« first day (3725 days earlier)      last day (46 days later) » 
09:00 - 17:0017:00 - 23:00

J--
9:47 AM
Morning.
 
Hey everyone
 
J--
10:22 AM
Hey Mech.
 
10:35 AM
morning guys
 
J--
Morning. How are you?
 
Doing okay
Just want to finish this week
Want to play GFR
 
J--
Yeah, this week has been stressful.
 
Though I'm more into GFD :D
 
J--
Having to rely on others to get this project completed fucking sucks.
As I said yesterday, I wish I would just get permission to do everything myself instead of all this red tape nonsense.
So frustrating.
 
10:48 AM
Understandable
 
J--
Yeah, it is most annoying because the project is my project, right.
So I see it like this; if another person fails to do their job, that is on me.
Everyone keeps telling me that isn't the case, but that is how I see it in my eyes...
It is really hard to NOT think like that. After all, it is my project.
 
11:10 AM
@J-- It prepares you for the real world
 
J--
What does? @JourneymanGeek
 
Other people wasting your time by not pulling their weight :D
Or so you think
 
J--
Yeah, fair point.
But that doesn't help me now.
I am the one who looks like a clown because others cannot do their job.
That isn't really real world because I could as easily complete this task myself.
But because of red tape, I cannot.
That is a stupid reason.
Guess it is something I just have to accept...
 
11:46 AM
@J-- Yeah having to accept stupid restrictions for no reason is what the real world is all about
 
 
2 hours later…
1:23 PM
@nobody Sad but true
@MechMK1 What are GFR and GFD? A few more hours and then you're off, right?
 
@ConorMancone GFR is "Gunfire Reborn", a game from a chinese developer, using chinese mythology
It's a mix of Risk of Rain 2, Borderlands and Doom.
I bought it a while ago and I am really really enjoying it
GFD...I better not say .D
 
@MechMK1 I had a suspicion that may be the case :)
Doom will always be one of my favorite games... good times!
The movie... not so much
out of all the video games that were ever adapted to movies, the only one that I really enjoyed was prince of persia
 
@ConorMancone The movie is entertaining in its own right, if you like "So good its bad" movies
But really, GFR is a really good game for just 10 bucks
Weapons drop randomly, and with a set of randomly chosen bonuses.
For example, there is a full-auto shotgun called "Illusion", which shoots faster the longer you hold the trigger. You can imagine that an inscription like "+65% more magazine size" is really good there
Or "Picked up ammo goes directly into the magazine"
Or my favouite: "Weapon deals fire damage" paired with "Weapon deals +100% damage against burning enemies"
 
@MechMK1 MUWAHAHAHA!!!! I need one of those in real life :)
Not sure what I would do with it, but.....
Hey, does anyone happen to know if there is a maximum allowed size for a content security policy?
 
2:05 PM
@ConorMancone Well, most web servers and browsers have a maximum size for HTTP headers so that would limit the size of your CSP.
 
J--
2:29 PM
@nobody Yeah I guess you're right.
 
2:41 PM
I got new idea. Lmk if you see any potential problems.
My idea is basically replicating SSH public key authentication on the web. Eliminate the need of passwords completely. Browser conducts authentication with the click of a button or automatically. Social engineering will also be basically impossible because there no password. The user would have no idea how to find their private key. The only big issue is transferring keys from browser to browser. This is relatively simple if users have a browser account.
On signup, the browser sends their public key to the website transparently to the user. Even if the website has a data breach, there is no risk of attackers getting passwords, hashed passwords, or anything that would allow them to access the account.
Instead of host key verification, HTTPS should be sufficient to prevent MITM attacks.
Thoughts?
 
98
Q: Certificate based authentication vs Username and Password authentication

StefanyWhat are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE I am interested as well in knowing what attacks are they prone to, e.g. as so far mentioned brute...

 
2:57 PM
@FireQuacker Hmm. But if it is integrated into the browser transparently, then I don't think most of those issues apply.
Second answer seems to lay out a couple more issues
 
> 1. Users are dumb
Fucking lost it right there
 
@JBis Is your idea different from client certificate authentication? I thought there was already something like that in browsers, just used extremely rarely.
 
