The DMZ

Hey everyone

Anonymous

10:22 AM

Hey Mech.

ThoriumBR

10:35 AM

morning guys

Anonymous

Morning. How are you?

Doing okay

Just want to finish this week

Want to play GFR

Anonymous

Yeah, this week has been stressful.

Though I'm more into GFD :D

Anonymous

Having to rely on others to get this project completed fucking sucks.

Anonymous

10:45 AM

As I said yesterday, I wish I would just get permission to do everything myself instead of all this red tape nonsense.

Anonymous

So frustrating.

Understandable

Anonymous

Yeah, it is most annoying because the project is my project, right.

Anonymous

So I see it like this; if another person fails to do their job, that is on me.

Anonymous

Everyone keeps telling me that isn't the case, but that is how I see it in my eyes...

Anonymous

10:50 AM

It is really hard to NOT think like that. After all, it is my project.

11:10 AM

@J-- It prepares you for the real world

Anonymous

What does? @JourneymanGeek

Other people wasting your time by not pulling their weight :D

Or so you think

Anonymous

Yeah, fair point.

Anonymous

But that doesn't help me now.

Anonymous

I am the one who looks like a clown because others cannot do their job.

Anonymous

11:14 AM

That isn't really real world because I could as easily complete this task myself.

Anonymous

But because of red tape, I cannot.

Anonymous

That is a stupid reason.

Anonymous

Guess it is something I just have to accept...

11:46 AM

@J-- Yeah having to accept stupid restrictions for no reason is what the real world is all about

Conor Mancone

1:23 PM

@nobody Sad but true

@MechMK1 What are GFR and GFD? A few more hours and then you're off, right?

@ConorMancone GFR is "Gunfire Reborn", a game from a chinese developer, using chinese mythology

It's a mix of Risk of Rain 2, Borderlands and Doom.

I bought it a while ago and I am really really enjoying it

GFD...I better not say .D

Conor Mancone

@MechMK1 I had a suspicion that may be the case :)

Doom will always be one of my favorite games... good times!

The movie... not so much

out of all the video games that were ever adapted to movies, the only one that I really enjoyed was prince of persia

@ConorMancone The movie is entertaining in its own right, if you like "So good its bad" movies

But really, GFR is a really good game for just 10 bucks

Weapons drop randomly, and with a set of randomly chosen bonuses.

For example, there is a full-auto shotgun called "Illusion", which shoots faster the longer you hold the trigger. You can imagine that an inscription like "+65% more magazine size" is really good there

Or "Picked up ammo goes directly into the magazine"

Or my favouite: "Weapon deals fire damage" paired with "Weapon deals +100% damage against burning enemies"

Conor Mancone

@MechMK1 MUWAHAHAHA!!!! I need one of those in real life :)

Not sure what I would do with it, but.....

Hey, does anyone happen to know if there is a maximum allowed size for a content security policy?

2:05 PM

@ConorMancone Well, most web servers and browsers have a maximum size for HTTP headers so that would limit the size of your CSP.

Anonymous

2:29 PM

@nobody Yeah I guess you're right.

2:41 PM

I got new idea. Lmk if you see any potential problems.

My idea is basically replicating SSH public key authentication on the web. Eliminate the need of passwords completely. Browser conducts authentication with the click of a button or automatically. Social engineering will also be basically impossible because there no password. The user would have no idea how to find their private key. The only big issue is transferring keys from browser to browser. This is relatively simple if users have a browser account.

On signup, the browser sends their public key to the website transparently to the user. Even if the website has a data breach, there is no risk of attackers getting passwords, hashed passwords, or anything that would allow them to access the account.

Instead of host key verification, HTTPS should be sufficient to prevent MITM attacks.

Thoughts?

Q: Certificate based authentication vs Username and Password authentication

98

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE I am interested as well in knowing what attacks are they prone to, e.g. as so far mentioned brute...

2:57 PM

@FireQuacker Hmm. But if it is integrated into the browser transparently, then I don't think most of those issues apply.

Second answer seems to lay out a couple more issues

> 1. Users are dumb

Fucking lost it right there

@JBis Is your idea different from client certificate authentication? I thought there was already something like that in browsers, just used extremely rarely.

Anonymous

Good luck getting users to use SSH keys for websites lmfao

Anonymous

Users can barely use passwords.

@FireQuacker yes

the big difference is its all transparent and built into the browser

Anonymous

3:02 PM

The entire concept of an SSH key for a standard user is far too complex.

Anonymous

They don't even like using their phone number for 2FA.

