the other folks that have the same 8 character
| password they reuse across all their services.
| signal11 wrote:
| Regular people also have their phones stolen, lost, damaged
| or bricked on a regular basis. I suspect passwords will
| remain as a backup mechanism for a while.
| Ekaros wrote:
| Also funnily enough most recovery mechanisms are tied to
| that same phone... And then what happens when they don't
| update their device every 2 years like good consumers and
| there is some massive vulnerability...
| Wowfunhappy wrote:
| So please stop bothering the people who did the right thing
| by setting up a password manager!
|
| There's an easy way to make passwords usable only by people
| with password managers: instead of letting the user set a
| password, generate it for them.
| notreallyserio wrote:
| What about Demolition Man are you referring to?
| sgc wrote:
| I have literally had financial institutions reject my password
| for being "too long" or containing "wrong special characters".
|
| Quite recently, my bank site was having a fit and I couldn't log
| in, with only cryptic errors. The first line of help didn't
| understand a thing and wrote back to IT to find out more.
| Apparently if you don't hand type / PW manager autotype your
| password, you are a hacker now; they are actively hostile towards
| PW managers. Great yet incomprehensible way to push people
| towards bad passwords. This was at a small bank that uses third
| party software, also used at another small bank I use. So it will
| have propagated to who knows where overnight.
|
| Now we want to get rid of passwords altogether, so phishing is a
| simple as [remotely] watching someone distracted unlocking their
| phone in the coffee shop, and there is a good chance you can get
| them to swipe right when they should go left. Idiocracy.
| lifeisstillgood wrote:
| I need to get past the press releases and read up, but is this
| using my phone to authenticate to an IDp (ie google) who then oks
| me with the relying party (example.com) or am I directly signing
| up with example.com (ie my phone has a key pair in its secure
| enclave for google only, for for hundreds of sites I visit
|
| (from memory this will need much bigger storage in the secure
| enclaves - thousands of accounts is quite feasible)
| scott00 wrote:
| You sign up directly with the relying party and are
| authenticating to a hardware device which then OKs you to the
| relying party. Each relying party gets a different public key.
| The corresponding private keys can be stored inside the secure
| enclave (this setup is called resident keys), or they can be
| stored in a "key handle" that the relying party stores and
| provides every time you attempt a login. The key handle would
| contain the service-specific private key encrypted with a key
| held inside the secure enclave.
| techsin101 wrote:
| I have lost my phone 3 times and countless times I needed to
| login and my phone battery had just died. Also I don't want to
| safeguard my phone like my life depends on it. Imagine cops get
| your phone and boom 99% access to everything you have got online.
| charliea0 wrote:
| This would have an interesting potential to cut down on password
| sharing for subscription services like Netflix, Amazon prime,
| etc.
|
| I think it would be more annoying to call a friend to confirm an
| authentication on their phone than it is to write down a text
| password.
| xeromal wrote:
| Or an EX-friend or partner.
| LinuxBender wrote:
| I can only speak for myself and my own personal preferences but I
| will not do business with anyone that requires this. I've been
| cutting ties with businesses that have intrusive practices. I
| have also been migrating to a bank that gave me the option to
| make everything online read-only. The only remaining business is
| Amazon but I have recently found a local business that will drive
| into a big city once a week to transport items from big box
| stores so maybe I can nix Amazon at some point. I am in a very
| remote area. My personal goal is to reach a point where I can
| power off my flip phone and leave it in a drawer for months at a
| time.
| joshyeager wrote:
| I understand that passwordless auth is better UX. But it seems
| like a step backwards in security from two factor authentication.
| Why are all these major players pushing passwordless auth but not
| allowing a password in conjunction with a FIDO2 token? I feel
| like I'm missing some important detail.
| scott00 wrote:
| The missing important details: for reasons I do not completely
| understand, FIDO uses very non-obvious definitions of the words
| password and PIN. To them a password is a text string provided
| to an online service for authentication purposes and a PIN is a
| text string provided to a physically near hardware device to
| authenticate to that hardware device, after which that hardware
| device can sign challenges that can be used to authenticate to
| an online service. When they talk about passwordless they are
| not precluding the use of a PIN. The PIN gets you your second
| factor without being stored on a bunch of different services,
| and with hardware assisted protection from exfiltration and
| brute force cracking.
|
| Relying parties (aka online services using FIDO protocols) have
| a lot of freedom to define exactly how restrictive they want to
| be by making choices about which devices they accept. Through
| choosing which devices they accept they can choose to require
| any combination of token, PIN, biometric, and password.
| MrStonedOne wrote:
| >Relying parties (aka online services using FIDO protocols)
| have a lot of freedom to define exactly how restrictive they
| want to be by making choices about which devices they accept.
|
| This, in my view, is the problem with FIDO.
|
| They shouldn't be able to make that choice.
| joshyeager wrote:
| Thanks, that is helpful! You're right that terminology is
| confusing.
| fauigerzigerk wrote:
| In what sense is this passwordless?
| dymk wrote:
| A password is something you can remember with just your
| memory, a hardware token is a physical object you need to
| have to use (and can be lost).
| fauigerzigerk wrote:
| So does this system not require that I set a password for
| my account?
|
| Everything I have read about this approach seems to imply
| that passwords are still used, only perhaps not as often.
|
| For instance, there's this quote from the article:
|
| _" Bellovin and others say one potentially tricky scenario
| in this new passwordless authentication scheme is what
| happens when someone loses their mobile device, or their
| phone breaks and they can't recall their iCloud password."_
| aristus wrote:
| Once you use them as the gatekeeper for auth ans identity, it
| becomes that much harder to delete that Facebook or switch
| phone brands. Not to mention _much_ deeper insight into your
| activity everywhere.
| frankharv wrote:
| >> Not to mention much deeper insight into your activity
| everywhere. This is the worrisome part for me.
|
| I still use a flip phone and don't want apps. I want a phone
| only.
| badrabbit wrote:
| There needs to be a law that forbids mandating cellphones and
| creditcards for ordinary business transactions. My apartment
| started requiring an app to enter the premises and use another
| app so wash and dry your cloth and then required an app to enter
| the place you wash your cloth. I came home one day after a series
| of missed and delayed flights, tired and sleepy at 3am after
| waiting eons for uber at the airport when my phone finally died
| and at 3am I could not enter my own apartment because my phone
| was dead and there is no one else at that time to open the hate
| for me.
|
| In these cases, technology is creating not solving problems.
|
| Ask yourself this: As great as smartphones are, do you want a
| future where everyone is required to purchase one, an a cell plan
| to exist in society, to engage in commerce, enjoy shelter, health
| care and security?
|
| I would even go so far as to say cash and physical paper should
| be supported by any business and government department.
| userbinator wrote:
| _I would even go so far as to say cash and physical paper
| should be supported by any business and government department._
|
| I believe there's laws in some states that require cash to be
| accepted.
| mperham wrote:
| It's a Federal law and written on every bill, "this note is
| legal tender for all debts, public and private."
| bombcar wrote:
| That pertains to debts - it's legal to have credit/debit
| only stores; you see them at times.
| theamk wrote:
| This is unusually, and I agree with you: I hope it never
| catches on.
|
| That said, my previous workplace has offered entrance with
| cellphone, as well as entrance by regular key fob. Over time, I
| have seen people switch more and more to cellphone method, and
| either returning the keyfobs or leaving them at home.
|
| Also, a nitpick: you don't necessarily have to purchase a cell
| plan for your phone. For example the scheme discussed in the
| article will work over WiFi just fine. And if you are in front
| of your computer trying to login, the chances are, you have
| WiFi as well. So while old cellphone is less convenient that
| keyfob (needs charging, bigger, heavier), it is still pretty
| usable.
| FinnKuhn wrote:
| I think many people enjoy the option of using their phone,
| but don't like that they HAVE to use it. For example for most
| occasions you have your phone on you, but for example when it
| is broken or empty not having an alternative would be really
| annoying.
| idle_zealot wrote:
| > Ask yourself this: As great as smartphones are, do you want a
| future where everyone is required to purchase one, an a cell
| plan to exist in society, to engage in commerce, enjoy shelter,
| health care and security?
