topic Re: Password-LESS Era in Welcome

Password-LESS Era

Agunlex — Mon, 09 Oct 2023 10:29:25 GMT

With the daily familiarity in the use of fingerprint login method, do you think the use of password as a login method will be eradicated completely in nearest future?

Re: Password-LESS Era

emb021 — Mon, 03 Apr 2023 15:25:30 GMT

"the daily familiarity in the use of fingerprint login method"

what's that?? I don't use that and never have.

Everything I access wants a password and often a secure code (texted or from an app).

So, yeah, I don't think passwords are going away in the short term. Maybe at some point.

Re: Password-LESS Era

dschimanski — Wed, 26 Apr 2023 09:11:18 GMT

You can hear a lot of voices on the internet praising passkeys as the future and the end of all/most passwords. As longs as they are seen as secure, I suppose.

Re: Password-LESS Era

cosminm — Tue, 17 Dec 2024 17:17:04 GMT

Agreed. Then you realise for Microsoft passkey access relies on a simple 12345 PIN that people usually set (for convenience), at which point the whole security crumbles 🙂

Re: Password-LESS Era

denbesten — Thu, 19 Dec 2024 16:59:19 GMT

@cosminm wrote:
... passkey access relies on a simple 12345 PIN

The PIN is local to the device, greatly shrinking the attack surface and making it trivial to level-up to a more secure credential after too many failed attempts. Similar to how your phone requires a password instead of pin/face-ID after a reboot.

The real beauty of passkeys is that they rely on public-key cryptography, rather than a user-chosen shared-secret. This offers a bunch of benefits:

Users do not have the opportunity to use the same password across multiple sites, nor can they chose weak passwords.
It frees users from ineffective and inconsistent password complexity rules.
The private key is not transmitted over the Internet, making it impractical for an adversary-in-the-middle to harvest credentials for later use.
The private key is never on the (web-) server, rendering its account database an insufficient place to steal credentials.
The passkey itself is "something you have", meaning that if access to the passkey is protected by a PIN, password or biometrics, one has achieved multi-factor-authentication.
The private key can be stored in hardware, making the passkey compliant with AAL3, NIST's strongest authentication level.