J--
Good luck getting users to use SSH keys for websites lmfao
Users can barely use passwords.
 
@FireQuacker yes
the big difference is its all transparent and built into the browser
 
J--
The entire concept of an SSH key for a standard user is far too complex.
They don't even like using their phone number for 2FA.
 
3:03 PM
Think about ssh for a second, all you do (once the keys are set up) is enter a command and press enter
 
J--
"enter a command"
 
That is just the interface
 
J--
You realise 90% of the population has ZERO idea what that means.
 
Instead of entering a command, you click a button on a website
 
J--
3:03 PM
They don't even know what a key is.
They don't know how to use a key.
How to enter a command.
Or what any of that means.
 
Ok I am not explaining well
 
J--
No, I think what you're saying is very clear.
I just don't see any scenario where a user who isn't technical understands what this means or how to use it.
 
Sadly, I have to agree with J here
Non-tech users are remarkable
 
@J-- Isn't that a UX issue, then?
 
J--
No, it isn't a UX issue.
It is purely an issue that most users are not technical. Especially older users.
 
3:07 PM
This is from the user perspective:

Sign Up:
1. Where the password box would be there is nothing
2. User enters sign up information (email, username) and clicks "sign up" button
Done.

Sign In:
1. User clicks sign in button
Done.
(No mention of keys, ssh, or anything)
 
I left my grandfather alone for 2 minutes while he was playing Solitaire and when I came back he had C:\Windows\Windows32 open
 
It's less complicated then entering a password
 
@JBis What if they use a different browser? What if they're on a different device
 
J--
^
 
"Why can't I log in? It doesn't even ask for my password?"
 
3:07 PM
@MechMK1 This is an issue i'll address once we get over that first part
 
Trust me, I'd fucking LOVE if websites used public keys for auth
They just don't
@AnneBatch Hey there
 
J--
And likely never will...
 
@MechMK1 I mean, they just have to get used to "not entering a password"
 
@MechMK1 Helloo
 
@JBis As I said, when they register, they need to register a public key
 
3:08 PM
Would the certificates be shared across all browsers you're signed into?
 
Even if that is built-into the browser, that won't work well across browsers
 
@MechMK1 No. They don't need to do anything. The browser does it for them.
 
@AnneBatch How're you?
@JBis But that needs to be configured
Even if the browser is configured to automatically generate a key
 
@MechMK1 I'm fine, thanks! How about you?
 
It won't work across devices seamlessly
 
3:09 PM
@MechMK1 It's the web. You standardize it, and in 5 years 95% of users are running browsers supporting it.
 
@AnneBatch Doing okay too. Really glad to be done with work this week
 
@MechMK1 In what way does it need to be configured?
 
@JBis The problem isn't support. We already have Webauth
 
@JBis Dumb question... which part is the first part?
 
@MechMK1 Really. You're the best
 
3:10 PM
@FireQuacker the interface once the key is transferred to the browser
 
@JBis Okay, imagine I register for SE with my public key on my laptop. How does it now work to access SE on my phone? How about my tablet?
@AnneBatch Aww thanks. I hope your day was good too
 
@MechMK1 I'll talk about key transfer. But once the key is transferred (assuming that works flawlessly) do you see a problem?
 
@JBis "Once it's transferred" explain that to a guy who's phone breaks and needs to get a new one
"Why can't I log in anymoe?"
 
Ok, I'll address it
Two primary issues. Key transfer (new device) and account recovery (lost key probably due to lost phone)
 
J--
Key storage in general is an issue.
 
3:12 PM
^
 
Also you can't log in from a shared computer, period.
 
J--
^
 
The important thing is, most users don't understand what a "key" is
 
That's funny cause we literally have a real life counterpart for keys
 
Account recovery is easy. Same as now, you go to "forgot password/key" enter your email and you get a link sent to your email where instead of entering a new password, you can register a new public key.
@MechMK1 Again, they don't need to.
@J-- Keys are stored encrypted in the same fashion all browsers store saved passwords rights now.
 
