TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

A Method for Password-Less Authentication

53 点作者 hackguru将近 9 年前

9 条评论

simbalion将近 9 年前
The dependency list is missing &quot;Smart phone&quot;.<p>Anyone who&#x27;s spent time in hotels in recent years knows that since switching from mechanical keys to magnetic keys, sometimes the keys break and the guest is locked out of their hotel room, which of course they never discover until trying to open the door. Then they have to go to the front desk, probably stand in line, and request a replacement key.<p>Using smart phones as authentication devices suffers from this exact same problem. I can&#x27;t speak for iOS but every android phone I&#x27;ve had has experienced slow operation, crashes, and other kinds of issues at inopportune moments. When I am trying to log into something to perform a 5 minute task I don&#x27;t want to be delayed for 15 minutes while my phone chugs away at whatever.<p>I&#x27;m just one geek, but I have spent a lot of time thinking about &quot;alternatives to passwords&quot;. I have concluded the password is king. We use passwords everywhere, and we will continue to use passwords everywhere, until someone invents something better. In 100s of years nobody has done that yet (Mechanical keys are a kind of password).<p>Instead of trying to replace passwords which are reliable and simple to use, with complicated authentication systems which are not reliable and not simple, we should focus our efforts on improving password authentication in our existing apps (no more limitations), building great password tools like keepass.info, and encouraging the average user to use password tools and practice good password habits.
评论 #12105840 未加载
kabdib将近 9 年前
In the can-you-really-use-cell-phone-for-trusted-computing department:<p>I have had support agents come to me and say, &quot;This user was convinced to put his phone into developer mode and attach it to a computer running malware controlled by the attacker.&quot; Game over.<p>Okay, that is colossally stupid behavior. Unbelievable, to most of the audience here. But users will do the damnedest things, and platforms -- whatever their static security failings -- really need to be resilient against coerced or ill-guided user actions as well.<p>I&#x27;ve worked on platforms that have had very well designed security systems, but they also made very sharp distinctions between what could be done by a developer and a normal user, and for the most part those worlds did not intersect at all.<p>Android&#x27;s barrier of &quot;tap seven times here and you&#x27;re a developer&quot; is very low. It&#x27;s clever, and good for many reasons, but user security isn&#x27;t one of them.
评论 #12106828 未加载
评论 #12106691 未加载
cm2187将近 9 年前
It looks a bit like Steve Gibson&#x27;s SQRL (which uses QR code rather than bluetooth), which I think is an excellent idea. I just wish it was sponsored by someone more consensual&#x2F;followed by the tech community.<p>But the idea of saving a private key on a locked down, app whitelisting, disk encrypted device (like an iphone) and to have a protocole that does not rely on a third party (which currently are mostly google and the social networks, the last people on earth I would want to share which sites I login to) is appealing.
评论 #12108186 未加载
eximius将近 9 年前
The bluetooth dependency looka painful. But I&#x27;m also highly skeptical of the behavioural analysis. I feel like a piece of malware could replay recorded behaviour and attack at 2:30am when the user is probably close enough to trigger an automatic authentication.
评论 #12105348 未加载
swordswinger12将近 9 年前
This sentence worries me: &quot;any secure computation algorithm that can compare our choice of user behavioral signature without exposing it&quot; because it makes it seem as though there are lots of these just lying around. It seems like this would be very tricky to construct, especially given the inherent fuzziness of a signature&#x2F;fingerprint based on user behavior. Do zero-knowledge &#x27;proofs of behavior&#x27; exist?<p>EDIT: That said, I do think this is a cute idea.
评论 #12105318 未加载
dguido将近 9 年前
We released a passwordless auth library for iOS about 2 weeks ago. At first glance, it looks much simpler than the process described on this website. We also take advantage of Secure Enclave key storage rather than leave the authenticator somewhere that malware can steal.<p><a href="https:&#x2F;&#x2F;blog.trailofbits.com&#x2F;2016&#x2F;06&#x2F;28&#x2F;start-using-the-secure-enclave-crypto-api&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.trailofbits.com&#x2F;2016&#x2F;06&#x2F;28&#x2F;start-using-the-secu...</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;tidas" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;tidas</a>
aemus将近 9 年前
Reminds me of the Biometric Open Standard.<p>Link to draft: official one is behind paywall <a href="https:&#x2F;&#x2F;www.oasis-open.org&#x2F;committees&#x2F;download.php&#x2F;56664&#x2F;P2410d11.pdf" rel="nofollow">https:&#x2F;&#x2F;www.oasis-open.org&#x2F;committees&#x2F;download.php&#x2F;56664&#x2F;P24...</a>
评论 #12105581 未加载
alafazam将近 9 年前
Everything looks great, except for bluetooth. Can&#x27;t we use internet instead.?
评论 #12105382 未加载
rileytg将近 9 年前
NFC would mitigate the &quot;close enough to trigger&quot; attacker