Skip to content

Apple Announces Decision to Ditch Passwords

Chitchat
  • @phenomlab I guess this should be another thread, but after you post this meme, I wonder about your opinion on the new techniques to omit passwords…

    https://tech.co/news/apple-ditches-passwords

    Apple, Google, and Microsoft are going in this direction I guess.

  • @crazycells interesting topic, and one that’s been banded around the security community for years. Whilst it’s a good concept, even biometric security and passkeys have one major flaw - the end user responsible for the security itself.

    Ever heard of users being the weakest link ? In most cases, this is absolutely true. For example, you could have the highest grade security on offer, but once you put that electronic fortress into inexperienced hands, it may as well not be there at all. It’s long been considered that the “human firewall” is relatively simple to bypass, and it’s sadly a fact. Humans are susceptible to coercion - easily convinced that even something that looks too good to be true (and often is) is genuine - a “one time” opportunity too good to miss.

    Then there’s the social engineering side of things. It really doesn’t matter how strong your security is, the user in control of it can easily open the door to all sorts of unwanted activity, and allow sensitive information to simply walk out of the door at the same time.

    Will biometric security replacing passwords resolve this issue ? No - it’ll be exactly the same, just with a modern approach. What’s needed here is awareness - a constant reminder of what can easily happen if you lower your guard. We make the same mistake constantly by requiring users to change their passwords every x days - all that has achieved is to lower entropy and in fact weaken security in the process. This is something I’ve written about before

    https://sudonix.com/topic/135/changing-passwords-regularly-actually-weakens-security

    Users have a nasty habit of choosing weak passwords that they as humans can remember, and by definition, make that same password vulnerable to a dictionary attack or other simple mechanism - even brute force or sieve attacks - by adding a sequential number to satisfy the change, but to keep the password memorable.

    Admittedly, biometric security can stop that in it’s tracks and increasingly enhance the user experience, but it’s not a silver bullet - and should never be regarded as one.

    For all the time users remain unaware of the risk (or are ignorant to it), then no amount of security enhancements - even biometric - are not enough to increase security.

  • @phenomlab Thanks for the comment.

    I agree with you on users being the weakest link in the system… Let’s see how well or how fast this system will be adapted… I hope they can come up with a secure way that is not annoying…

    I actually started using the “1password” password manager quite some time ago for this purpose, and I have to tell you that my life got so much easier. I also turn on 2FA if the website offers one in the app, and I do not remember or know any of the passwords I have 😄 I only know 1 password that will unlock the 1password app 😄 and that is enough to fill the login page details… I usually pick a long alphanumeric password with some special characters in it, so it is hard to guess.

    Additionally, after my critical email addresses got exposed in several website hackings last year, I also started using “simplelogin.io” with a custom domain so that I could create unique email addresses for each website. I have been using this for the last 8 months or so, and happy so far…

    With this method, each website has a unique email address and also unique password. At least if I am hacked on website X, my info on website Y is still safe…

  • @crazycells good call with the password manager. I use Bitwarden myself for personal and family usage, and Dashlane for work. I’ve been experimenting with Bitwarden and it’s 2fa capabilities and I have to admit it’s impressive - so much so that I’m considering using this as a drop in replacement for Authy which I’ve been using for years.

  • @phenomlab said in Apple Announces Decision to Ditch Passwords:

    @crazycells good call with the password manager. I use Bitwarden myself for personal and family usage, and Dashlane for work. I’ve been experimenting with Bitwarden and it’s 2fa capabilities and I have to admit it’s impressive - so much so that I’m considering using this as a drop in replacement for Authy which I’ve been using for years.

    Yeah, I, too, prefer password managers filling 2FAs rather than me checking from an app on the phone. That is why I ditched Authy for this very reason 😄

  • @crazycells I suppose the only issue which immediately springs to mind here is that if the password manager becomes compromised - for example, if your master password is inadvertently leaked, then an attacker has both the password, and the TOTP code.

    This might not sit well with the more paranoid users, but be perfectly acceptable and convenient for the less discerning ones.

    Food for thought.

  • @phenomlab said in Apple Announces Decision to Ditch Passwords:

    @crazycells I suppose the only issue which immediately springs to mind here is that if the password manager becomes compromised - for example, if your master password is inadvertently leaked, then an attacker has both the password, and the TOTP code.

    This might not sit well with the more paranoid users, but be perfectly acceptable and convenient for the less discerning ones.

