Timeline for How can we eliminate passwords given the problems with biometric authentication?
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 7, 2020 at 3:26 | comment | added | Steve Jessop | In fact an authentication app on your phone has some features in common with a password manager plugin: it generates "passwords" (not literally passwords, but data used to authenticate you) too secure for you to be able to remember. But it uses better protocols than, "I'll just send the exact same secret every time, shall I? That will probably be OK." | |
| Jul 7, 2020 at 3:16 | comment | added | Steve Jessop | @Anonymous: the holdup is that using bad passwords costs almost everyone almost nothing, almost all the time. If the mean time between your bank account being hacked was, say, 2 days, then the average person might start to see the issue, but it is not. And it's no coincidence that many of the services that it would actually matter financially if they get hacked, are the same sites encouraging 2FA. | |
| Jul 7, 2020 at 2:32 | comment | added | Miral | I don't use a password manager, but I also use a unique password for every site. I just remember them all. On the occasion I forget one, the password reset is usually easy to find and only takes a few seconds to use. (Usually the only time I have problems remembering a password is when the site has a stupid policy in place, which is one reason why I agree with xkcd that this actually lowers security.) | |
| Jul 6, 2020 at 23:58 | comment | added | Kate | Indeed, most people don't have a password manager, and yet there are free, proven and open source solutions available on the market today. What's the holdup, apathy, ignorance ? People could make their life simpler but instead they keep using bad passwords. They know they are bad but they are still doing it. My password manager even has a browser plugin. This is nice if you are lazy: almost no keystrokes required. I have complex passwords for each site and I don't have to remember them. Not a perfect solution but one of the best tools we have. | |
| Jul 6, 2020 at 23:09 | comment | added | Schwern | @Miral One or two individual passwords this time. And again. And again. On repeat, forever. For each one has to go to the website, remember their username and password (most people don't have a password manager), login, find where to change the password (they're all different), maybe put in the password again, maybe also 2FA, come up with a new password, come up with another one that meets the policy, and remember it. Biometrics are not the answer, but password fatigue is a real problem. Password resets are frustrating out of proportion to the effort; even with a manager I hate it. | |
| Jul 6, 2020 at 22:17 | comment | added | Miral | @Schwern I'm not sure I understand that argument. Unless the thing that was breached was your personal password database, then any breach should be of one or two individual passwords that should be relatively straightforward to change -- unless someone has already exploited the breach and changed your account details, but then that's going to be a problem regardless. Or unless you're using the same password on hundreds of sites -- which is exactly the same problem that using biometrics would cause. | |
| Jul 6, 2020 at 17:38 | comment | added | Schwern | The wording suggests 2FA is a replacement for passwords. The "two" in two-factor authentication a password AND a second code; it's an extra layer of security. However, a password reset via emailed link is often used as a replacement for infrequently used accounts. Users using password reset avoid having yet another password illustrates password exhaustion. | |
| Jul 6, 2020 at 17:33 | comment | added | Schwern | When the OP says changing a password is tedious and expensive, I read that to mean for the user. Because no matter how streamlined the process, it's not one password, it's one hundred. We have password managers to deal with this flood, but they are difficult to get a typical user to adopt. Even with a password manager and automatic notification of password breeches, resetting compromised passwords is a tedious, manual, constant process for the user. | |
| Jul 6, 2020 at 11:40 | comment | added | Kate | So the first explanation is that passwords can be "expensive" in terms of clerical work involved (IT support) when it is in fact a cost of doing business. Hardly anybody says that computers are "expensive". The other meaning of "expensive" is as outlined in one of the articles: "Passwords are a very serious and expensive security risk". Meaning that a compromised password can have very detrimental consequences, which is self-evident. A compromised password leading to a breach is expensive for the victim. That still does not mean that alternatives are less expensive. | |
| Jul 6, 2020 at 11:31 | comment | added | Kate | The idea of changing a password being expensive is indeed strange. The thing is, it is not always possible for the user to change it. For example to reset a password in Active Directory IT support department will have to intervene and manually reset it (and verify the request is legitimate and not a possible social engineering trick). It happens so many times that employees forget their password. Sometimes, the password policy is the cause of the problem: employees rotate their passwords using a pattern that is more or less constant, and after a while they are confused. | |
| Jul 6, 2020 at 7:33 | review | First posts | |||
| Jul 6, 2020 at 8:39 | |||||
| Jul 6, 2020 at 7:30 | history | answered | The_Moth | CC BY-SA 4.0 |