Slashdot Mirror
NYT Password Security Discussion Overlooks Universal Logins
A recent NYT piece explores the never-ending quest for password-based security, to which reader climenole responds with a snippet from ReadWriteWeb that argues it's time to think more seriously about life beyond passwords, at least beyond keeping a long list of individual login/password pairs:
"These protective measures don't go very far, according to the New York Times, because hackers can get ahold of passwords with software that remotely tracks keystrokes, or by tricking users into typing them in. The story touches on a range of issues around the problem, but neglects to mention the obvious: the march toward a centralized login for multiple sites."
In matters of security, the most important tool anyone can have is common sense. Phishing scams, "dangerous" websites, revealing important information willy nilly...all things that cause major problems in the digital world, and all things that could be almost completely avoided if common sense was more prevalent.
Granted, some people "don't know any better"...but that's why you educate those types of people if you know any.
Living With a Nerd
Why don't you hunter2s shut the hunter2 up!
Always a great idea. Windows registry anyone?
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
I'll admit, I feel torn when I see that OpenID login. Increase my chance of giving someone access to everything? Or make it simple?
In the end I compromise and simply use a variation of one password for those.
There is the problem with centralized logins: the masses don't consider the first part, and only think of the convenience.
Absolute power corrupts absolutely. indymedia
So they just need one password to access all your profiles?
Unless it was not actually your password for all those sites, but the password to a database (only available locally) that contained the password to those sites, I don't see how that's a solution. Actually, I thought the main problem with passwords was that people already used the same password for all their sites.
We are all God's parents.
this story neglects to mention the obvious: the resistance from developers unwilling to hand the security of their systems and the trust of their users over to a 3rd party.
The trouble with OpenID is it's still one identity that you're carting around, allowing yourself to be tracked across multiple sites.
A better solution is just to use a password manager (KeepassX, Last Pass, etc.) which lets you manage your own multiple identities in a secure way. This gives you the convenience of a single sign-on with the security of a distinct identity for every site where you want it.
Great, so I'll be able to use Facebook Connect to login to my bank accounts soon????? Count me in!!!!!!
NY Times knows what they are doing while supporting this call for centralized password management and identity system. They serve the powers that be on their quest to even greater power. I agree with their point - increasing the so called safety - but on the other hand I am a bit worried about having a few people in charge of the identities of eventually entire population. Almighty government and rich corporations will certainly be willing to help us with our identities.
I like OpenID, but if you couple it with a three factor authentication, whether it be a smartcard, or biometric, or whatever.. that's when it becomes useful.
Too bad the current implementation doesn't support it. Sadly, World of Warcraft and Starcraft II do.
Go figure.
The price is always right if someone else is paying.
I am very happy with KeePassX. It stores your passwords and related information in an encrypted file. You can copy a password out of it to paste into a web-form. This means
The obvious problem is that you need a password to open the KeePassX file. However, this at least does not go via browser, and I can manage to remember one complex, very secure password.
KeePassX is open-source, available for Windows/Mac/Linux, and compatible across all of these. Nice solution - give it a try!
p.s. I have no relation to the project - just a happy user!
Enjoy life! This is not a dress rehearsal.
Password is not dead. Any single factor authentication has security issues of its own. Multi-factors authentication is much safer (although not bullet proof). I wouldn't be surprised that sites providing access to sensitive data (banks, gov) to require at least two factors authentication in the near future. The current security practice asking you stupid question about yourself, in addition to a password, is ridiculously weak.
Just asking if that type of security exists for open id?
Anonymous comments are as pathetic as the anonymous "sources" that contaminate gutless journalism from the New York Time
What has always amazed me about authenication for access-control via a computer is the widespread use of "passwords". We treat computer access-control like it's a brand new problem, however it's really just the same old access-control problem that we solved at least 4000 years ago.
Why don't we have passwords to get into our houses? Why don't we have passwords to get into our cars or P.O. boxes or even safe-deposit boxes? Because passwords are a pain in the ass that are inherently insecure because we, as humans, are terrible at remembering arbitrary strings of numbers/letters/symbols. What we are good at remembering - objects/ideas and the words associated with them - make for terrible passwords because they are so darn easy to guess.
The idea of a lock and key is one which we have been using for millenia for security, so why haven't we applied this simple metaphor for electronic access-control. We even have the technology readily available: Public Key Authentication. But for some reason the only place I've ever seen it used is in OpenSSH. In fact, it's considered superior to password authentication in OpenSSH and recommended over a password.
So why not have RSA keys to our email, online banking etc. just like we have keys to our houses, cars etc?
How come no one ever brings up the thought of Key based authentication. I feel this would help in a lot of ways...it adds an additional layer of protection against attacks. the website you log into just keeps your public key and nothing else. If no one can get a hold of your private key and passphrase then you are good. Since people tend to use the same password for every site then the chance of unlocking everything at once won't happen. I guess if you wanted to you could have the site keep both, but that is pointless to me.
