| *** KindTwo has joined #maemo | 00:18 | |
| *** KindOne has quit IRC | 00:19 | |
| *** KindTwo is now known as KindOne | 00:22 | |
| *** pagurus has quit IRC | 00:22 | |
| *** florian has quit IRC | 00:23 | |
| *** florian has joined #maemo | 00:24 | |
| *** Kabouik has quit IRC | 00:30 | |
| *** Pali has joined #maemo | 00:34 | |
| *** mva_ has joined #maemo | 01:05 | |
| *** mva has quit IRC | 01:06 | |
| *** Kabouik has joined #maemo | 01:27 | |
| *** freemangordon has quit IRC | 01:49 | |
| *** freemangordon has joined #maemo | 01:56 | |
| *** drathir_tor has quit IRC | 02:12 | |
| *** Kabouik has quit IRC | 02:18 | |
| *** drathir_tor has joined #maemo | 02:20 | |
| *** florian has quit IRC | 02:33 | |
| *** Kabouik has joined #maemo | 02:37 | |
| *** jskarvad has quit IRC | 02:53 | |
| *** Kilroo has joined #maemo | 02:58 | |
| *** Pali has quit IRC | 02:59 | |
| *** KindOne has quit IRC | 03:22 | |
| *** KindOne has joined #maemo | 03:31 | |
| *** KindTwo has joined #maemo | 04:23 | |
| *** KindOne has quit IRC | 04:25 | |
| *** KindTwo is now known as KindOne | 04:27 | |
| *** LauRoman|S has joined #maemo | 04:58 | |
| *** KindTwo has joined #maemo | 05:17 | |
| *** KindOne has quit IRC | 05:19 | |
| *** KindOne has joined #maemo | 05:21 | |
| *** KindTwo has quit IRC | 05:22 | |
| *** sicelo has quit IRC | 05:40 | |
| *** sicelo has joined #maemo | 05:41 | |
| *** sicelo has quit IRC | 05:41 | |
| *** sicelo has joined #maemo | 05:41 | |
| *** KindTwo has joined #maemo | 05:41 | |
| *** KindOne has quit IRC | 05:42 | |
| *** tm has quit IRC | 05:44 | |
| *** KindTwo is now known as KindOne | 05:45 | |
| *** tm has joined #maemo | 05:47 | |
| *** KindTwo has joined #maemo | 06:33 | |
| *** KindOne has quit IRC | 06:35 | |
| *** KindTwo is now known as KindOne | 06:38 | |
| *** KindOne has quit IRC | 06:48 | |
| *** DocScrutinizer05 has quit IRC | 07:26 | |
| *** DocScrutinizer05 has joined #maemo | 07:26 | |
| *** APic has quit IRC | 08:36 | |
| *** APic has joined #maemo | 08:38 | |
| *** Kilroo has quit IRC | 09:09 | |
| brolin_empey | I love these lame applications that tell the user that their password has expired and needs to be changed but happily accept the expired password as the “new” password, such as the Web site for my current (since 2018 June) credit card provider who just expired my original password. | 09:31 |
|---|---|---|
| *** Kabouik has quit IRC | 09:33 | |
| brolin_empey | Even Windows 2000 originally did this but Microsoft may have fixed it in one of the service packs. | 09:34 |
| *** Kabouik has joined #maemo | 09:44 | |
| *** Kabouik has quit IRC | 09:51 | |
| *** Kabouik_ has joined #maemo | 09:57 | |
| *** Kabouik_ has quit IRC | 10:10 | |
| luke-jr | brolin_empey: is there a legit use case for expiring passwords? | 10:30 |
| *** Pali has joined #maemo | 10:51 | |
| *** jskarvad has joined #maemo | 10:57 | |
| *** pagurus has joined #maemo | 11:24 | |
| *** luke-jr has quit IRC | 11:37 | |
| *** luke-jr has joined #maemo | 11:38 | |
| sixwheeledbeast | I fail to see the point in expiring passwords. Some companies have it as a policy. People are lazy you make it harder for people that use password management and the ones that dont care generally use the same password but change the last character. | 11:47 |
| sixwheeledbeast | As much as I hate biometrics it works for people that aren't interested. | 11:49 |
| *** Kabouik has joined #maemo | 12:10 | |
| *** chgvisua- has quit IRC | 12:27 | |
| *** chgvisual has joined #maemo | 12:27 | |
| Maxdamantus | I hate that most things even use passwords. | 12:40 |
| *** eMHa has quit IRC | 12:41 | |
| Maxdamantus | If a system is relyping on something like email as its actual authority (eg, systems where you can reset a password as long as you have access to an email address), a password is only really a convenience feature that makes it quicker to authorise (enter a memorised password instead of go through an email validation cycle). | 12:42 |
| Maxdamantus | Most sites should either just use email validation to log in. If it's something that someone is using frequently, then allow their broswser to remember the a long-lived session cookie, otherwise if they're using it infrequently, they're going to forget their password and go through an email validation cycle anyway. | 12:45 |