3:14 PM
They kind of do, that is the problem. You can't completely abstract everything away. Sure, people will stat calling it different things like "register a new identity" or such
 
@MechMK1 that's fine
So key transfer is the only really big issue I see
 
Well, as I said, we already have Webauthn. Why is nobody using it?
That would actually be a really good question for the site
"Why is Webauthn not used as primary authentication method in most websites?"
 
J--
Mech is right on this "you can't completely abstract everything away". This is fundamentally a new concept to a user. Without some level of understanding of it, there will ALWAYS be cases where they are confused. Such is the same with passwords.
 
Don't remember much about WebAuthn but iirc it requires a third party authenticator like a hardware key or something
 
@JBis Not necessarily
 
J--
3:17 PM
You can't just reword things and expect that a user understands it.
 
@J-- Yes, we are striving for equal or better. In some places the complexity might be the same as passwords.
 
Passwords "work" more or less, because users understand the concept of a password. You see that public-key authentication only works with users who fundamentally understand how public-key cryptography works.
 
J--
While it might be in plain English, the idea itself is still technical.
The complexity is not the same as a password.
Not to a user it isn't.
THey've used passwords FOREVER.
Changing the entire system with a new one will only confuse them.
THat's assuming EVERYONE adopts this strategy too.
 
I disagree because of how simple the system will be
 
J--
You can disagree, sure.
 
3:19 PM
It's literately clicking a button
 
J--
But go online, find a site using this which isn't aimed at technical people.
Then you have your proof it works.
 
Every user can click a button
And any improvement to the system users will have to learn something
 
J--
There is a difference between learning an entirely new concept.
And adding to an existing one.
 
the user doesn't need to know how it works
 
J--
If it was so easy to implement this do you not think that sites like Facebook would have done it already?
As Mech said, you cannot just abstract it away. On some level they DO need to understand how it works.
 
3:22 PM
It can't be implemented until browsers support it
 
0
Q: Why is Webauthn not used as primary authentication method?

MechMK1In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all intents and purposes, this should be much more user-friendly than a traditional password-based au...

 
J--
Or they will only be more confused in the long run.
 
@JBis Clicking the button to sign in isn't the hard part. The hard part is explaining to people why a seemingly unrelated action suddenly made it impossible for them to log in.
 
J--
^ bingo
 
@FireQuacker When was the last time you lost a device?
Or anyone you know of lost a device
 
J--
3:23 PM
I don't get how that has any bearing on this.
People lose devices all the time, your point?
You cannot reduce the sample size to 1...
 
@JBis I... don't leave the house much
 
My grandfather lost his phone because it just wouldn't turn on anymore
 
When was the last time you logged into a website on a device you didn't own?
 
I last lost a hard drive because I dropped a hard-drive onto it
@JBis Literally right now
 
J--
You're asking these questions because YOU don't do that.
That isn't how this works.
 
3:24 PM
Ok bad example
 
J--
You cannot use yourself as the example.
 
@JBis An authentication method needs to work for everyone, not just most people.
 
J--
^
 
@MechMK1 Well, we could still have password support for legacy situations
 
@JBis Guess what everyone will use then?
Protip: It's the thing they're familiar with
People are remarkably stupid, don't forget that
 
3:26 PM
@MechMK1 Well it obv not be an overnight thing. Im sure you would use it and other technical people and then slowly users would use it.
 