|
| I'd be fine with this, so long as there's a safety net of some
| sort to provide cheap/used phones to anyone who now needs one.
| Computers make lots of things easier, and forcing every
| business to accommodate the additional complexity of non-
| electronic access sounds like a bad idea.
|
| That said, I do agree that something should be done about "use
| this app to open your apartment door" and "use this app to do
| your laundry". I think the emphasis should be on
| interoperability. So you as a business can't require the use of
| a specific piece of software, but you can specify a protocol,
| preferably one that's already in use.
|
| As for "my phone lost charge at 3am and I got locked out". I
| see this as equivalent to "I lost my keys at 3am and got locked
| out"; unfortunate, but ultimately either your fault or bad
| luck. Time to call a locksmith (or digital equivalent, a
| hacker?).
| em-bee wrote:
| ugh, no. an out of power phone is not the same thing as lost
| keys. in decades of traveling i never once lost my keys, but
| my phone is out of power almost every time after i spend a
| day away from home or office.
| idle_zealot wrote:
| If you knew that you needed phone charge to enter your
| apartment I bet you'd bring a spare battery pack when you
| went out. You could fit in the space you save by not
| needing keys!
| ajsnigrutin wrote:
| So instead of one tiny key, you need a powerbank, that
| you must also recharge and replace every few years.
|
| What if you drop the phone and break the screen?
| alcover wrote:
| > If you knew that you needed phone charge to enter your
| apartment I bet you'd bring a spare battery pack when you
| went out.
|
| I don't even.. what the hell.. _UBIK_ is a fiction, not a
| desirable lifestyle. Your sentence is the stuff of tech-
| nightmares.
|
| Re-read please out loud :
|
| " _If you knew that you needed phone charge to enter your
| apartment I bet you 'd bring a spare battery pack when
| you went out._"
| nine_k wrote:
| Have you tried carrying a power bank with you on longer
| travels?
| imwillofficial wrote:
| That's not the point. No matter what prep you make, the
| question of "do we really want to rely so much on new
| tech to run everything in our life?" Is a valid question.
| ratww wrote:
| _> Time to call a locksmith (or digital equivalent, a
| hacker?)._
|
| Kinda hard to with a phone that's out of charge...
| imwillofficial wrote:
| Imagine hackers of the future cyber dystopia being simple
| locksmiths for broken tech.
| Kim_Bruning wrote:
| Seeing how often I've needed to crack some customer's
| mail client or wifi, or etc ... [*] I think we're already
| mostly there. (Though it's not always a dark and stormy
| night)
|
| [*] Obviously after confirming it's really theirs and/or
| they have the requisite authority. The usual disclaimers
| apply.
| beezle wrote:
| Let us not forget how all so secure cell phones are!
|
| I had a broker request a switch from a printed card with
| challenge responses to a cell phone based system. Rejected with
| prejudice. Never ever will I do banking or trading with a cell
| phone.
| twobitshifter wrote:
| We all remember when facebook.com became unreachable and they
| had to use a saw to get to the server? Buildings couldn't be
| accessed, phone calls couldn't be made, and emails couldn't be
| sent because facebook.com was unreachable. That was just a DNS
| problem, imagine that happening everywhere.
| bombcar wrote:
| Automated systems like that should at least have a qi charger
| built in - so worst case you can jumpstart your phone.
| ryukafalz wrote:
| > Ask yourself this: As great as smartphones are, do you want a
| future where everyone is required to purchase one, an a cell
| plan to exist in society, to engage in commerce, enjoy shelter,
| health care and security?
|
| No, I don't. So it's a good thing you can already use FIDO
| authentication without a phone using e.g. a Yubikey!
| [deleted]
| mellavora wrote:
| even if your apartment doesn\t support it?
| dwaite wrote:
| Apartment?
|
| FIDO security keys connect over USB or NFC to authenticate
| into a computer. There have not been much successes using
| them for physical access.
| bryanrasmussen wrote:
| The parent poster that ryukafalz replied to had an
| anecdote regarding being locked out of their apartment
| because their cellphone died, that was the essential
| cause of their antipathy, and the quoted text mentioned
| 'enjoy shelter' as one of the things you might need a
| cellphone to purchase in the dystopian future.
| another_story wrote:
| This exists in China right now. You need a phone to show you've
| not been in close contact with covid cases. Many places only
| accept WeChat/Alipay for payment. A phone is a necessity.
| userbinator wrote:
| China, the ultimate authoritarian dystopia --- definitely
| something we should be taking lessons from, i.e. in order to
| _not_ go in that direction.
| pessimizer wrote:
| > As great as smartphones are, do you want a future where
| everyone is required to purchase one, an a cell plan to exist
| in society, to engage in commerce, enjoy shelter, health care
| and security?
|
| It's an even more dire question: do you want a future where
| you're required to carry that cellphone on your person at all
| times?
|
| And for the slippery slope: do you want a future where it's
| legal to arrest people until their phones can be verified? To
| prevent impersonation, maybe chip people like dogs so that they
| can be reliably matched to their phones, and make it a crime
| (maybe "attempted impersonation") to tamper with the chip or to
| help someone tamper with the chip?
| xg15 wrote:
| Adding to that, smartphones can also be extremely
| distracting. If you'll be effectively unable to put away your
| phone for longer periods of time because almost everything
| requires that you interact with it, that can't be good for
| your mental health.
| imwillofficial wrote:
| Recent times have shown that the slippery slope is more often
| rule, than fallacy.
| JumpCrisscross wrote:
| > _do you want a future where everyone is required to purchase
| one, an a cell plan to exist in society, to engage in commerce,
| enjoy shelter, health care and security?_
|
| This seems like a slippery slope argument. Almost everyone
| purchasing these products has a phone and service. Cash is
| expensive to accept. (And makes zero sense for online-only
| services, which a cash-mandating law incentivises.)
| daenz wrote:
| Everyone having a phone already is orthogonal to whether or
| not it is a good idea to require phones to function in
| society.
|
| I don't see it as a slippery slope argument because almost
| everything will eventually move to being online-based, and if
| "having a phone" becomes the standard for authN, then someone
| without a phone is excluded from participating in all of
| those things.
| mortenjorck wrote:
| It's amazing how quickly Golden Krishna's TED-circuit profile
| faded and everyone forgot the critical UX lesson that he built
| his brand on: The best UI is no UI. The corollary being that if
| a one-step action now requires you to unlock your phone, you've
| added at least one additional step (probably more) and your
| "smart" IoT solution is a downgrade, not an upgrade.
| zeroonetwothree wrote:
| Just because you don't like something doesn't mean it should be
| illegal.
| ttGpN5Nde3pK wrote:
| > My apartment started requiring an app to enter the premises
| and use another app so wash and dry your cloth and then
| required an app to enter the place you wash your cloth.
|
| This shit has got to stop. I ran into similar doing a
| mortgage... They "only accepted the escrow payment through
| ${RANDOM_APP}." Yea right, y'all can take a check, and they
| did.
|
| I'm quite sure _all_ the app does is process the
| payment.:rolleyes: /s No way they collect/sell any info I send
| through it. Oh, and I'm sure they'll be super upfront whenever
| their database that my info sits in for eternity with
| 'admin:admin' protecting it gets popped.
| paulbjensen wrote:
| This is potentially a bad idea, and I can explain an actual use
| case that happened a few weeks ago.
|
| My neighbour had dropped her phone in some water, it was a
| Samsung S21, and the screen was messed up. The moment you tried
| to activate the screen, lines would appear across it. It was
| unusable.
|
| Thankfully she had a spare phone available to use, but she needed
| to get a bunch of things setup on there (Google Mail, NHS for the
| Covid pass as she was travelling abroad).
|
| She ran into an issue authenticating her Google Mail account -
| the password. She didn't remember it, so we tried the "Forgot
| Password" user flow.
|
| For reasons unknown, the user flow insisted on sending a
| notification to her Samsung S21, even though we had swapped the
| SIM card from that phone into the new phone, and we had no way to
| swipe the notification on the S21 due to the screen being broke.
|
| Somehow, we managed to trigger sending a text message with a
| code, and thankfully she got access to her Gmail account and
| other items.
