5 ms·
"Now might be a good time to change your password to something longer, or finally get onboard with 2FA." If it becomes trivial to crack the passwords, then we'
by jzs 6y ago
"Now might be a good time to change your password to something longer, or finally get onboard with 2FA."
If it becomes trivial to crack the passwords, then we're really left one factor. Unless we replace the password factor with something else.
Sqrl perhaps?
- arpa 6y agoClient certificates is also a thing.
- mschuster91 6y agoAnd they are an utter PITA to use, everywhere in the stack...
- ta17711771 6y agoWe could fix that..
- Nerada 6y agoCracking good (long) passwords is far from trivial (and mathematically should remain that way), the main problem is most users pick terrible passwords.
- amelius 6y agoThe problem: users don't want long passwords. (Though password managers can help a lot.)
- UncleEntity 6y agoOh, the irony... One of my banking apps has a 10 minute logout "feature" (which can't be disabled) that pretty much guarantees you need to have a crappy, easy to remember, password if you want to use it. Add on top of this a predilection for "2FA" (aka text message) every few times you log in and the thing is basically an unusable hot mess. (looking at you walmart moneycard)
- ryanlol 6y agoIf it’s trivial to dump password hashes, you’re probably already left with zero factors.
- tialaramex 6y agoFor a lot of things this is true, but not for WebAuthn. Here's what my site has on file for one of my own logins: id: AWrNx4WDVIACFXeNDG4h6R6/ppUi8oIuXJYRwaJtOxssDZybQnu8wt6Cjdc4PqztvnSxnSgLmZGRT1BTnbZjz/M= public key: pQECAyYgASFYIFsl5O6VHyqngNHPlNmWrjGTPjLFh1jzVnhOUJGP79yVIlgg6L2rDoH/l028WsMes+MbDU0RzM2oSdTcRq+cSwz/E/k= friendly name: unhygienix The only thing you can do with that data is the exact thing it's intended for, checking the user has the authenticator corresponding to that ID and wants to sign into this particular web site. Also I guess you maybe learn that this user enjoyed the Asterix comics? You can't impersonate me using that data, any more than you can impersonate Hacker News based on the data inside its TLS certificate.
- paul_f 6y agoNot trivial. You still have to break in and get /etc/passwd or the equivalent, right? And doesn't creating a unique salt for each client also help significantly?
- Rafert 6y agoWebAuthn is well supported across all major browsers and can be used for multifactor login without username and password.