Think about ssh for a second, all you do (once the keys are set up) is enter a command and press enter

Anonymous

"enter a command"

That is just the interface

Anonymous

You realise 90% of the population has ZERO idea what that means.

3:03 PM

Obligatory Troy Hunt reference: Here's Why (Insert Thing Here) Is Not a Password Killer

Instead of entering a command, you click a button on a website

Anonymous

They don't even know what a key is.

Anonymous

They don't know how to use a key.

Anonymous

How to enter a command.

Anonymous

Or what any of that means.

3:04 PM

Ok I am not explaining well

Anonymous

No, I think what you're saying is very clear.

Anonymous

I just don't see any scenario where a user who isn't technical understands what this means or how to use it.

Sadly, I have to agree with J here

Non-tech users are remarkable

@J-- Isn't that a UX issue, then?

Anonymous

No, it isn't a UX issue.

Anonymous

3:06 PM

It is purely an issue that most users are not technical. Especially older users.

This is from the user perspective:

Sign Up:
1. Where the password box would be there is nothing
2. User enters sign up information (email, username) and clicks "sign up" button
Done.

Sign In:
1. User clicks sign in button
Done.
(No mention of keys, ssh, or anything)

I left my grandfather alone for 2 minutes while he was playing Solitaire and when I came back he had C:\Windows\Windows32 open

It's less complicated then entering a password

@JBis What if they use a different browser? What if they're on a different device

Anonymous

^

3:07 PM

"Why can't I log in? It doesn't even ask for my password?"

@MechMK1 This is an issue i'll address once we get over that first part

Trust me, I'd fucking LOVE if websites used public keys for auth

They just don't

@AnneBatch Hey there

Anonymous

And likely never will...

@MechMK1 I mean, they just have to get used to "not entering a password"

Anne Batch

@MechMK1 Helloo

3:08 PM

@JBis As I said, when they register, they need to register a public key

Would the certificates be shared across all browsers you're signed into?

Even if that is built-into the browser, that won't work well across browsers

@MechMK1 No. They don't need to do anything. The browser does it for them.

@AnneBatch How're you?

@JBis But that needs to be configured

Even if the browser is configured to automatically generate a key

Anne Batch

@MechMK1 I'm fine, thanks! How about you?

3:09 PM

It won't work across devices seamlessly

@MechMK1 It's the web. You standardize it, and in 5 years 95% of users are running browsers supporting it.

@AnneBatch Doing okay too. Really glad to be done with work this week

@MechMK1 In what way does it need to be configured?

@JBis The problem isn't support. We already have Webauth

@JBis Dumb question... which part is the first part?

Anne Batch

3:09 PM

@MechMK1 Really. You're the best

@FireQuacker the interface once the key is transferred to the browser

@JBis Okay, imagine I register for SE with my public key on my laptop. How does it now work to access SE on my phone? How about my tablet?

@AnneBatch Aww thanks. I hope your day was good too

@MechMK1 I'll talk about key transfer. But once the key is transferred (assuming that works flawlessly) do you see a problem?

@JBis "Once it's transferred" explain that to a guy who's phone breaks and needs to get a new one

"Why can't I log in anymoe?"

Ok, I'll address it

Two primary issues. Key transfer (new device) and account recovery (lost key probably due to lost phone)

Anonymous

3:12 PM

Key storage in general is an issue.

^

Also you can't log in from a shared computer, period.

Anonymous

^

The important thing is, most users don't understand what a "key" is

That's funny cause we literally have a real life counterpart for keys

3:13 PM

Account recovery is easy. Same as now, you go to "forgot password/key" enter your email and you get a link sent to your email where instead of entering a new password, you can register a new public key.

@MechMK1 Again, they don't need to.

@J-- Keys are stored encrypted in the same fashion all browsers store saved passwords rights now.

They kind of do, that is the problem. You can't completely abstract everything away. Sure, people will stat calling it different things like "register a new identity" or such

@MechMK1 that's fine

So key transfer is the only really big issue I see

Well, as I said, we already have Webauthn. Why is nobody using it?

That would actually be a really good question for the site

"Why is Webauthn not used as primary authentication method in most websites?"

Anonymous

Mech is right on this "you can't completely abstract everything away". This is fundamentally a new concept to a user. Without some level of understanding of it, there will ALWAYS be cases where they are confused. Such is the same with passwords.

Don't remember much about WebAuthn but iirc it requires a third party authenticator like a hardware key or something

3:17 PM

@JBis Not necessarily

Anonymous

You can't just reword things and expect that a user understands it.

@J-- Yes, we are striving for equal or better. In some places the complexity might be the same as passwords.