People disabled TLS 1.2 and enabled SSLv3 because 3 > 1.2
@JBis Trust me, I would love to see public-key crypto everywhere.
I just doubt it will happen in the next 30 years
 
@MechMK1 thats funny
 
J--
We can't even get 2FA via SMS working.
I doubt we're going to get public key working.
(in regards to "normal" users)
 
> Now, one more thing: if I don't mention biometrics and WebAuthn they'll continually show up in the comments anyway. On the biometrics front, I'm a big supporter of things like Face ID and Windows Hello (I love my Logitech BRIO for that). But they don't replace passwords, rather provide you with an alternate means of authenticating. I still have my Apple account password and my Microsoft password, I just don't use them as frequently.
> WebAuthn has the potential to be awesome, not least of which because it's a W3C initiative and not a vendor pushing their cyber thing. But it's also extremely early days and even then, as with [insert things here], it will lead to a change in process that brings with it friction. The difference though - the great hope - is that it might redefine authentication to online services in an open, standardised way and ultimately achieve broad adoption. But that's many years out yet.
 
Honestly, if we can get computer literacy up in the next decades, that would be amazing
 
J--
3:27 PM
Agreed.
 
Quote from the Troy Hunt article
 
I will have to read more about WebAuthn
 
If 2050 >=50% of people have a rough understanding about what a "public key" is, then that's a HUGE win already.
 
J--
I think the general takeaway is that from a technical perspective t is a nice idea.
But from a users perspective we are SO far.
 
Agreed, technically it's really amazing!
But what good is a fancy tech solution your average user can't use?
 
3:29 PM
We would all be safer if it weren't for all those $%^& users
(Anybody want to bet that Mech's question hits the HNQ?)
 
"Explain to someone who has no understanding of an incredibly complicated system (and no desire to learn about said system) how to use said complicated system" is a fundamentally difficult thing to do
 
J--
lol ^^ £10
 
Time to get the bots and downvote it to oblivion
 
Maybe I am under estimating the complexity to users
I just think its less complex than passwords
 
J--
Since Facebook, Apple, TikTok, SnapChat, Instagram, WhatsApp, Twitter are not doing this you can bet you are.
 
3:31 PM
More like you underestimate the stupidity of users
 
J--
^
 
@JBis You have fallen prone to the curse of knowledge
Something is obvious to you, so it becomes difficult to understand how said thing can't be obvious to someone else.
 
Let me propose this
 
@MechMK1 well - its a bit of a chicken and egg problem
I'd LOVE to use something like that
but it takes time for most sties to do something like that
 
Many older users can't sign up for a website themselves
We are seeing even with COVID-19 vaccines, old people can't sign up to get their shots
Many times they will call their son/daughter/younger family member who has some technical knowledge
 
3:34 PM
@JBis I had to help my dad sign up cause they sent him a text with a URL and he couldn't get it on his PC
 
@JBis Even my mother had trouble, and she is quite computer literate. She also knows how public key crypto works.
 
That is who I am targeting
 
@JBis Let me rephrase: How many web developers do you think have no idea how public key crypto works?
I assure you: A LOT!
 
I don't think users need to*
 
Oh yes, they very much do
 
3:35 PM
If implemented properly, the user would never have to worry about keys or understand how it works
 
I am talking about the developer
If a webdev doesn't understand the fundamental concept behind their authentication, they're going to build a shoddy website
How many people do you think believe that a private key is "like a password"?
 
J--
Web devs still get passwords wrong on a daily basis :D
JUst last week I was in here talking about them hashing with md5 and storing only 15 characters lmfao
 
See, this is just how human nature works. If you don't understand something, your mind twists it into something you do understand.
 
@J-- Another thing this would solve
 
J--
But that doesn't mean devs don't have new challenges to understand/.
 
3:37 PM
they dont need to even hash the public key
 
J--
You act as if this is magic.
It isn't magic.
SOMEONE needs to understand it.
 
@JBis It would work, IFF people understand how it works
 
J--
Regardless of what you think, they cannot just implement something correctly that they don't understand.
 
If the biggest issue is getting devs to undrestand it, i consider it a success
 
J--
It isn't a success when it is totally wrong and more insecure.
 
3:38 PM
lol
 
@J-- One of the places I worked in had an internal 12 char minimum and forgot to change the front end from an 8 char maximum....
So when your password expired, you couldn't change it
 
J--
Hahahhahahaha :D
Nice.
 