|
| But it was not a simple process, and there's no way your everyday
| person would have a clue how to deal with such cases (it
| confounded me and I'm a developer!), so I hope that someone with
| UX and QA chops is able to cater for scenarios like someone's
| phone screen being busted and knows how to provide alternative
| options that your everyday folk can get to grips with.
| thetinguy wrote:
| Just turn the phone off. That's what Apple has you do when you
| need to turn off Find My iPhone but your phone is on and unable
| to be used. Even without the sim the device is still trusted,
| and as long as it's connected to the internet it will try to
| authenticate with it. Also trusted contacts are also now a
| thing. https://support.apple.com/en-us/HT212515
| throwaquestion5 wrote:
| Gotta love HN. OP talks about phone useflows that in "no way
| your everyday person would have a clue how to deal with such
| cases" on a Samsung phone. They get a reply about a hack
| about apple phones when unusable.
|
| You do notice the irony, right?
| FinnKuhn wrote:
| While it isn't helpful for this person, I'm happy that I
| read it so at least I know the "correct" solution to this
| problem now should I ever encounter it.
| marssaxman wrote:
| This is one of those ideas which is completely the opposite of
| the way I want to do things, but which will probably gain enough
| traction that I'll be forced to accommodate it after several
| years of frustration, grumbling, and workarounds.
| daenz wrote:
| I can see that perspective, but I don't think that will happen.
| Companies jump at any chance to steal each others customers, so
| the necessity threshold has to be very high for something like
| this to be adopted across the board.
| andi999 wrote:
| Is this tied to the phone or to the phone number. This makes a
| difference if the phone dies or gets lost.
| korginator wrote:
| I feel this approach has the potential to increase the number of
| successful attacks. According to the article, users would merely
| need to unlock their phones to complete the sign-in process.
|
| Most people tend to automatically unlock their phones without a
| second thought.
| OttPeterR wrote:
| I imagine there would be a prompt of "are you trying to log
| into <website>?" and the user would have to confirm
| taeric wrote:
| I find i accidentally unlock my phone in my pocket all the dang
| time. Is annoying how easy it is to do. :(
| rahidz wrote:
| At least in the US, the 5th amendment protects against revealing
| our passwords to the government (and we can always go with "I
| forgot what it was"). I don't believe the same is true for
| biometrics and such, is it?
| Riverheart wrote:
| Biometrics and physical tokens are not protected
| Klasiaster wrote:
| The main problem I see (based on the screenshot in the article)
| is that it still allows the attacker to initiate the auth flow
| from the outside, and the clueless user would in doubt just
| unlock for them. I don't see how the proposed scheme would
| prevent this phishing attack. It seems to be worse than the SMS
| 2FA part where one would at least have to enter the SMS code into
| some suspicious website.
|
| My method of choice would rather have been what is established
| now for 2FA with time-based one-time passwords (TOTP). Here the
| attacker can't initiate the auth flow from the outside.
| Ekaros wrote:
| I'm already in the auth approval hell working as consultant
| with multiple separate corporate customer and all the 2fa
| authentications needed in my daily activities. Including fun
| broken flows that mean I get notification that I don't even
| need, because I need to use different account...
|
| In the end this likely only leads to training people to
| automatically approve anything as every little piece of
| software on their machines needs approval once a day or more
| often at worst...
| scott00 wrote:
| I think that for the cases where you're authenticating on one
| device in order to allow access on another device, this is done
| by bluetooth communication between the devices, and as a result
| you have to be within bluetooth range of the auth device to
| initiate the auth flow.
| ninjin-carh wrote:
| I love the convenience but this will lock people to either iOS or
| Android.
|
| Next year: EU government force big tech phone OS manufacturers to
| enable identity portability
| JustFinishedBSG wrote:
| > I love the convenience but this will lock people to either
| iOS or Android.
|
| FIDO2 is an open standard, you can use security keys or TPMs or
| whatever you want.
| anothernewdude wrote:
| So back to single-factor then?
| QuantumSeed wrote:
| Wonder what these means for those folks who find smartphones too
| confusing and difficult to use. I have a couple of friends in
| their late 70's who simply can't use them; I fear they will be
| left behind.
| sokoloff wrote:
| To some extent, they are probably already being left behind;
| it's just that it's a more gradual thing than if smartphone
| becomes a hard blocker to a something that's essential in life.
| Bilal_io wrote:
| When I first heard about FICO, I thought I'd be a standard that a
| password manager can take advantage of, where they can identify
| me using my phone, then autofill my credentials. Maybe not very
| practical. But when I learned that the purpose of FICO was to
| replace passwords and rely on a tech giant to allow/deny me
| access to my online accounts, I was disappointed. No thank you.
| throwawaymanbot wrote:
| teeray wrote:
| This is an awfully complicated way to force people to stop using
| the same crappy password on every website.
| r_klancer wrote:
| I'd be a bit worried about this from a digital hygiene
| standpoint: the default device for storing your passkey will be
| your phone, and every unlock is temptation to get sucked into the
| world of notifications and social apps.
|
| Fortunately it looks like security keys such as
| https://cloud.google.com/titan-security-key can be used instead.
| boplicity wrote:
| It's really, really bad digital hygeine to use social media
| apps - anything with "doom scrolling" - on the phone at all. I
| don't think most people agree with that, but if you eliminate
| all such things on your phone, it can be no problem to open a
| phone and use it.
|
| I don't check email on my phone, unless I absolutely have to. I
| don't have any social media on it except for signal. I don't
| open the web browser. My phone is mostly used for maps, reading
| books, and video chatting.
|
| I look forward to a world where people genuinely view social
| apps and related addictive software the way we do harmful
| drugs. Something to be avoided, and if you can't avoid them,
| there should be pressure to seek help.
| amelius wrote:
| Will the EU allow it?
| eulers_secret wrote:
| I hope there's a FOSS way to manage my FIDO2 login tokens.
|
| As long as there's a command-line app that I can use instead of
| my phone (which I will _never_ do), I'm good with this!
|
| I'd be willing to help develop such an app.
| e2le wrote:
| There are a number of FOSS solutions.
|
| - https://github.com/google/OpenSK <- DIY solution
|
| - https://solokeys.com/
|
| - https://www.nitrokey.com/
|
| The issue with any FOSS solution is that FIDO requires an
| attestation private key, which must be shared between a batch
| of at least 100,000 security keys. Using a DIY or cli app
| solution (application running on the host) will likely mean
| you'll be generating that private key yourself, this makes you
| identifiable across registrations.
|
| Some sites (Cloudflare) may reject the use of attestation keys
| which are not found on the Fido Alliance Metadata Service. This
| precludes the use of any DIY solution.
|
| https://fidoalliance.org/metadata/
|
| https://support.cloudflare.com/hc/en-us/articles/44068890480...
| Jimmy wrote:
| I simply won't use any service that requires a phone and doesn't
| allow other options. I am opposed to a future in which phones are
| a necessity of life rather than merely a convenience.
|
| And to the people who say "but desktops/laptops are already a
| necessity of life" - yes, and that's a problem. We need to be
| actively thinking of ways to roll things back, rather than
| allowing technology to become more and more integrated into life.
| mistrial9 wrote:
| _strongly agree_
| tjr225 wrote:
| What if I lose my phone or forget it at home? Can I no longer
| do my personal banking on my laptop or workstation?
| ghaff wrote:
| That's true today if you use a password manager, no? And it's
| true of any site that uses 2FA (unless the site supports
| multiple authenticators and you have a backup token).
| xyzzy_plugh wrote:
| My password manager is accessible on my other computers, so
| no it's not true today.
| bartchamdo wrote:
| The better analogy if your driver's license/ID it
| passport. If you leave these, you likely can't travel or
| be admitted into specific establishments, etc.
| ghaff wrote:
| Ever since I somehow managed to lose my driver's license
| between the private car that dropped me off at the
| airport and the door to the airport, I always use another
| government ID I don't actually need for anything (Global
| Entry) while going through security.
|
| I also usually carry my passport as a backup though that
| probably won't work if I need to rent car--and on that
| particular trip it was a last minute overnighter so I
| didn't throw in my backup documents and cards folder. It
| took me about half an hour to convince the hotel to let
| me check in.