Passwords "work" more or less, because users understand the concept of a password. You see that public-key authentication only works with users who fundamentally understand how public-key cryptography works.

Anonymous

While it might be in plain English, the idea itself is still technical.

Anonymous

The complexity is not the same as a password.

Anonymous

3:18 PM

Not to a user it isn't.

Anonymous

THey've used passwords FOREVER.

Anonymous

Changing the entire system with a new one will only confuse them.

Anonymous

THat's assuming EVERYONE adopts this strategy too.

I disagree because of how simple the system will be

Anonymous

You can disagree, sure.

3:19 PM

It's literately clicking a button

Anonymous

But go online, find a site using this which isn't aimed at technical people.

Anonymous

Then you have your proof it works.

Every user can click a button

And any improvement to the system users will have to learn something

Anonymous

There is a difference between learning an entirely new concept.

Anonymous

And adding to an existing one.

3:21 PM

the user doesn't need to know how it works

Anonymous

If it was so easy to implement this do you not think that sites like Facebook would have done it already?

Anonymous

As Mech said, you cannot just abstract it away. On some level they DO need to understand how it works.

It can't be implemented until browsers support it

Q: Why is Webauthn not used as primary authentication method?

0

In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all intents and purposes, this should be much more user-friendly than a traditional password-based au...

authentication passwords webauthn

Anonymous

Or they will only be more confused in the long run.

3:22 PM

@JBis Clicking the button to sign in isn't the hard part. The hard part is explaining to people why a seemingly unrelated action suddenly made it impossible for them to log in.

Anonymous

^ bingo

@FireQuacker When was the last time you lost a device?

Or anyone you know of lost a device

Anonymous

I don't get how that has any bearing on this.

Anonymous

People lose devices all the time, your point?

Anonymous

You cannot reduce the sample size to 1...

3:23 PM

@JBis I... don't leave the house much

My grandfather lost his phone because it just wouldn't turn on anymore

When was the last time you logged into a website on a device you didn't own?

I last lost a hard drive because I dropped a hard-drive onto it

@JBis Literally right now

Anonymous

You're asking these questions because YOU don't do that.

Anonymous

That isn't how this works.

3:24 PM

Ok bad example

Anonymous

You cannot use yourself as the example.

@JBis An authentication method needs to work for everyone, not just most people.

Anonymous

^

@MechMK1 Well, we could still have password support for legacy situations

@JBis Guess what everyone will use then?

Protip: It's the thing they're familiar with

People are remarkably stupid, don't forget that

3:26 PM

@MechMK1 Well it obv not be an overnight thing. Im sure you would use it and other technical people and then slowly users would use it.

People disabled TLS 1.2 and enabled SSLv3 because 3 > 1.2

@JBis Trust me, I would love to see public-key crypto everywhere.

I just doubt it will happen in the next 30 years

@MechMK1 thats funny

Anonymous

We can't even get 2FA via SMS working.

Anonymous

I doubt we're going to get public key working.

Anonymous

(in regards to "normal" users)

3:27 PM

> Now, one more thing: if I don't mention biometrics and WebAuthn they'll continually show up in the comments anyway. On the biometrics front, I'm a big supporter of things like Face ID and Windows Hello (I love my Logitech BRIO for that). But they don't replace passwords, rather provide you with an alternate means of authenticating. I still have my Apple account password and my Microsoft password, I just don't use them as frequently.

> WebAuthn has the potential to be awesome, not least of which because it's a W3C initiative and not a vendor pushing their cyber thing. But it's also extremely early days and even then, as with [insert things here], it will lead to a change in process that brings with it friction. The difference though - the great hope - is that it might redefine authentication to online services in an open, standardised way and ultimately achieve broad adoption. But that's many years out yet.

Honestly, if we can get computer literacy up in the next decades, that would be amazing

Anonymous

Agreed.

Quote from the Troy Hunt article

I will have to read more about WebAuthn

If 2050 >=50% of people have a rough understanding about what a "public key" is, then that's a HUGE win already.

Anonymous

3:28 PM

I think the general takeaway is that from a technical perspective t is a nice idea.

Anonymous

But from a users perspective we are SO far.

Agreed, technically it's really amazing!

But what good is a fancy tech solution your average user can't use?

We would all be safer if it weren't for all those $%^& users

(Anybody want to bet that Mech's question hits the HNQ?)

