News for hackers. Stuff that matters.
Re:We didn't encrypt your password, we hashed it by matthewmacleod on Friday September 04, 2020 @06:44PM (#24379636)
By the way I think that we should phase out password anyway, I mean that I prefer to implement in the applications that I develop a password-less authentication: when you want to sign in a mail (or an SMS) is sent to you, you click on a link with a temporary token and you are authenticated.

Please don’t do this. For one thing, SMS is fundamentally broken as a secure delivery method. But more than that… it’s just so, so deeply annoying.

Re:We didn't encrypt your password, we hashed it by weavie on Friday September 04, 2020 @07:16PM (#24379886)
I worked in an office that had no mobile signal. So for me a 2fa SMS involved walking out of the office and down the road for a few minutes until the SMS came through and then running back to my desk in the hope that I get there in time to enter the code before it times out.
Re:We didn't encrypt your password, we hashed it by ed25519FUUU on Friday September 04, 2020 @07:25PM (#24379933)
No WiFi calling??
Re:We didn't encrypt your password, we hashed it by throwit4tonight on Friday September 04, 2020 @08:09PM (#24380232)
You may not be able to get your phone on the corporate network without installing their MDM, and you may not want to give your employer the ability to wipe your phone.
Re:We didn't encrypt your password, we hashed it by xeromal on Friday September 04, 2020 @11:26PM (#24381192)
Or the ability to glean what you do on your phone!
Re:We didn't encrypt your password, we hashed it by IshKebab on Saturday September 05, 2020 @06:59AM (#24382723)
Support for that is very uneven. Most UK networks only support it if you have an iPhone or a Samsung phone, and sometimes only if you bought the phone from the network directly.
Re:We didn't encrypt your password, we hashed it by oneplane on Friday September 04, 2020 @07:04PM (#24379787)
But how will you log in to your SMS inbox? With an email? But what if that requires an SMS inbox as well.

Once we're in the realm of 'you only have to remember this one password' you might as well use a password manager that unlocks with that password and does the rest for you (be it with autofill or webauthn and the likes).

Yubikeys are fine too, even as a single factor in some cases.

Re:We didn't encrypt your password, we hashed it by three_legs on Friday September 04, 2020 @07:33PM (#24379988)
It's disturbingly annoying, I agree