|
| In general, I hate traveling with things that you really
| can't afford to lose and can only mitigate against loss
| to some degree.
| e2le wrote:
| > In general, I hate traveling with things that you
| really can't afford to lose and can only mitigate against
| loss to some degree.
|
| This could be resolved using a FIDO enabled NFC sub-
| dermal implant.
| Wowfunhappy wrote:
| So now I'm modifying my body in order to use the
| internet?
| e2le wrote:
| Why not? If they're made cheap enough for everyone to
| use, it provides greater security over other methods.
| BiteCode_dev wrote:
| Identification systems on computers are already abused to
| extremes. There is no way a putting a identifiction
| system inside your body is not going to result in
| tremendous abuses on the long run, with much more
| terrible social consequences since it will be linked to
| individuals and hard to disable or remove.
|
| The simple fact there no guaranty of safety that can be
| made about such a system despite its obvious consequences
| about tracking, power and control should alone be a red
| flag.
|
| When I read such a comment, I can't help but think school
| should make kids read more science fiction. Many authors
| covered why something like this is a dangerous idea.
|
| I'd go even farther, but I would reach the Goodwin point.
| Wowfunhappy wrote:
| But it's _always_ possible to get a new passport, even if
| you 've lost every other type of identification. What
| happens if I loose my Yubikey and all of my backup codes?
| ghaff wrote:
| As noted in the article, it's a tough problem. The easier
| you make account recovery the easier you make attacking
| those recovery methods.
| Wowfunhappy wrote:
| It so happens that I have a great solution to this tough
| problem, which has served me well for years.
|
| I have a password manager, protected by a strong, unique,
| randomly-generated master password that I took the time
| to commit to memory. I cannot ever loose this password,
| and as long as I have it, I can get into my vault. As
| long as I can get into my vault, I have access to my
| other passwords.
|
| An increasing number of web services have decided this is
| insecure, and are forcing me to use secondary devices in
| order to authenticate myself. This does very little to
| increase my security, while putting me at risk of getting
| locked out of essential resources.
|
| I'm all for alternate options, but please don't take this
| setup away from me!
| idle_zealot wrote:
| I strongly disagree. Personal computers are here to stay, and
| will only become more integrated into daily life due to the
| conveniences they afford. The fight now isn't to keep computing
| out of daily life. Rather, we ought to be fighting to ensure
| that people have control over the computers in their lives.
|
| There are two ways this ends up:
|
| The future where everyone has to carry around a black box
| computing device controlled by its manufacturer and the
| privileged creators of the apps you've been allowed or
| compelled to install on it. The present state of iPads/iPhones
| and to a lesser extent Android phones make this future feel
| incredibly close.
|
| But the future where everyone carries around an incredible
| communication and calculation tool that acts as an agent for
| them and expands every individual's capabilities feels only
| just slightly out of reach.
|
| The line dividing the two futures is thin and technical in
| nature. This leaves us with a tricky situation where most
| people wouldn't be able to distinguish which they're headed
| towards, or even which they're living in. All I can do is hope
| that either legal tides go my way and grant users control over
| their computers (phones) by force, or that somehow tech
| literacy rises and people demand control.
| OJFord wrote:
| I think you need to define personal compute as including
| mobile phones/tables for that to be true. I've had several
| even highly technical colleagues with no non-work 'computer'
| - they use an iPad or whatever, because that's sufficient for
| their non-work use of one.
| idle_zealot wrote:
| I didn't realize that my usage if the term was unclear, but
| to clarify: an iPad is a personal computer. A smartphone is
| a personal computer. Even modern game consoles are personal
| computers. They're all general-purpose computers owned by
| an individual. However, they have software locks placed on
| them that prevent their owners from controlling them. In
| the post above when I'm talking about personal computers
| that we carry around I primarily mean phones. I will update
| the post to clarify.
| Jimmy wrote:
| I don't really disagree. I'm not a luddite and I don't
| advocate for turning off the internet. Computers are
| certainly here to stay. It's an extremely complex issue, and
| I don't have all the answers, or even know how to phrase all
| the questions.
|
| I do think society needs to take a proactive role in deciding
| how it wants to interact with technology though. There's a
| certain laissez faire, almost defeatist attitude that you see
| from a lot of the tech crowd, that goes something like
| "technology will do what it does, and it will change our
| lives how it sees fit, and we are powerless to stop it." But
| if that was the case, we couldn't have gun control laws, or
| environmental protection laws, or restrictions on nuclear
| technology. Technology may continue to develop, but it's
| still up to us how we choose to use it.
| idle_zealot wrote:
| > technology will do what it does, and it will change our
| lives how it sees fit, and we are powerless to stop it
|
| I too see this attitude from technical people. To be clear:
| I do not hold it. Like you say, I favor regulation in the
| vein of gun control, environmental protection, etc. Left
| alone the tech market will consolidate and rob users of as
| much power as possible; it is simply the most profitable
| way of doing business.
|
| To be more specific: I am a proponent of bills like S.2710
| - Open App Markets Act
| (https://www.congress.gov/bill/117th-congress/senate-
| bill/271...), which among other things requires operating
| systems to "... allow and provide readily accessible means
| for users of that operating system to ... install third-
| party apps or app stores through means other than its app
| store". Though I would also want additional provisions,
| like not allowing OSes to reserve special privileges for
| first-party or blessed third-party apps, eg iOS restricts
| third-party apps from running JIT code, preventing browser
| competition on the platform.
| pessimizer wrote:
| There's absolutely nothing technical about this. It's
| entirely political, there's no technology that needs to be
| developed for this. All you have to do is create laws (or
| allow monopolies and cartels to impose "standards") that
| require people to carry their cellphones at all times. Make
| physical doorknobs illegal (as a security threat, and lack of
| accessibility for the disabled.) Done.
|
| You don't even need cellphones. Just issue people hard to
| forge documentation and set up checkpoints. It's the
| difference between a fence and a shock collar.
|
| Your dream seems to be to set up the infrastructure for
| universal command and control, then expect it to choose to
| regulate itself.
| idle_zealot wrote:
| > Your dream seems to be to set up the infrastructure for
| universal command and control, then expect it to choose to
| regulate itself.
|
| I don't think I said anything of the sort. Just because
| something is electronic doesn't mean it's centralized and
| restrictive. My dream is one where technology is an
| empowering tool accessible to anyone and I'm all for
| regulation to prevent monopolies or cartels from imposing
| self-serving "standards" that block out competitors and
| force people into walled gardens. You seem mostly concerned
| about authoritarianism. I propose that so long as users are
| in control of their computers then computer ownership will
| have a net-positive impact on general freedom. If users do
| not control their computers then they will have a net-
| negative impact on freedom. So the crucial aspect is not
| whether or not phones/computers become required for daily
| life, but whether users have control over them.
| roywashere wrote:
| The article does not fully explain it, but the proposal is
| about using FIDO to sign in to services. The article simplifies
| this as signing in by unlocking your phone, but that is just
| one way to do FIDO (and possibly the most common way). If you
| prefer not to use your phone, you can also use a YubiKey or
| similar on your desktop/laptop; pushing FIDO as a standard
| would probably make it possible to use a YubiKey with much more
| services than today!
| autoexec wrote:
| FIDO weakens security by limiting authentication to just
| something you have (a device/USB token) and something you are
| (biometrics) while throwing out the requirement for something
| you know (a password). Something you have can be easily
| stolen, and biometrics cannot be kept secret, can be forged,
| and can't be reset/changed once compromised.
|
| Having something you know (a password) is more secure because
| something in your memory that you don't share can't be taken
| from you by any means. Passwords aren't perfect (you can be
| tricked into sharing it, or tortured into giving it up) but
| there are solutions for being forced to hand over a password,
| and neither tokens or biometrics solve the problem of people
| being tricked.
|
| No one can murder you in an alley, and drag your lifeless
| corpse to an ATM and clean out your bank account because the
| murderers have your face, and fingerprints, even your cell
| phone, but not your pin. Good security should always require
| a secret that you know.
|
| Not having a password would be fine for logging into low risk
| sites like this website, where at worst someone might get
| your account banned or post comments under your username, but
| any site or transaction where the risk is greater should just
| always require a password.
