Slashdot Mirror
The Internet of Things Is the Password Killer We've Been Waiting For
jfruh writes: You can't enter a password into an Apple Watch; the software doesn't allow it, and the UI would make doing so difficult even if it did. As we enter the brave new world of wearable and embeddable devices and omnipresent 'headless' computers, we may be seeing the end of the password as we know it. What will replace it? Well, as anyone who's ever unlocked car door just by reaching for its handle with a key in their pocket knows, the answer may be the embeddable devices themselves.
This is one of the rare cases where the title doesn't ask the question, yet the answer is still no.
ANd if they want to use their account on multiple devices? On their actual PC? On a PC at a firend's house or library?
And email recovery- laughable. If they lost their phone, which was almost definitely logged into their email, then they've lost everything.
Please name your apps, so I can be sure never to use them.
I still have more fans than freaks. WTF is wrong with you people?
halfway through the article...
[ Don't miss: Welcome to the Internet of Things. Please check your privacy at the door. ]
Anons need not reply. Questions end with a question mark.
In the sense that both 'the internet of things' and 'passwords' can be described as "an egregiously maldesigned and actively user-hostile security clusterfuck; typically bodged together by people who don't know, don't care, or both", I suppose that 'IoT' would be a worthy successor.
In all other respects, what a load of tedious, meandering, bullshit to arrive at some vacuous generalities about a vaguely described non-solution.
Look if your phone gets malware or MITM and skims the logon normally, you're boned. You're boned in many ways since if you have malware you probably have a keystroke logger too. Yet this passwordless style won't ever let them know how to log onto your account. This is no different since your login/password phase of authentication is the same. In fact with the server giving you a quite long randomized password its better than someone's recycled password they use on every site.
If you don't enter an email and verify it, yes, you lose everything! This is why you enter your email and verify it, gain some virtual currency for completing the task. The thing is, it won't prompt you for this for about 10-30 minutes in since you don't have anything worth saving anyway, and no one wants detracted from seeing if the game is cool or not.
God spoke to me
Dude, he's not running a f*cking bank. He's obviously talking about a system for some phone toy like Angry Birds. Do you care if I can get into your Angry Birds account? Probably not much.
He's describing a system that is good enough for phone toys and things that require similarly low security. Like apparently Slashdot, which lets you perma-login with a browser cookie and redirects https to http rather than the other way around.
vi ~/.emacs # I'm probably going to Hell for this.