News for hackers. Stuff that matters.
Re:Passwords Are Fine by k8sToGo on Tuesday July 04, 2023 @07:36AM (#36585301)
Of course you despise it. Security always comes at the cost of convenience.
Re:Passwords Are Fine by Cupprum on Tuesday July 04, 2023 @07:42AM (#36585357)
Security is inconvenience, therefore the role of security is to find where is the limit. Because afterwards users will start to search for shortcuts, which usually makes the systems even less secure.
Re:Passwords Are Fine by stevage on Tuesday July 04, 2023 @07:44AM (#36585380)
I don't despise all inconvenient things. I don't mind carrying house keys. It's just a question of whether you value the security enough to make it worthwhile.
Re:Passwords Are Fine by NoZebra120vClip on Tuesday July 04, 2023 @07:51AM (#36585438)
> I don't mind carrying house keys.

House keys are a minimal inconvenience because the lock on your front door also affords minimal security. Just ask the Lock Picking Lawyer how long it would take a determined intruder to get into your home, whether by picking, force, or finding a weakness such as open window.

If your home had high security, I can guarantee that you'd feel the inconvenience.

Re:Passwords Are Fine by pclmulqdq on Tuesday July 04, 2023 @08:16AM (#36585649)
You can have a very secure facility that only uses a "house key"-style entry flow for the user. The key will look really weird (see Medeco and Evva for examples) and the building will have some design compromises - few entry points, no openable windows, etc.

A password, in theory, could work the same way. Except that the normal password UX involves people remembering the password, which entails a huge security compromise.

Re:Passwords Are Fine by NoZebra120vClip on Tuesday July 04, 2023 @08:23AM (#36585706)
> no openable windows

Yep, I'd call that a significant inconvenience (for a home that someone like me lives in).

Re:Passwords Are Fine by stevage on Tuesday July 04, 2023 @09:09AM (#36586176)
Personally I'd be fine with password restrictions like 16 characters minimum etc etc. Still better than MFA.
Re:Passwords Are Fine by stevage on Tuesday July 04, 2023 @09:03AM (#36586115)
Indeed. But hopefully that was the tradeoff I had chosen.

MFA irritates me because usually it isn't my choice.

Re:Passwords Are Fine by NoZebra120vClip on Tuesday July 04, 2023 @09:11AM (#36586204)
MFA has some sort of calculated irritation built into it.

Part of it consists in the incredibly varied ways it can manifest. I could receive an SMS code, an email code, I could generate a TOTP code (choice of two Yubikeys), I could use U2F/FIDO (choice of 3 Yubikeys), I could get a Magic Link, I could use Sign in with Google, I could punt and use a code on my emergency backup paper. Don't forget to pass a CAPTCHA, and your password probably expired while you were away, as well.

Of course this all transpires after I've unlocked my password manager's vault, which has its own style of 2FA security, its own timeouts, and its own UI/UX quirks.

So you can see the sheer dizzying possible mutations of the MFA flow. Sometimes you don't even know what they'll hit you with until you try to log in!

What amuses me is "We sent a code to your email. This message will self-destruct in 10 minutes." when email used to arrive on the scale of 5-7 days if the server was overloaded or busy. Oftentimes I find myself racing multiple timeouts to run the gauntlet of MFA in whatever way has been mandated.

Re:Passwords Are Fine by Mordisquitos on Tuesday July 04, 2023 @08:07AM (#36585585)
Those who would give up essential Security, to purchase a little temporary Convenience, deserve neither Security nor Convenience.

    — Frankmin Benjalin
Re:Passwords Are Fine by CaptainFever on Tuesday July 04, 2023 @08:32AM (#36585802)
Security with the cost of convenience comes with the cost of security.
Re:Passwords Are Fine by api on Tuesday July 04, 2023 @08:09AM (#36585596)
Lol. That’s 99.9% of all users especially if you consider privacy a subset of security.