| jjulius wrote:
| Preface: I've been busy as shit this week and haven't
| really read up on FIDO. I don't know that I have a position
| on it yet.
|
| > Something you have can be easily stolen, and biometrics
| cannot be kept secret, can be forged, and can't be
| reset/changed once compromised.
|
| Something you have can easily be stolen _as long as someone
| is able to access it_. Someone on the other side of the
| world is not going to be able to steal your USB token from
| the comfort of their own bedroom, just as they 're unlikely
| to get your biometrics.
|
| A password exists in your memory, yes, but it also exists
| in the databases of untold numbers of corporations, each
| with different levels of security, and at least some of
| those corporations duplicate copies of those databases
| across different data centers throughout the world. These
| databases can essentially be accessed by anyone, anywhere.
|
| I understand what you're saying, but you're forgetting that
| passwords, by nature, have to exist somewhere other than
| your head, guarded by someone other than you.
| epistasis wrote:
| FIDO is quite old, and a huuuuuuuge upgrade over a
| password based system in terms of both security and in
| terms of user convenience.
|
| It feels weird to encounter resistance to FIDO on HN of
| all places. The biggest complaint about FIDO is that is
| has rolled out to slowly, not that it is in any way
| inferior to our horrendously insecure web dozens of
| accounts secured by a weak human memorizable password, or
| worse reused passwords.
| idle_zealot wrote:
| > A password exists in your memory, yes, but it also
| exists in the databases of untold numbers of
| corporations, each with different levels of security
|
| > passwords, by nature, have to exist somewhere other
| than your head, guarded by someone other than you.
|
| What? That's simply not true. Passwords are only stored
| in your head and anywhere you explicitly write them down
| for safekeeping (like a password manager). Services _do
| not_ need a copy to validate your password, and _should
| never_ store one. They only need a salted hash to confirm
| if the password you input was correct. Such a hash is
| irreversible without an attacker randomly guessing your
| password through brute force, which is beyond impractical
| for any decent password.
| jjulius wrote:
| I stand corrected on some of my phrasing, thank you for
| the correction. However...
|
| >Services _do not_ need a copy to validate your password,
| and _should never_ store one.
|
| "Do not need" and "should" are the key words here. Users
| don't know how a site stores passwords, we have to trust
| them to use strong encryption when it comes to hashing,
| and to not store it in plaintext.
| idle_zealot wrote:
| Users don't know how a site implements FIDO either.
|
| With any authentication system you do have to trust the
| server you're accessing to identify you correctly. Take
| FIDO: sure, in theory someone would have to be close to
| you to steal the "thing you have", but if the service
| you're authenticating with doesn't implement the protocol
| properly or is hacked, then attackers may be able to
| access your account without being anywhere near you.
|
| All authentication schemes offer benefits only if
| implemented correctly.
| autoexec wrote:
| > Something you have can easily be stolen as long as
| someone is able to access it. Someone on the other side
| of the world is not going to be able to steal your USB
| token from the comfort of their own bedroom, just as
| they're unlikely to get your biometrics.
|
| True, and better security systems take advantage of that
| by combing all three. For me to log into work I have to
| use a password (what I know), use a hardware token (what
| I have), and be logging in from a location where they'll
| expect me to be (what I am). All of those things have
| their flaws, but the odds of someone managing to pull off
| all three are much less likely.
|
| As the use of biometrics increases we'll see more
| examples of that data being collected stolen and and
| shared around the world. Right now, it's not used often
| enough for criminals to bother passing around scans of
| your fingerprints, or photos used to spoof facial
| recognition, but it's bound to happen.
|
| > I understand what you're saying, but you're forgetting
| that passwords, by nature, have to exist somewhere other
| than your head, guarded by someone other than you.
|
| As others have said, they shouldn't. We have to expect
| failures and breeches, which is why it's so important
| that we have those other two pillars to fall back on when
| "what we know" fails us.
| JumpCrisscross wrote:
| > _better security systems take advantage of that by
| combing all three. For me to log into work I have to use
| a password (what I know), use a hardware token (what I
| have), and be logging in from a location where they 'll
| expect me to be (what I am)._
|
| Perfect is the enemy of the good. FIDO is better than
| just passwords. That's what it's replacing. You can keep
| using triple-factor authentication if you want to.
| autoexec wrote:
| "What you know" provides better protection, made better
| still by requiring something you have and/or something
| you are. FIDO is a combination of weaker protections plus
| added convenience. Its better than passwords in terms of
| being easier.
|
| Perfect is the enemy of the good, and perfect security
| cannot exist. FIDO is perfectly fine for some things. For
| anything actually important and worth protecting it's a
| step in the wrong direction and even worse it's being
| pushed for by groups who want to increase their ability
| to collect your data and control you.
| ryukafalz wrote:
| FIDO with a PIN also involves something you know, with
| the added benefit that the PIN is never sent across the
| internet.
| txcwpalpha wrote:
| >FIDO weakens security by limiting authentication to just
| something you have (a device/USB token) and something you
| are (biometrics) while throwing out the requirement for
| something you know (a password).
|
| Not necessarily. The specific implementation being talked
| about in the article is to use your phone as your FIDO
| device, and your phone has to be unlocked. So the
| "something you have" is your phone, and to unlock it, you
| can either use "something you are" (biometrics via face ID
| or fingerprint), _or_ you can have a PIN /password on your
| phone to make it "something you know".
|
| I wouldn't be surprised (and I would hope) that the FIDO
| app or feature on phones would also come with the ability
| to restrict it via PIN/password even if your phone unlocks
| via biometric.
| ghaff wrote:
| Desktops/laptops aren't a necessity of life for many people. In
| general, I'd say smartphones were a far more universal
| necessity today.
| Jimmy wrote:
| Sorry, that may have been poorly worded. I wanted to preempt
| the objection of "well, you say you don't want to be
| dependent on smartphones, but then you'll just be dependent
| on some other type of computer". I wanted to make it clear
| that the problem is about rethinking our relationship with
| computing in general, not just with smartphones.
| la6472 wrote:
| First thing that comes to my mind is "What happens if your
| phone is suddenly dead"? Will this FIDO alliance guarantee
| alternative means of access or that they will send someone down
| to your house to identify you positively and restore access to
| your online mail and documents?
| Wowfunhappy wrote:
| > "but desktops/laptops are already a necessity of life"
|
| No they're not! You need either a desktop _or_ a laptop _or_ a
| tablet _or_ a smartphone, but you don 't need more than one.
|
| I'm okay living in a world where everyone needs access to some
| type of computer, in the same way that everyone probably needs
| access to some type of writing utensil. However, people should
| be able to choose the form factor that lets them live their
| best life.
| xdennis wrote:
| > I'm okay living in a world where everyone needs access to
| some type of computer
|
| Some people don't want any technology at all. What happens to
| them in your future?
| Wowfunhappy wrote:
| > Some people don't want any technology at all.
|
| That's a shame. They must get very cold in the winter
| without the ability to build a fire.
| ajsnigrutin wrote:
| What tech do you need to build a fire?
| Wowfunhappy wrote:
| A controlled fire is itself a form of technology.
| [deleted]
| msh wrote:
| If you don't want any kind of medical technology it will
| most likely be a rather short future...
| epistasis wrote:
| I'm sure plenty of people would have appreciated never
| having to learn to read to fill out paper forms in the past
| either.
|
| This has gone off on a weird tangent; the article is about
| how a new standard can greatly simplify account passwords,
| the very hardest and frustrating thing about modern life on
| the web.
|
| Changing that into "we shouldn't have any rich if we don't
| want to" is a strange reaction to making tech more
| accessible. But perhaps if one wants to eliminate tech from
| people's lives then making tech as bad and painful as
| possible might be one way to do that; but it seems like a
| foolish way to pursue that goal.
| Wowfunhappy wrote:
| > Changing that into "we shouldn't have any rich if we
| don't want to" is a strange reaction to making tech more
| accessible.
|
| I am 100% in favor of giving people the _option_ to log
| in with their phone instead of a password, if they want
| to. If that 's all the article meant, I stand corrected.
