Passwords are outdated, you should just have to submit a picture of both sides of your credit card.

https://nitter.net/axios/status/1712679556375601187

72 comments

Didn't Okta just straight up get all their customer data hoovered up by hacker squad
- My employer uses Okta for SSO lul
  
  Hoo boy
- yes

Every 'passwordless' solution to passwords always ends up being the informational equivalent of 'passwords, but the method is changed'. Biometrics are just a once-in-a-lifetime password that's entered differently, password managers are just all your passwords, but behind one big password.
Even 2FA is just "password you know" and "password your device knows".
Not saying these solutions don't have value, but to say passwords are outdated is a bit silly.
- USB/NFC hardware keys are pretty good though, they are just the current form of smartcard hardware keys that have been around since the late 1990s for high security environments. If you worked for certain federal agencies or private sector companies, you might have used them. They are old technology at this point that has more recently been introduced into the consumer space as platforms and companies face backlash for constantly having security breaches.
  
  I have used them (coincidentally, with Okta), and they are pretty neat! I actually choose to use them instead of a smartphone app where I can, because it's much faster to use. I'd recommend them to companies as a good measure.
  They are still effectively 2FA where it's just a lot harder to work out the proprietary system with which the password is encoded. So it is a sort of a 'security by obscurity', but the likelihood of someone going through all the work to disassemble your key and work it out with you noticing / before the key gets invalidated is pretty low, so unless you're protecting something super-duper high value (and assuming the manufacturer hasn't screwed up too badly), they'll do a good job.

Guy who thinks passwords are outdated, setting a new password for his bank app: Hmm, how about Christmas123!, just like all my other logins so I don't have to worry about forgetting it!
- A fundamental problem with passwords is that you either have a "secure" selection of large, distinct, constantly rotating codes that you have to keep track of on paper/in an app (insecure!) or a single memorable code that - once it is cracked - exposes all affiliated systems (insecure!)
  There's a serious argument to the effect that a physical id tied to a digitally managed rotating set of large arcane codes is at least as secure as the paper/app-based list of hard codes. The big problem with this technology is that it requires a more complex hardware interface with more attendant IT support. So you're talking about $$$ that people don't want to spend for additional technical security.
  Two-factor authentication is cheaper and easier than biometrics. So we've settled on that instead.
- just like how every one of my work passwords that i never set but just came with the IT gear i use is "season two digit number"

I simply use the fingerprint scanner with my balls. They'd never think to check there.
- If they do think to check there, I'd see that as a net win.

fingerprints, face scanning... my OnePlus just keeps asking for pics of my asshole before I can unlock it. Is this just a China thing?
- It's like a thumbprint, but more secure because you don't typically rub it on every surface.
  
  you don't typically rub it on every surface
  I don't think you're using your asshole right
- As a fellow OnePlus haver, I have LineageOS (which is privacy-focused) installed and am not asked for pics of my asshole
  
  I also use lineageos but still send them pictures of my asshole since I don't want them to feel left out
- Please drink the Diet Mountain Dew Verification Can.

I was talking to a schoolteacher the other day who was getting re-fingerprinted for the Nth time. Their last fingerprinting was two years ago. Same job, same county, etc. Everyone was justifying it because of "privacy." But, like, it's all going to the same database, where the same people have access. Are they destroying the records every two years (
), or did the authorities just forget their own passwords?
- If you get into the reaaaaaaaaaaaal nitty gritty of security regarding biometric factors shit turns real weird eventually. Like "How do we know that fingerprint is still attached to a living person?" type stuff.
  I'd be sure as hell this isn't what happened here, just sort of a fun fact. Also why I think thinking biometric factors as safe is fucking insane, exactly because they're fairly immuteable. You get one data leak on your fingerprint-security-database and now you can never use that shit again if you're taking it seriously. And if you don't expect nation-state-level actors as a threat vector, why the fuck are you taking fingerprints?
  It's mostly just technologically illiterate people falling for it imo
  
  Mmm.
  I should go print a silicon printer that can make fake fingers based on, idk, someone's fabvorite ice cream flavor or something. Really hasten the slide in to the security abyss.
  Either way, I still use passwords for everything, and every password is unique. Biometrics my right tit they don't even have t beat that out of you, then can just cut something off. At least with the password manager it has to either have a vulnerability or they need access to state-level legal muscle to force the people who designed it to open the lock. Plus if one password gets compromized nothing else is unless it's the master, and even with the master they still need access to the password locker to do anything with it.
  
  lmao someone doesn't have an OTP RFID chip embedded in their nail bed and it shows.
  