| Maxdamantus | s/either // | 12:45 |
| infobot | Maxdamantus meant: Most sites should just use email validation to log in. If it's something that someone is using frequently, then allow their broswser to remember the a long-lived session cookie, otherwise if they're using it infrequently, they're going to forget their pas... | 12:45 |
| sixwheeledbeast | Your requiring the need for email and browser which maybe inconvenient. i don't want my browser to remember any cookies between sessions. | 13:05 |
| sixwheeledbeast | A password is providing a weak form of 2FA. If your email is compromised then you validate all sessions from there its a single point failure. | 13:08 |
| sixwheeledbeast | Also i believe we where referring to security more generally so logging into the system in the first place for example. | 13:10 |
| Maxdamantus | No. Allowing a password is a weakening of the system. 2FA is about requiring an *extra* requirement for authentication. Most password systems are about providing an *alternative* requirement for authentication. | 13:25 |
| Maxdamantus | Since most password systems allow you to authenticate if you've forgotten the password. | 13:25 |
| Maxdamantus | So the password is not actually required, it's just a way of access the system quicker. | 13:26 |
| Maxdamantus | 2FA requires 2 factors when authenticating. Password systems usually allow you to authenticate using only one factor (the password). Those systems also usually allow you to authenticate using the email, but they don't require you to authenticate using both. | 13:29 |
| Maxdamantus | So again, you've got two alternative ways of accessing the system, therefore it's strictly weaker. | 13:29 |
| Maxdamantus | and passwords seem like a very weak system. | 13:29 |
| Maxdamantus | Since people reuse passwords all the time. | 13:29 |
| Maxdamantus | > If your email is compromised then you validate all sessions from there its a single point failure. | 13:31 |
| Maxdamantus | Most password systems allow you to recover if you have access to email. | 13:32 |
| Maxdamantus | So by having a password, they're not protecting against that. | 13:32 |
| *** Kabouik has quit IRC | 13:33 | |
| *** Kabouik has joined #maemo | 13:33 | |
| Maxdamantus | It's like allowing your friend into your house by opening the door for them (you are the primary authority), and then for convenience you can give them a door key. | 13:37 |
| Maxdamantus | Giving them a key is a weakening of security. | 13:38 |
| sixwheeledbeast | Not protecting no, but not providing access to everywhere else. If you have forgotten a password you would have to validate in the same way as registering the account in the first place and this would clear the password. | 13:38 |
| Maxdamantus | Right, so why not just require them to validate the same way each time they log in? | 13:39 |
| Maxdamantus | Instead of giving out extra keys that can be used to bypass the primary authority mechanism? | 13:40 |
| sixwheeledbeast | Well because it inconvenient just like never leaving your house so you can let your friend in. | 13:40 |
| sixwheeledbeast | to use your analogy | 13:40 |
| *** Kabouik has quit IRC | 13:40 | |
| Maxdamantus | Right, so it's a convenience feature. It's a weakening of security. | 13:40 |
| *** Kabouik has joined #maemo | 13:42 | |
| sixwheeledbeast | I don't agree. It's systematically not compatible with people but itself it isn't a weakness IMO. | 13:42 |
| Maxdamantus | If it's a site that's used once every month or two, you might as well just have that initial validation as the way people log in, because it's likely that at that length of time, it's going to be more annoying trying to memorise a password than checking an email. | 13:42 |
| Maxdamantus | It's clearly a weakness. You still have the alternative way of authenticating (using email or whatever). Like the door analogy, you can still ask your friend to let you in. | 13:43 |
| Maxdamantus | But having a password/key is an extra vulnerability that can be exploited by others. | 13:44 |
| Maxdamantus | You could accidentally leave your key somewhere, or you could reuse a password, or you could enter your password into another website as you're trying to remember their password. | 13:44 |