|
| But, I got the impression that the people quoted in the
| article were working to eventually _remove_ passwords as
| a method of authentication. That 's not cool, because it
| requires users to have a secondary device.
|
| I don't think my impression was entirely unreasonable,
| because we're already seeing it in the number of websites
| _forcing_ users to set up two factor authentication. Note
| that many of these so-called "two-factor" solutions
| allow the user to reset their password using only their
| phone (which is what really makes SIM-swapping such a
| problem), which means your password is effectively
| optional, but a phone is required.
| Teever wrote:
| > However, people should be able to choose the form factor
| that lets them live their best life.
|
| Especially when one particular form factor leads to
| surveillance of your location.
| theamk wrote:
| I assume you mean phones?
|
| This is not a form factor result, it's a result of a
| function.
|
| If you want to have internet access without being near
| internet AP, you have to accept surveillance. This applies
| equally to phone, or tablet with SIM card, or laptop with
| external 3G modem.
|
| If you are OK with only accessing internet in specific
| location, you can turn off cell subsystem in your phone --
| this functionality is present in every phone I have seen.
|
| (Same applies to bluetooth, wifi and other ways to track
| device remotely)
| spaniard89277 wrote:
| Mobile phones could be open systems like PCs are. But
| they aren't. So we should oppose this movement to use
| phones for everything until the situation changes.
|
| Not to mention that old people is suffering (at least
| here in Spain) a lot because services push everyone into
| apps etc.
|
| I cancelled my fathers bank account for this very reason
| and moved him to a credit union. It was painful but their
| customer support was so awful that it was worth it.
|
| The last straw was that they told him he couldn't do a
| money transfer from his local office but he had to use a
| mobile app. He called me to help him with that. That got
| me angry.
| Wowfunhappy wrote:
| I agree. However, phones are also uniquely _addictive_ ,
| which IMO is a strong case for dropping them if they
| interfere with your life. We should at least make sure it
| is _possible_ to drop them.
|
| (I don't love using the word "addictive" here because
| phones are not _chemically_ addictive, but any other term
| makes the point less clear.)
| rhn_mk1 wrote:
| > If you want to have internet access without being near
| internet AP, you have to accept surveillance. This
| applies equally to phone, or tablet with SIM card, or
| laptop with external 3G modem.
|
| That is true in practice, but not true in theory. There
| are urban WiFi networks that already operate without
| spying on the users. Nothing prevents mobile networks
| from being applied in the same way on a technical level.
|
| In fact when you're using a mobile network, you _are_
| near an internet AP in the form of a cell tower. Taking
| 5G NR, you even have to be nearer to it than you would be
| to your WiFi AP.
|
| Surveillance is not a result of form factor or function,
| it's a result of social organization.
| throwawayboise wrote:
| You don't _need_ any of it.
|
| I grew up without any of this mobile or home computing
| technology, and I don't see anything essential today that I
| cannot do without it. It's all about convenience.
| 650REDHAIR wrote:
| I've been thinking about going phoneless, but had a realization
| that I have used this number for far too many accounts to even
| remember.
|
| I basically need to port this number to a cheaper carrier and
| cover the cost...forever
| dandanua wrote:
| The problem is not with the technology itself. The problem is
| that technology is increasingly trying to control you and not
| vice versa. Humans are becoming slaves of a system, that has
| only "profits" in its mind.
| TedDoesntTalk wrote:
| > We need to be actively thinking of ways to roll things back
|
| Although I agree with you, it is not realistic.
|
| Do you think kids who are 3 right now will feel the same when
| they are your age?
|
| Reminds me of the US General who, in WW II, insisted cavalry
| still had a place in warfare. Can't remember his name.
| xdennis wrote:
| > Reminds me of the US General who, in WW II, insisted
| cavalry still had a place in warfare. Can't remember his
| name.
|
| Cavalry still had a huge role to play in WW2. You didn't ride
| them into battle (you didn't do that in WW1 either), but they
| were used for transport. Germany and Russia used 6 million of
| them.[1]
|
| [1]: https://en.wikipedia.org/wiki/Horses_in_World_War_II
| TedDoesntTalk wrote:
| Calvary != Horses
|
| It was Maj Gen John Herr:
|
| 1 point by TedDoesntTalk 7 minutes ago | root | parent |
| next | edit | delete [-]
|
| It was Maj Gen John Herr:
|
| "In 1945 Herr wrote that conversion of cavalry to armor was
| a mistake, an act of "robbing Peter to pay Paul": expansion
| of armor was necessary, but not at the expense of horse
| units."
|
| https://en.wikipedia.org/wiki/John_Knowles_Herr#Chief_of_Ca
| v...
| peoplefromibiza wrote:
| _The 10th Mountain Cavalry Reconnaissance Troop of the 10th
| Mountain Division, while not designated as U.S. Cavalry,
| conducted the last horse-mounted charge of any Army
| organization while engaged in Austria in 1945. An impromptu
| pistol charge by the Third Platoon was carried out when the
| Troop encountered a machine gun nest in an Italian village
| /town sometime between 14-23 April 1945._
|
| anyway the point is not to go back to soldiers riding horses,
| but to not reduce the authentication options, because it also
| reduces security.
|
| After all we still use keys to unlock doors and not our
| phones (because it would be stupid)
| TedDoesntTalk wrote:
| It was Maj Gen John Herr:
|
| "In 1945 Herr wrote that conversion of cavalry to armor was
| a mistake, an act of "robbing Peter to pay Paul": expansion
| of armor was necessary, but not at the expense of horse
| units."
|
| ...
|
| "even in 1942 he still struggled for the horse, requesting
| Marshall for "an immediate increase in horse cavalry."
|
| ...
|
| "He enforced a formal policy that any increase in
| mechanized forces must be preceded by a proportional
| increase in horse cavalry; as a result the 7th Cavalry
| Brigade remained the only mechanized unit until 1940.
| Later, he had to admit the rising power of armor, but was
| just as unwilling to dismount his troops.
|
| After the outbreak of World War II Herr followed the
| European campaigns through attache reports that reinforced
| his belief in superiority of cavalry tactics. His chief of
| staff Willis D. Crittenberger pre-screened these reports
| and jotted "cavalry mission" in the margins to attract
| Herr's attention.[16] Herr's own interpretation of the
| intelligence was biased in favor of the horse. He believed
| that the Wehrmacht relied on horses because of German
| operational doctrine when, in fact, it was a purely
| economic decision.[6] He wrote that other Western European
| armies dismissed the horse because of shrinking horse and
| forage stocks; the American situation, according to Herr
| was more akin to Poland or the Soviet Union, which still
| kept sizable horse formations.[15] He assessed blitzkrieg
| as a "typical cavalry mission" and suggested expanding the
| 7th Cavalry Brigade along German panzer division standards,
| under full Cavalry control.[17] The proposal, delivered at
| the War College in September 1939, was bundled with the
| demand that new armored units should be formed from scratch
| rather than converted from horse troops.
|
| In the first half of 1940 Herr embraced the concept of
| "horse-mechanized formations" and called for expansion of
| cavalry brigades into divisions. He alienated George
| Marshall by insisting that mechanization should be an
| expansion of existing cavalry troops, rather than their
| replacement.[19] He publicly rallied for more horse units
| through Cavalry Journal publications,[15] and brought
| further tension inside his troops by asking each cavalry
| officer to choose his side: either for horse cavalry, or
| for mechanization. According to Bruce Palmer Jr., the
| request forced officers of all grades to "cut their throats
| professionally": they had to bet their careers on obsolete
| war technology, or risk immediate repercussions from their
| Chief."
|
| https://en.wikipedia.org/wiki/John_Knowles_Herr#Chief_of_Ca
| v...
| vkou wrote:
| Cavalry absolutely had a place in WWII.
|
| That purpose wasn't doing pike-and-lance charges into panzer
| lines. Just like most motorized units, WWI and WWII cavalry
| didn't fight from horseback - it would use horses to get to
| where they were going to fight, and dismount to fight.
|
| The Eastern Front had a lot of terrain that was not
| conductive to wheeled travel.
|
| Cavalry is also far more cost-efficient at hunting down
| partisans, and terrorizing civilians. It doesn't need petrol,
| you can just steal horsefeed directly from the people you are
| occupying.