@JourneymanGeek Something similar happened to me
 
Give me a circumstance when the user would need to know about keys
 
J--
We aren't talking about users anymore.
We already proved our point on that.
 
3:39 PM
@JBis "Plug in key, press button"
 
Alright
 
"insert card"
 
@JourneymanGeek No need to plug in key
or insert card
 
and older folks probably get physical devices better
@JBis Well I don't like "keys" cause it means I need to store a copy somewhere :D
 
They had an 8 char maximum first, then a 12 char minimum.

When changing my password, they told me my old password didn't meet character length requirements
@JBis Key management is still something users need to do
Even if it's "abstracted away"
 
3:40 PM
if it's abstracted away, users don't need to do it :)
 
J--
...
 
storing passwords securely on disk is a super complicated process, users do it all the time through the click of a button "would you like to save this password"
they don't need to have any idea how its being stored
 
@JBis unless your browser or other platform generated and shared the cert
 
@JBis You're conflating password managers with "memorable passwords"
 
or how it's synced with their 10 other devices
 
3:42 PM
I like how matrix does it
 
@JourneymanGeek that would also be abstracted away likely
 
(when you log into the other PC, you need to confirm its trusted on an already set up machine)
 
@JBis Also, how would you sync to other devices?
As in, how would you authenticate the other device?
Sounds like you need to use your key there. You know, the key which is on the other, broken device
And the key that the user doesn't know exists
 
@MechMK1 on the other hand, I just have N fido keys...
and if I lose one, I can just remove it from whatever service it is associated with
 
@JourneymanGeek You are also not the average user
 
3:44 PM
@MechMK1 well no
 
That's what J and I have been saying. This system would be amazing for tech-literate people
But tech-illiterate people will have a really big problem
 
(even if I'm probably the least techie person here :D )
@MechMK1 BUT if I set up a U2f device
 
I have two solutions neither of which I like. It's still an issue.

1. Site stores multiple public keys for each user for each device. When you register a new device the keys won't match up and site will prompt "we see you are logging in from a new device. we sent you a link please click to sign in" (this is identical to how discord does it. still no mention of key).

2. The key transfer is standardized and occurs through a browser account such as google chrome account or firefox account. This would be standardized so you can pull keys from various browser vendors. Still don't like this bec
 
and told my mom or dad "Its like a house key"
they would get it :)
 
regardless, there is no mention of keys or dealing with keys
for #2 you could implement "(when you log into the other PC, you need to confirm its trusted on an already set up machine)" for signing into the browser account
P.S. browser account would probably still use a password for now which goes back to troy hunt's point
 
3:49 PM
@JBis Too bad my already set-up machine is broken
 
@MechMK1 that's out of scope for this protocol, browser would have to deal with that. Maybe they just don't have that requirement or some kind of backup email.
 
J--
Absolutely it is not the same implications as using a password manager.
 
@J-- How so?
 
J--
You're suggesting sites give the private keys to other sites and all browsers?
Terrible idea.
 
@J-- what no
 
J--
3:51 PM
Then I don't understand that last part.
 
If I have my phone and my computer. I created the account on my computer so the key is on my computer. I want to sign in on my phone. I need to either transfer my phone's public key to website (idea #1) or transfer private key from my computer to my phone (idea #2).

In idea #2, computer would upload private key to google servers and sync with phone device in the same fashion chrome browsers perform password syncing https://support.google.com/chrome/answer/6197437?co=GENIE.Platform%3DAndroid&hl=en
 
@JBis That's a bit shit then, innit? Imagine I have one device where I registered and store all my authentication tokens, and suddenly it breaks. I am fucked then.
What other sites do is store your private key in a "paper format". They give you a list of words you have to write down and keep safe. Those words are your "private key", just in a different format.
 
@MechMK1 You would likely have it auto backed up to chrome servers
 
@JBis I can't authenticate with those though
Because the only device where my private key is stored has just exploded 2 seconds ago
 
No. Google would have your private keys albeit encrypted.
 
3:56 PM
@JBis And how can I prove to google that I am who I am?
 