| Maxdamantus | the password/key is a way of bypassing that primary authority mechanism (asking the friend, or verifying an email address) | 13:45 |
| sixwheeledbeast | As I say it not just about websites, you have security before you even get to a browser or email client. Using passwords incorrectly is down to the user not the method. | 13:46 |
| Maxdamantus | I'm not opposed to passwords overall. I just think most of them are useless. | 13:47 |
| Maxdamantus | There are relatively few things that should actually use passwords. That does not include most websites. | 13:47 |
| Maxdamantus | Most websites ultimately authenticate using email validation. Obviously if you're talking about access to an email account, or access to some system using ssh, you're not ultimately using email validation, so a password might make sense in those situations. | 13:48 |
| Maxdamantus | s/useless/useless and a security liability/ | 13:49 |
| infobot | Maxdamantus meant: Most websites ultimately authenticate using email validation. Obviously if you're talking about access to an email account, or access to some system using ssh, you're not ultimately using email validation, so a password might make sense in those situation... | 13:49 |
| *** Kabouik has quit IRC | 13:51 | |
| *** Kabouik has joined #maemo | 13:52 | |
| sixwheeledbeast | You can't expect to validate every session via email on every site everytime you start a new browsing session. | 13:52 |
| Maxdamantus | Then remember the session. | 13:55 |
| sixwheeledbeast | The overhead created both ways would be ridiculous, also your email would not be protected via HTTPS. Leaving your browsing session open would be like leaving your front door open. | 13:55 |
| Maxdamantus | You mentioned password managers before. Where is the password being saved? | 13:56 |
| *** Kabouik has quit IRC | 13:56 | |
| sixwheeledbeast | encypted somewhere else | 13:56 |
| Maxdamantus | Encrypted using what? | 13:56 |
| Maxdamantus | To the extent that most people use password management, it's just making the password accessible to the browser. | 13:57 |
| Maxdamantus | Might as well just store cookies instead. At least cookies are essentially forced to be randomly generated instead of potentially reused across different websites. | 13:57 |
| sixwheeledbeast | Encrypted with whatever the latest standard is an stored away from the session. | 13:58 |
| *** Kabouik has joined #maemo | 13:58 | |
| Maxdamantus | It would be fine if passwords were also required to be randomly generated (as often happens when people use more advanced password managers), but the point of a password is generally that the user is able to choose a common phrase that they can remember. There's nothing preventing them from reusing that phrase across different sites. | 13:58 |
| Maxdamantus | What's the difference between encrypting the password and encrypting the cookies? | 13:59 |
| Maxdamantus | (When I said "encrypted using what?" I meant: what is the source of the encryption key. You can't just encrypt something and then claim you've added security. If you store the encryption key next to the encrypted data, there's no added security.) | 14:01 |
| sixwheeledbeast | I am not saying the are perfect and that the system systematically helps people use them correctly. | 14:02 |
| Maxdamantus | If passwords are being encrypted using, eg, the user's OS password (so the actual key is encrypted using the user's OS password), browsers might as well just be doing the same thing with their cookie stores. If you forget your OS password, you lose access to your cookies. | 14:04 |
| sixwheeledbeast | Well you could be flexible the key can be anything:- psychical hardware, a piece of data, a "strong master password" that is only knowledge and not used elsewhere. | 14:04 |
| Maxdamantus | imo that's a pretty decent system. | 14:04 |
| *** Kabouik has quit IRC | 14:06 | |
| *** Kabouik has joined #maemo | 14:07 | |
| sixwheeledbeast | Ultimately my ideal solution is a device combined with a password. (something I have and something I know). Which is pretty much what i have now, the random passwords that the manager makes up mean nothing to me or anyone. | 14:11 |
| *** Kabouik has quit IRC | 14:12 | |
| Maxdamantus | Sure, so that's not really a password. It's still probably a weakening of the system, but it's not as weak as a typical password setup. | 14:13 |