| TedDoesntTalk wrote:
| Not so much by the US Army; perhaps by other armies. See my
| sibling comments about Maj Gen John Herr who was side-lined
| then forced into retirement because of his views of cavalry
| during WW 2.
| coffeefirst wrote:
| I've yet to see an answer to the elephant in the room: if your
| phone gets lost or bricked, what's the recovery path?
| dwaite wrote:
| Typically you set up many devices that can be used for
| authentication - your android phone and windows desktop, as
| well as a USB key in your safe for emergency access into bank
| accounts and the like.
|
| Account recovery is a pretty well-known space as well. If the
| person does not have any authentication mechanisms left, you
| can send an email link or go through identity proofing
| depending on your security requirements.
| theonemind wrote:
| If you count that as part of phone-as-password cure, that
| makes the cure worse than the disease, in my opinion. Now I
| need to maintain and regularly test a recovery path. (Much
| like backups, if you don't test them, you literally don't
| even know they work. Other device needs good working order,
| perhaps subject to OS patching and data loss--pay attention,
| or your supposed backup plan might not work at all)
| nicolas_t wrote:
| And then banks will decide that it's not secure having
| multiple devices and actively prevent you from doing that.
|
| Right now my bank requires my phone to get a 2fa code for
| anything important. I can only have a single device at a
| time, if I lose my phone, I can of course reset it if I'm in
| the country and go to a branch. Of course with Covid that was
| difficult when I last lost my phone, so I had to download a
| form sign it and fax it to be able to set up my 2fa on my new
| phone. It took 2 weeks before I could access my bank account.
| ggm wrote:
| In the article. Cloud rsync of fido state, PKCS wrapped for the
| security concious.
|
| Our fallback on passphrase held off-line, for emergency use
| only.
| Snc wrote:
| FIDO needs to improve their communications and marketing if they
| hope to gain adoption, if they can't even get to the HN crowd.
| TFA also gets passwordless wrong, see _As ZDNet notes, Apple,
| Google and Microsoft already support these passwordless standards
| (e.g. "Sign in with Google")_ But that is _not_ passwordless as
| either FIDO or ZDNet describe it, it 's simply OpenID Connect.
|
| The announcement is specifically about FIDO2 adding support for
| two additional things:
|
| 1) The ability to share FIDO credentials between multiple
| devices. Previously, it was implied and alluded to, but never
| stated outright, that credentials would be bound to an
| authenticator, like a MacBook's Secure Enclave, which FIDO calls
| a platform authentictor, or a Yubikey, which FIDO calls a roaming
| authenticator. Now there's explicit support for multi-device
| credentials. Apple recently added this feature in what it calls
| "Passkeys", a name that other vendors (but not FIDO) seem to be
| adopting too. This is net positive. Losing a device that was
| bound to a credential meant that the credential was lost forever.
| Now, as long as the credential resides in at least one device the
| user has access to, there's no recovery flow needed. Note that
| the vendor providing syncing services for these credentials does
| not have access to them. See
| https://support.apple.com/guide/security/secure-keychain-syn...
| for an example implementation
|
| 2) Expanded ability and commitment from vendors to use a roaming
| authenticator over Bluetooth Low Energy (this is already in the
| standard). And in particular, the ability to use a phone's
| platform authenticator as a roaming authenticator in a different
| device. This does not mean, as TFA implies, that you'll need a
| phone to sign in to services. Rather, it means that for services
| that allow or require FIDO credentials to sign in, a phone is now
| an additional option to present those credentials. You can still
| use a Yubikey, TouchID or any other way you interact with your
| existing TPM.
|
| I understand that people are concerned about new authentication
| standards backed by big corporations who have a history of
| locking users out of their platforms and services, but the
| current state of secure login is dire. FIDO2 is an incredibly
| well designed set of protocols to prevent phishing, credential
| reuse, and several common causes for account compromise. It was
| clearly designed with that in mind, at the expense of usability.
| These are notable and incremental improvements to enhance the
| usability of a standard that is head and shoulders better than
| existing alternatives like passwords, but still has some ways to
| go in terms of functionality. Personally, I'm very excited about
| FIDO and WebAuthn, and some of the improvements I'd like to see
| in the coming months are:
|
| a) The ability to share passkeys across vendors, including the
| ability to implement a "sync fabric" as some folks in the
| WebAuthn working group have called it, so it's interoperable
| beyond the major vendors. b) For these vendors to strengthen
| their own log in experience. Apple only allows their own TOTP
| implementation and SMS fallback to authenticate to iCloud. I'd
| like to use WebAuthn exclusively here, so I could back up access
| to my now-precious Keychain that holds all my FIDO credentials
| with a YubiKey. c) A better story about backing up security keys.
| Implementing a) would give us that. Devices that can be
| initialized with a given seed like some common hardware crypto
| wallets would give us that, albeit not without introducing
| changes to the threat model -- you have to store the seed and
| input it somehow -- and https://www.yubico.com/blog/yubico-
| proposes-webauthn-protoco... would give us that as well. d) A
| better story for usernameless. The current methodology to have a
| user initiate a usernameless login and picking the right
| credential is a UX mess, and I don't believe I have actually seen
| it implemented in a production site. I'd love to be shown an
| example!
| saltcured wrote:
| One question I am unable to answer from all of these recent
| discussions: will I ever be able to use my phone as a cross-
| platform compatible FIDO/U2F hardware key?
|
| I don't want a vendor-specific or identity-provider specific
| integration like Google using Chrome and Android for MFA with
| Google accounts. I mean could my Android or iOS phone connect to
| a laptop via bluetooth or USB and act as a hardware key just as
| if I used a yubikey or titan key, and be visible to Firefox or
| any other software that knows how to talk to U2F or other
| smartcards to enroll with new websites and identity providers
| that have nothing to do with Google nor Apple accounts?
| idle_zealot wrote:
| There's no technical reason why your phone couldn't do what you
| describe. But the goal here isn't to maximize security or
| privacy, it's to maximize convenience for the sort of person
| who already uses the same weak password everywhere for the sake
| of convenience. Plugging in their phone with a wire is too much
| to ask.
| dwaite wrote:
| This is one of the main topics of the agreement discussed in
| the article - an agreement on how to use a phone as a cross-
| platform compatible authenticator and a commitment to do so.
|
| The mechanism is already available on chrome and android if you
| select the option to add an android phone - iPhones and iPads
| have a developer preview feature flag you can enable to work
| with this as well, and to have a Mac display a similar option
| when using the platform level support (aka Safari or certain
| native apps).
| aeturnum wrote:
| I mean, I do understand the appeal of using strong crypto over
| using passwords. I also understand why one would roll this out on
| phones first (even though phones are obviously less secure than
| many other ways of doing this). At its core, a model of identity
| would be to create a keypair for each account and require that
| key sign each login request.
|
| That said, I agree with everyone's fears and frustrations with
| the actual real world circumstances around phones. I do not trust
| my phone and I don't really trust the most popular projects to
| make phones more secure. I suppose you could keep a separate
| device whose only exposure to networks is to verify access over a
| limited protocol - but ofc due to the baseband and other
| requirements you would still be vulnerable. Very frustrating.
| dwaite wrote:
| > I also understand why one would roll this out on phones first
|
| This is Web Authentication/FIDO 2. We've had security keys like
| Yubikeys to do this for years.
|
| This is about committing to have computing devices also have
| the functionality of these security keys built in, to
| synchronize those credentials within a platform ecosystem, and
| to support cross-platform usage such as an android phone
| letting you into a site on a windows desktop browser.
|
| The hope is that much higher user availability will cause much
| higher site adoption.
|
| > At its core, a model of identity would be to create a keypair
| for each account and require that key sign each login request.
|
| That is exactly how it works. Web Authentication declares a
| javascript API for site access, and the request and signed
| authentication response formats/processing.
|
| > That said, I agree with everyone's fears and frustrations
| with the actual real world circumstances around phones. I do
| not trust my phone and I don't really trust the most popular
| projects to make phones more secure.
|
| There is about eight years of hardware in the market you can
| use rather than your phone. In addition to security-opinionated
| end-users, it is expected that some portion of enterprises and
| governments will require a separate hardware key for
| employee/contractor access - and may even require specifically
| the one that their IT hands to the person.
