Muffett has thought about these things for a long time (I was helping him reverse poorly thought out password hash functions in the 1980s).
https://alecmuffett.com/muffett-passwords
There is a lot to be gained by most users in using passwordless approaches, but the key aspects are that insisting on such approaches has impacts on both the possibilities of not identifying oneself accurately (e.g. anonymity), the recovery process, spotting compromise (compromised email is a very different experience with emailed tokens vs emailed password reset - in one your password no longer works, as well as consolidating access into silos (Facebook bans or outages are a thing).
For these reasons I have stopped using "login with facebook" as a federated identity.
I try to restrict "login with google" for specific security and business related tasks.
But I am using a password manager for nearly all routine passwords (with the exception of some finance and particularly sensitive accounts).
Inserting email into the loop is potentially painful, and email still has legions of security issues (lot of sites still don't validate x509 certificates when delivering or receiving emails, in a previous role making GMail validate NATOs certificates was extra work as they aren't in Google's trusted set). I'm interested in approaches to taking email and SMS out of both authentication & the account recovery loop, because account recovery which is either plaintext, effectively plaintext, or easily intercepted by people who might already be in the process of attacking your organisation will eventually be the Achilles heel. Nearly all consumer services fall to SIM swapping or hijacking phone numbers.
We are entering a period when the authentication choices are multiplying, and some implementation (cough - Slack) will confuse users even if the basic ideas are sound. From an end user perspective it is probably wise to try and prevent rampant proliferation until winners emerge. It does make sense to focus on the things that are likely to secure accounts even against attacks that successfully steal credentials, such as identifying which users routinely use Tor, which don't, other signals of compromise or a need to do further investigation. These kinds of checks defeat crazy things like the recent defeat of browser same original policy to steal web credentials, or indeed if their mobile phone has Pegasus malware on it stealing credentials and email.
My personal weakness, I kind of like SQRL, but I don't think it'll succeed.
------------------------------
Simon Waters
Founder
Insufficient Entropy
------------------------------
Original Message:
Sent: Jul 26, 2021 10:44:44 AM
From: Olivia Rempe
Subject: Passwordless Logins
#repost Saw this post on reddit this morning and wanted to get the community's opinion on the future of passwordless logins.
"I read more and more about passwordless logins and how it's the future, but I'm not entirely sure how to feel about them. By passwordless logins is meant that you can login with a one time password (OTP) that you aquire by email, sms, an app or hardware key (ex Yubi key). The main reason usually being that the user does not have to deal with passwords.
I myself have no issues dealing with passwords, I use a password manager and randomly generate a strong password for each login. I always enable 2FA preferably with an app wherever I can. I believe that this is the most secure as it is a combination of something you know and something you own (phone/hardware key). I also prefer an app over a hardware key since you always need to have it with you if you want to access something on the go with the risk of losing it. Sms and email OTP I try to avoid.
But I'm not like most users and I know from my girlfriend and friends that it's not very common to setup 2FA as they find it annoying having to look at their phone for a OTP. I've been able to convince them to use a password manager, but 2FA is a step too far.
So does it make sense to just skip the passwords all together? I see why they want to skip passwords. Since the majority of users still reuse and/or have weak passwords, even with password manager adoption and most users don't bother to setup 2FA unless forced.
What is your opinion about this? And could this be the solution that offers better security while still being somewhat convenient?"
------------------------------
Olivia Rempe
Community Engagement Specialist
Cloud Security Alliance
------------------------------