| Maxdamantus | (typical password setup as in where the user remembers a password and types it in each time) | 14:13 |
| sixwheeledbeast | the issue with cookies is being tracked, you have no easy control over saving just the password and not the rest of the session to login quickly. | 14:14 |
| sixwheeledbeast | Yer i see what you mean from the POV of I am using the "Password" box as a "Key" so it's not really a "password" | 14:16 |
| sixwheeledbeast | I have never considered a password to be a "password" it's just a string of memorable characters. | 14:19 |
| Maxdamantus | also, in cases where websites do legitimately need to use actual passwords, I want there to be some sort of augmented PAKE system (eg, SRP or OPAQUE). It requires support from the web browser or OS, but it means it's not unsafe to, eg, reuse a password across multiple sites. | 14:20 |
| Maxdamantus | I imagine the main issue with PAKE is getting a UX that people learn to use properly, so they're informed that the browser/OS is asking for the password instead of the website. | 14:21 |
| *** Kabouik has joined #maemo | 14:25 | |
| Maxdamantus | imo SRP would also be suitable in place of ssh password authentication. | 14:25 |
| sixwheeledbeast | They are not going away, as other options all have equal flaws or implementation issues. | 14:25 |
| *** florian_kc has joined #maemo | 14:43 | |
| *** Kabouik has quit IRC | 14:52 | |
| *** Kabouik has joined #maemo | 15:00 | |
| *** Kabouik has quit IRC | 15:04 | |
| *** Kabouik has joined #maemo | 15:30 | |
| *** ^[_ has quit IRC | 15:33 | |
| *** ^[_ has joined #maemo | 15:33 | |
| *** eMHa has joined #maemo | 16:07 | |
| *** Kabouik has quit IRC | 16:19 | |
| *** Kabouik has joined #maemo | 16:21 | |
| *** troulouliou_div2 has quit IRC | 16:21 | |
| *** troulouliou_div2 has joined #maemo | 16:24 | |
| *** sunshavi has quit IRC | 16:29 | |
| *** troulouliou_div2 has quit IRC | 16:31 | |
| *** troulouliou_div2 has joined #maemo | 16:31 | |
| *** troulouliou_div2 has quit IRC | 16:39 | |
| *** Kabouik has quit IRC | 16:44 | |
| *** sunshavi has joined #maemo | 16:46 | |
| *** sunshavi has quit IRC | 16:48 | |
| *** troulouliou_div2 has joined #maemo | 17:03 | |
| *** LauRoman|S has quit IRC | 17:09 | |
| *** Kabouik has joined #maemo | 17:19 | |
| *** Kabouik has quit IRC | 17:40 | |
| *** Kabouik has joined #maemo | 17:42 | |
| *** troulouliou_div2 has quit IRC | 17:52 | |
| *** troulouliou_div2 has joined #maemo | 18:00 | |
| *** sunshavi has joined #maemo | 18:00 | |
| *** troulouliou_div2 has quit IRC | 18:00 | |
| *** troulouliou_div2 has joined #maemo | 18:00 | |
| *** LauRoman|S has joined #maemo | 18:08 | |
| *** Kabouik has quit IRC | 18:23 | |
| *** Kabouik has joined #maemo | 18:36 | |
| *** Kabouik has quit IRC | 18:50 | |
| *** sunshavi has quit IRC | 19:00 | |
| *** infobot has quit IRC | 19:14 | |
| *** Kabouik has joined #maemo | 19:23 | |
| *** Kabouik has quit IRC | 19:25 | |
| *** thuttu77 has joined #maemo | 19:50 | |
| *** sunshavi has joined #maemo | 19:53 | |
| *** Kabouik has joined #maemo | 19:53 | |
| *** infobot has joined #maemo | 19:56 | |
| *** ChanServ sets mode: +v infobot | 19:56 | |
| *** infobot has quit IRC | 20:01 | |
| *** thuttu77 has quit IRC | 20:01 | |
| *** Kabouik has quit IRC | 20:04 | |
| *** Kabouik has joined #maemo | 20:05 | |
| *** Kabouik has quit IRC | 20:13 | |
| *** Kabouik has joined #maemo | 20:26 | |
| *** florian_kc has quit IRC | 20:26 | |
| *** Kabouik has quit IRC | 20:32 | |
| *** jskarvad has quit IRC | 21:03 | |
| *** florian_kc has joined #maemo | 21:36 | |
| *** dos1 has quit IRC | 21:43 | |
| *** dos1 has joined #maemo | 21:46 | |
| *** florian_kc is now known as florian | 21:53 | |
| *** ced117 has joined #maemo | 22:13 | |
| *** ced117 has joined #maemo | 22:13 | |
| *** infobot has joined #maemo | 22:19 | |
| *** ChanServ sets mode: +v infobot | 22:19 | |
| *** infobot has quit IRC | 22:38 | |
| *** infobot has joined #maemo | 22:39 | |
| *** ChanServ sets mode: +v infobot | 22:39 | |
| *** ced117 has quit IRC | 22:42 | |
| *** ced117 has joined #maemo | 22:44 | |
| *** ced117 has joined #maemo | 22:44 | |
| *** l_bratch has quit IRC | 23:11 | |
| *** l_bratch has joined #maemo | 23:13 | |
Generated by irclog2html.py 2.15.1 by Marius Gedminas - find it at mg.pov.lt!