| aeturnum wrote:
| > _This is Web Authentication /FIDO 2. We've had security
| keys like Yubikeys to do this for years._
|
| Yes - doesn't the article suggest that this would use FIDO?
| "According to the FIDO Alliance, users will be able to sign
| in to websites through the same action that they take
| multiple times each day to unlock their devices"
|
| I was pointing out that this model - FIDO or some other
| version - does make sense. Even if the drawbacks of forcing
| people to use it on phones are obvious.
|
| > _There is about eight years of hardware in the market you
| can use rather than your phone._
|
| If there are dedicated hardware solutions that's great! It
| seemed from the article like they were requiring phones -
| which was the source of my concern.
| aestetix wrote:
| Is there an option for those of us who do not have a mobile
| phone?
| TheRealNGenius wrote:
| no thanks, my nonexistent phone can't replace my existent
| passwords
| _fat_santa wrote:
| I would hope that this is not made to be the only login option.
| More and more it seems that you can't go through life without a
| smartphone.
| ghaff wrote:
| Of course, you already are if you use a password manager.
| (ADDED: As noted elsewhere, password managers can also be
| accessed from other devices so not the same.)
|
| I agree with your basic point though. Smartphones are the
| default for doing more and more things. And when traveling, I
| try to have reasonably backups for maps, itineraries, etc. But
| I'm hardly religious about it and my phone breaking or getting
| lost/stolen when traveling would be a major hassle.
| thereare5lights wrote:
| Oh that's cool. Something that's super easy to steal and to
| coerce access to.
| fortran77 wrote:
| My 89 year old mother can deal with a printed sheet of her
| passwords but can't deal with the complications of a smartphone.
| dataflow wrote:
| What happens if my phone breaks/dies/runs out of battery/gets
| lost/...? What if it's my grandma's phone N thousand miles away?
| dwaite wrote:
| Your first question is the primary topic of the article.
| fimdomeio wrote:
| I know this is far from the main discussion, and that it's
| something that happens all the time, but I can't help feeling
| offended that this is called FIDO which nameclashes with a part
| of pre-internet history, FidoNet.
| vbezhenar wrote:
| I don't understand why so many websites insist on using valid
| email/phone and password at the same time.
|
| Just implement login via email/sms and that's about it.
|
| Now when it comes to this "phone" authentication, I'm not sure
| that I like this idea. I have good control over my phone number.
| I have good control over my domain and email (that's not true for
| most users, but they have the option). But making all my digital
| life depending on Apple or Google: that I don't like.
| lloydatkinson wrote:
| Nope. 2FA is already terrible enough and does not provide any
| meaningful security that can't be provided conventionally. Making
| it become "only FA" eg password-less is an unimaginably
| disastrous idea.
| chemmail wrote:
| What happens when you lose/break/get stolen, or app bugs out? You
| are SOL? There are utopian theories. And I've watched enough
| hunger games to know this will only end with someone breathing
| poison.
| daenz wrote:
| Just say you wish everyone was required to be chipped at birth
| with a NFC private key, Big Tech. I'm only being half sarcastic.
| There's a lot of outlandish conspiracies around this idea, but I
| think we all know it's heading in that direction, unless we
| continually reject it.
| theamk wrote:
| Don't see this direction at all, given you can do all this
| stuff using $20 Android phone with no plan you got from ebay.
| daenz wrote:
| Many of the replies here are "but what if I lose my phone|my
| battery dies|my phone is destroyed?" and they are all valid
| concerns. The next logical improvement to this is an authN
| device that cannot be lost, forgotten, or easily destroyed.
| One that is even more secure than biometrics.
| teddyh wrote:
| Let him that hath understanding count the number of the beast.
| mellavora wrote:
| I, for one, want the chip in my hand rather than my forehead.
|
| It is so much less humiliating to put my hand on the sensor
| than when I have to touch my head to the cash register each
| time I want to pay for something.
| [deleted]
| raspyberr wrote:
| Does anyone else think it's crazy that in order to participate in
| modern life you have to have an account with one of two massive
| American companies - Google or Apple.
| theamk wrote:
| No, because this is simply not true. I am not sure what
| "participate in modern life" means for you, but I have no
| personal Apple devices, so no Apple account for me; and I use
| Fastmail as my primary email.
|
| Granted, there are some groups which use Google Docs or such to
| coordinate, so I still have to have a Google account, but this
| is somewhat optional. And Google Play is pretty nice if you
| have a cellphone -- but on the older Android tablets I keep
| them account-less and use F-droid/random APKs from the web
| instead.
|
| A much concerning thing IMHO is a Facebook requirement -- I am
| missing a number of events when I tell people I don't use
| Facebook. Hopefully it will change one day, but I am not
| holding my breath.
|
| (And re the original article, you only need Google/Apple
| account if you want to use cloud sync. I am not quite sure how
| the system will work, but I suspect that with Android, you
| might either have alternative clouds (like Samsung's cloud), or
| may be able to use your own service, or sync via wired cable to
| PC)
| Ekaros wrote:
| I really hate that we truly think and market smartphones as some
| sort of secure device. To me the whole thing looks like creating
| massive single point of failure. A single device have big enough
| vulnerability and essentially everything is lost. Including all
| the usual recovery options from email, phone calls to SMS
| messages.
|
| As security person I prefer much more old school options, like
| that I can still use single use passwords with my bank. But I
| fear that this will go away one day...
| userbinator wrote:
| The companies realised that "security" is a great way to
| persaude, so they market that way while spreading paranoia and
| FUD about everything else. They've already been fighting right-
| to-repair with the same talking points. In reality it's just a
| power-grab from Big Tech and the security they're really
| desiring is security _against_ the user (and ostensibly
| attackers, which includes users in their thinking, since they
| don 't want to let users do things they don't approve of...)
| azinman2 wrote:
| The alternative right now is people using the same pot password
| everywhere, and/or writing it down on post it noted next to
| their computer. We need far better solutions for the majority.
| jml7c5 wrote:
| I dearly wish that security keys (Yubikey etc) were cheaper.
| The average person needs two keys so that they can store one
| as a backup. The average person needs keys that support NFC
| (or similar) so that they can easily use one across multiple
| devices. But the average person is not going to pay $50 for a
| pair of keys, regardless of the security or convenience
| benefit. It's not until you hit the $5/key range that people
| will use them without being strongly deterred by the cost.
| FinnKuhn wrote:
| I think that ease of use and services that support it are
| bigger challenges than the price.
| Ekaros wrote:
| Post it notes at home aren't so bad. It is not like you
| couldn't steal a phone if you have physical access. Maybe
| finger print is bit hard, but learning pass code or using
| face unlock when person is sleeping...
| specialist wrote:
| I've been waiting +25 years for this.
|
| But I don't want my phone to serve as my "root" authority. I'd
| rather have a separate pair of fobs used to seed all my other
| devices. Then put one of those fobs somewhere safe.
|
| When the USA finally gets smart and implements postal banking,
| I'd love for the USPS to offer safe boxes. Maybe even other fob
| related services. Kinda like a notary public, but for
| credentials.
|
| --
|
| Late 90s, shortly after W3C's P3 failed to catch on, a buddy and
| me cobbled together a SSO POC for browsers. Our catchy name was
| "Credendity", a failed portnameau evoking credentials and
| identity. One of our core motivators was "faceted identity",
| negotiated per account, to only share partial PII, to thwart data
| aggregators. So naive; big data deanon always wins.
|
| Our POC was just turrible. Embarrassing. Ditto every SSO
| implementations I've used since, whether standards-based, vendor,
| or bespoke. In hindsight, it's too bad our sense of integrity and
| esthetics prompted us to abandon our effort.
| password4321 wrote:
| Like the acquired/abandoned https://github.com/kryptco/kr with
| iOS and Android apps all under an "All Rights Reserved"-source
| license?
|
| > _SSH auth + Git commit /tag signing using a key stored [on your
| device]_
|
| > _turns your [...] device into a WebAuthn /U2F Authenticator_
___________________________________________________________________
(page generated 2022-05-07 23:01 UTC)