@MechMK1 same way you do now, signing to your gmail account
 
@JBis And how do I sign into my Gmail account?
 
7 mins ago, by JBis
P.S. browser account would probably still use a password for now which goes back to troy hunt's point
 
So yeah, we're back to passwords
 
Of course
But we are still at a better place than we were before
 
3:57 PM
Which just shows that we can't get rid of passwords, at least not until people understand how public key crypto works
 
I am not seeking to get rid of all passwords
like 99% of them (where possible)
wouldn't you agree if everyone was doing that, we'd be in a better situation?
even if they still had a gmail password
 
J--
We never really disagreed with that...
 
I said repeatedly that I wished that this was done
 
J--
We disagreed you can get this working with non-technical users.
 
But it is impossible
 
J--
3:59 PM
^ for now
 
Because users are not tech-literate
 
J--
for a long while..
 
And you need tech-literate users for that
 
You keep saying that
 
J--
Yes.
 
3:59 PM
Because it's the crux of the argument
 
but in all the solutions i've proposed you've yet to point out an instance where they would actually need to know anything
idea #1 and idea #2, neither of them mention keys
sign up and sign in don't mention keys
nothing mentions keys or any synonym
 
J--
As I already said, if this was so easy to implement and it would not impact non-techy users then Facebook, Google, Twitter, Apple, etc, etc would have already done it.
The fact they have not should be your answer.
 
@J-- somethings not done until its done
 
J--
Nobody disagrees that it is a good technical solution.
That is not an answer...
That is an avoidance of my point.
And now I am going to exit this conversation and go to the store.
 
You are saying "well if it could be done it would have been done already"
 
J--
4:02 PM
I know what I said.
You don't need to quote me.
Take care. Back soon.
 
Alright, either way thanks all for talking this out with me!
o/
 
Sure thing
 
4:26 PM
I know I'm late to this argument. But I think the problems on the user's side could be worked out eventually.
However, to get this to work, you'd have to make a standard for this. Then get the browsers to implement it. Then get websites to start implementing it. Then get the users to switch over to this (that's the most difficult part, not because people won't understand (you can abstract things away) but because people don't like to change their workflow.) All this is going to take a long long long long time to happen.
And it might never even take off. Which is probably why Facebook, Google, Twitter, Apple, etc haven't bothered to try implementing this
 
@nobody i think this is fair. Well the first step is making a good spec for browsers to implement, ill start with that.
Another interesting point is privacy. If the browser provided the same public key each time a website asked for it, it could be used for cross site tracking. I the browser would need to generate a new key pair for each website?
 
4:42 PM
Of course
If you used one key and it got compromised, then you'd have to go to every site you ever went and change your key with them
@JBis Just remember that steps 3 and 4 are a chicken and egg problem. Users won't adopt it unless the majority of sites use this (cuz why would I adopt a separate auth mechanism for just that one site)? Sites won't implement it unless a significant percentage of users use it (why waste dev time for something nobody will use?)
 
true
i wonder if a more general spec would be better (public-keys would be an extension later on). A persistent browser API for storing and retrieving private random secure values. One use case would be passwords. Instead of having a user enter a password, the browser generates one and stores it. Similar to a password manager but built into the browser and transparent to the user. Websites could retrieve it when needed for authentication.
In fact, it would be extremely easy to implement for developers. Transparent for users. And simply an abstraction on top of passwords (for now).
 
@JBis cookies?
 
lol, sorta but not always sent and stored differently
 
iirc chrome encrypts cookies the same way it encrypts passwords
 
but cookies are synced with devices (annoyingly)
 
4:54 PM
ok so you want to add a mechanism to transfer cookies across multiple devices?
 
no, i want to add an API to directly access password managers
 
hmmm... that will prevent me from having multiple accounts on the same website
unless you add an option for choosing which account I want to sign in with. But then we are back to where we were
 
shit
:(
 
09:00 - 17:0017:00 - 23:00

« first day (3725 days earlier)      last day (46 days later) »