  A fingerprint is a convenient way to unlock my laptop and can't be leaked by a security camera.
- I’ve asked the county clerk this once when I had to get my fingerprints done just because I was working in a different building 3 blocks away, but basically every time you renew certain trainings or certificates it’s required regardless of how many times you’ve done it before
  
  I did some googling and this was the best explanation I could find. (Most everything else was just "because that's the requirement.")
  Maybe I'm too paranoid but I still think the feds would figure out how to fuck with me, if they wanted to, based on the prints I had taken for a job I held >10 years ago.

"The way forward" and not "more secure" because cops usually don't need a warrant to use your own biometrics to unlock your phone

Passwords are outdated in the sense that the current best practice is to use a password manager that automatically generates a unique high entropy password (read: completely garbled mess no human would ever remember) for every website or service you use. Most of the replacement for them, however, are less secure garbage that can easily be obtained either through social engineering or by the authorities, so you know.
- Even then, you're better off with a passphrase as they are longer, easier to remember, and are harder to brute force. It's like a dictionary resistant password.
  
  depending on what you mean by passphrase, "dictionary resistant" is kind of the opposite of how I'd describe them. Sure they'll be long and unique but an english language dictionary will surely make bruteforcing them a lot easier
  
  The absolute best practice is to add random spaces that don't correspond to syllables. A 10 character password can go from taking a few seconds to crack to several hundred years with a few well placed spaces.
  That said, there are databases out there that don't like spaces, and for some reason lots of financial institutions are this way.
  
  A randomly-generated password can be a lot shorter than an equivalent-strength passphrase, actually:
  If you have a dictionary with 25,000 words in it, and you randomly select 5 of them, your passphrase will have a strength of about 73 bits of entropy, which is decent (but actually less than the NIST recommendation of 80 bits, as it happens; to get there, you'd need 6 words).
  A similar-strength randomly-generated password consisting of letters (upper- and lower-case), numbers, and a selection of 10 possible symbol characters (so, a total spread of 26 + 26 + 10 + 10 = 72 possible characters) would only need to be 12 characters long (and would have a strength of about 74 bits of entropy--13 characters would top 80 bits).
  The passphrase would take over 300 years to brute-force at 1 trillion guesses per second, but the extra bit of entropy in the 12-character password means it would take 600 years to guess that one at the same rate.
  
  That’s why stuff like webauthn is better; if we’re going to maintain a list of garbled text, let’s make it secure one-way encrypted keys instead, which are way stronger.
  You’re still only as secure as your password manager, but no one’s gonna decrypt your private key from a stolen database of public keys unless some really monumental exploit is discovered - and if that happens we’ve got MUCH bigger problems.

Yes I love getting an email every single time I log in to a website. Great UX, nothing obnoxious about it.

Me just sitting here installing a pin tumbler lock on my computer that I need to turn every time I want to log in to a website

ummm have they heard of 'passkeys'? like that thing that solves all these issues without any biometrics and personal information and cant be stolen as easily? like one login on a malicious device, and boom all your biometric data is now in the hand of the attacker. physical passkeys? good luck compromising that lol
also yes, this is obviously so cops can get to into your stuff and company's can collect your biometric data
- to be fair the way most fingerprint scanners are implemented it isn't possible to extract the actual fingerprint (that I know of). but with a malicious device I guess they probably could procure a different type of scanner
  Agreed tho I will stick with a master password I know and a hardware token that I have, probably until I die, unless something way better comes out that doesn't allow legal compulsion
  
  that true, and i guess it is worth mentioning that many physical passkeys use fingerprint scanners. the only difference is that your fingerprint never gets send on the internet at all

There's plenty of valid "password less" auth that would be great to have. SQRL by GRC is pretty much perfect, just needs adoption. Physical tokens and such are also very secure.

Passwords are fine with two factor authentication right? Like I have two factor authentication on my phone for pretty much everything either through text or a full on authenticator app.
- Okta is a service that provides two factor authentication for corporations.
  Two-factor is good enough for most things. Of course, you should use a passphrase, you should have a different one for each login service, etc.
  
  Okta also keeps having issues where they get hacked so I don't think they're ones to trust
- Two factor authentication basically makes the password a formality. Gabe Newell famously published his steam username and password and invited everyone to give it their best shot lol