    Food for thought.

    yeah, but thanks to 1password, I am ok with this.
    they have a secondary level of encryption. so even if you got my master password, it is useless without a device that I have registered. It is not enough to decrypt my account, even online. You have to enter a “secret code” to add your device to the account so that you can decrypt your passwords on that device, and this secret code is given during registration only.

  • @crazycells That sounds like a solid solution.

  • Google has started to implement this several days ago , and I asked about this to @julian on NodeBB… I guess this passwordless access will be the new norm for many websites/apps…

    https://www.theverge.com/2023/5/3/23709318/google-accounts-passkey-support-password-2fa-fido-security-phishing

    https://community.nodebb.org/post/92962

  • @crazycells this is an interesting concept, and I’ve been looking at this same technology for a while now. However, I do think it has flaws in the sense that you can use multiple devices, and if one of those were stolen, that could then easily act as a gateway to gain access to your accounts via an unauthorized source.

    Admittedly, you could easily prevent access by disabling that specific device, but the window of opportunity would still exist for a short period of time, and that may be long enough for any nefarious actor to compromise your accounts.

    No technology is going to be absolutely perfect, and we have to accept that. However, I do think it’s going to be a while before this new method of authentication becomes mainstream.

  • @phenomlab yes, let’s see how it will be implemented. I am curious about it.

    For most people, I believe this device will be their phone. And I believe phones are quite secure since they will need a passcode to be opened anyway. And you cannot try indefinitely to find out the passcode.

  • @crazycells said in Apple Announces Decision to Ditch Passwords:

    And you cannot try indefinitely to find out the passcode.

    That’s very true. However, as we saw with the San Bernadino shooting, the FBI did in fact manage to hack that device
    https://www.theverge.com/2021/4/14/22383957/fbi-san-bernadino-iphone-hack-shooting-investigation

    However, I think your average criminal may not have the array of resources that the FBI has… 🙂

  • @phenomlab said in Apple Announces Decision to Ditch Passwords:

    However, I think your average criminal may not have the array of resources that the FBI has… 🙂

    lol I hope they do not 😄

  • @crazycells Who knows given today’s modern technology.


  • 3 Votes
    7 Posts
    208 Views

    @DownPW said in Proton launch password manager:

    And bitwarden can be self hosted

    Yes, correct.

    @DownPW said in Proton launch password manager:

    I’m now on KeepassXC bcause it’s free and without cloud account.

    Yes, looks good (albeit a little on the basic side, but who needs bells and whistles for password management?)

    https://keepassxc.org/

  • 11 Votes
    4 Posts
    214 Views

    happy holidays all
    merry christmas 🎄 🤶

  • 9 Votes
    23 Posts
    1k Views

    @JAC yes, same here. A lot of that functionality made it’s way into Vivaldi so you will probably feel at home.

  • 6 Votes
    4 Posts
    257 Views

    @crazycells that makes sense. Microsoft tried something similar with Windows but called it “optional updates” 🤦

  • 4 Votes
    2 Posts
    283 Views

    Here’s a very useful video that will walk you through the privacy features of Android - mostly around the ones you should disable to get the most out of the experience

  • 17 Votes
    21 Posts
    914 Views

    @crazycells said in Netflix hints at password sharing crackdown:

    We love laws, and would pay if we want to watch movies.

    I think you’ve hit the nail on the head here - particularly around the point re: privacy. I expect that other people are willing to abide by the laws also, but it’s very easy to see how rising prices will simply fuel the pirate industry even further. Nobody likes to be “ripped off” or “held to ransom”, and there are always going to be those who would rather not pay at all and put up with a poor video image taken in the cinema with someone’s head bobbing up and down, or overhearing someone complain they asked for an ice cream but got a donut… 🙂

    The rising costs of viewing material is what is in essence the fuel for the piracy market - not just viewing either - it used to be the case (before digital downloads of music tracks) that people were pirating CD’s because of the cost. With the onset of online music stores, that’s probably a thing of the past - I can’t recall overhearing anyone saying they spend all of their free time searching for mp3’s etc recently, unless I’m out of touch, but the film industry is encouraging piracy with the spiralling costs of attending the cinema etc - not to mention being robbed in broad daylight if you want refreshments.

  • 5 Votes
    6 Posts
    351 Views

    @DownPW Yes, data protection in the USA is lacklustre to say the least.

  • Member chat

    Moved Chitchat
    11
    5 Votes
    11 Posts
    485 Views

    @phenomlab sure has, keep up the good work!