Here's an idea. Why can't we build a mechanism to use your mobile phone as the other factor. You pay your provider to provide the service for you, and you get a new key each time you use the last one. So if I log on some website and use the key, I automatically get a new one on my phone. I could even receive them in tens to cater for situations where I might be out of network.
So educate me... How do I use common sense to determine if the site I just logged into actually secures the login information on the backend? Is it stored in clear text, transmitted in clear text, available to everyone in the company? I have no idea what happens to the credentials I just entered. How do I use common sense to determine if Facebook, MySpace, Slashdot, NYT, etc are taking the securing of my personal and login information seriously? Do you read every EULA completely? Would you even know if the company did not follow their EULA? Do you have the resources to sue if they don't?
Common sense tells me that no site is to be trusted implicitly; they are all dangerous.
Keep in mind that the username/password is stored on a server that a company owns, as well as other information you input such as your email, possibly credit card numbers.
Keep in mind that two companies, such as google mail and facxebook*, could potentially affiliate and 'share data', correlating a better picture of who you are and what you do. Basically, merging data from your spheres of influence on the internet, most with the intention to generate revenue or dossier.
Keep in mind a universal login system facilitates this hot-swapping of information.
Keep in mind that while it is easier to remember 1 password than 10, if that 1 is broken, it's as bad as all of those 10 being broken.
And keep in mind that while you have RIGHTS, digital law is murky as hell, courts can hardly agree on what the fuck is what, there is a legal expectation of not sharing personally-identifiable information however PID is not clearly defined and in all honesty once you make it into the shitstorm that is the court of law you have very few clear 'digital rights'. The above affiliate-information-sharing system is entirely legal until some judge hits a case and says it's not. To a degree, most of the technocratic elite are youngsters, under the age of, say, 30. Most Judges are well over their 30's, and many less technologically experienced than the average slashdot subscriber, something which may or may not bode well when you need educate on the finer points of internetworking in the courtroom. Lawmakers are also often shoved into this category, but it's a toss-up whether more have the acumen to even read the thousand-page bills they endorse and vote into law, much less the proficiency to understand more than f5'ing drudgereport.com.
* Just an extreme example; facebook has affiliates with which they can legally share anything you put on your page, even if you privatize it from other USERS. Presumably they sell these affiliations for money, re: 5 billion dollar company. Also presumably, Google is not a client of theirs. I really have no idea.
Don't they already have a centralized login site for NYT, always works fone for me.
http://www.bugmenot.com/view/nytimes.com
I have a password to get into my house, well, a key code. My deadbolt lock has a number pad. I punch in my code and the deadbolt unlocks. I hate carrying keys around, if I could get my truck to start up that way i would (I already have a hidden wireless keypad on my truck that will unlock and/or open the windows.
6.8SPC TR of 550, l xwind at 6, drift rt at 26" drops 77". AT has 503 ft-lbs at 1403 fps. FT 0.86
OK, so I could use one website with 1 password, trusting them with all my information (and look how great Facebook does), or I could use multiple websites with one password. In either case, I am trusting people not to screw with my information. So I am trusting more people with multiple sites, but they don't KNOW that I am trusting them. Sure it's security by obscurity, but it still makes more sense than trusting the same company with all my info. And it still lets me use one password for finances and another for my email and another for my medical information, and a third for all my social websites and games. No need to give the people I play games with ANY access to my finances. But honestly there are many better solutions that moronically giving away your privacy just reduce the number of people that know your password. It's a really stupid idea.
excitingthingstodo.blogspot.com
Central login by definition links your multiple accounts to a single identity. In most cases it is not a problem. But do you really want somebody to know you login with the same ID to you bank, health insurance and pr0n site? I don' think so. I'd prefer to have several identities on-line. One for secure stuff (bank, financial, medical info etc), one for shopping, one for unimportant stuff like forums, diggs, facespaces etc and one or many for things that I may not be so proud off like pr0n sites. The quality of the passwords I use on these tiers of logins should be appropriate for the importance of the account.
Many many websites and programs that require passwords allow u to reset passwords by having them send u an email and a link in the email to reset the password. so, if ur email password is compromised many other passwords are comprimised as well.
It's already a work-in-progress: gpgAuth
One password everywhere, no passwords stored on remote servers, validation of the server too--like SSH.
There's no place like
This topic of passwords keeps coming up. Different people keep piping in with "the REAL problem with passwords is........" and the solution is PKI/OpenID/keepass/1password/phone auth/securID etc etc etc. My impression is that we are making no progress whatever. We can't even agree on what the main problems are (keylogging, user forgetting, phishing, brute-forcing etc). With a 100 slashdotters posting you get 100 different offered solutions. So my guess is that 5 years from now, and probably 10 we're stuck exactly where we are today. Anyone disagree?
Those are not two factors, you're just using the file+your password together, *as* a longer password.