"Explain to someone who has no understanding of an incredibly complicated system (and no desire to learn about said system) how to use said complicated system" is a fundamentally difficult thing to do

Anonymous

lol ^^ £10

3:31 PM

Time to get the bots and downvote it to oblivion

Maybe I am under estimating the complexity to users

I just think its less complex than passwords

Anonymous

Since Facebook, Apple, TikTok, SnapChat, Instagram, WhatsApp, Twitter are not doing this you can bet you are.

More like you underestimate the stupidity of users

Anonymous

^

@JBis You have fallen prone to the curse of knowledge

Something is obvious to you, so it becomes difficult to understand how said thing can't be obvious to someone else.

3:32 PM

Let me propose this

@MechMK1 well - its a bit of a chicken and egg problem

I'd LOVE to use something like that

but it takes time for most sties to do something like that

Many older users can't sign up for a website themselves

We are seeing even with COVID-19 vaccines, old people can't sign up to get their shots

Many times they will call their son/daughter/younger family member who has some technical knowledge

@JBis I had to help my dad sign up cause they sent him a text with a URL and he couldn't get it on his PC

@JBis Even my mother had trouble, and she is quite computer literate. She also knows how public key crypto works.

That is who I am targeting

3:34 PM

@JBis Let me rephrase: How many web developers do you think have no idea how public key crypto works?

I assure you: A LOT!

I don't think users need to*

Oh yes, they very much do

If implemented properly, the user would never have to worry about keys or understand how it works

I am talking about the developer

If a webdev doesn't understand the fundamental concept behind their authentication, they're going to build a shoddy website

How many people do you think believe that a private key is "like a password"?

Anonymous

Web devs still get passwords wrong on a daily basis :D

Anonymous

3:36 PM

JUst last week I was in here talking about them hashing with md5 and storing only 15 characters lmfao

See, this is just how human nature works. If you don't understand something, your mind twists it into something you do understand.

@J-- Another thing this would solve

Anonymous

But that doesn't mean devs don't have new challenges to understand/.

they dont need to even hash the public key

Anonymous

You act as if this is magic.

Anonymous

3:37 PM

It isn't magic.

Anonymous

SOMEONE needs to understand it.

@JBis It would work, IFF people understand how it works

Anonymous

Regardless of what you think, they cannot just implement something correctly that they don't understand.

If the biggest issue is getting devs to undrestand it, i consider it a success

Anonymous

It isn't a success when it is totally wrong and more insecure.

3:38 PM

lol

@J-- One of the places I worked in had an internal 12 char minimum and forgot to change the front end from an 8 char maximum....

So when your password expired, you couldn't change it

Anonymous

Hahahhahahaha :D

Anonymous

Nice.

@JourneymanGeek Something similar happened to me

Give me a circumstance when the user would need to know about keys

Anonymous

3:39 PM

We aren't talking about users anymore.

Anonymous

We already proved our point on that.

@JBis "Plug in key, press button"

Alright

"insert card"

@JourneymanGeek No need to plug in key

or insert card

3:39 PM

and older folks probably get physical devices better

@JBis Well I don't like "keys" cause it means I need to store a copy somewhere :D

They had an 8 char maximum first, then a 12 char minimum.

When changing my password, they told me my old password didn't meet character length requirements

@JBis Key management is still something users need to do

Even if it's "abstracted away"

if it's abstracted away, users don't need to do it :)

Anonymous

...

storing passwords securely on disk is a super complicated process, users do it all the time through the click of a button "would you like to save this password"

they don't need to have any idea how its being stored

@JBis unless your browser or other platform generated and shared the cert

3:42 PM

@JBis You're conflating password managers with "memorable passwords"

or how it's synced with their 10 other devices

I like how matrix does it

@JourneymanGeek that would also be abstracted away likely

(when you log into the other PC, you need to confirm its trusted on an already set up machine)

@JBis Also, how would you sync to other devices?

As in, how would you authenticate the other device?

Sounds like you need to use your key there. You know, the key which is on the other, broken device

And the key that the user doesn't know exists

3:43 PM

@MechMK1 on the other hand, I just have N fido keys...

and if I lose one, I can just remove it from whatever service it is associated with

@JourneymanGeek You are also not the average user

@MechMK1 well no

That's what J and I have been saying. This system would be amazing for tech-literate people

But tech-illiterate people will have a really big problem

(even if I'm probably the least techie person here :D )

@MechMK1 BUT if I set up a U2f device

I have two solutions neither of which I like. It's still an issue.

1. Site stores multiple public keys for each user for each device. When you register a new device the keys won't match up and site will prompt "we see you are logging in from a new device. we sent you a link please click to sign in" (this is identical to how discord does it. still no mention of key).

2. The key transfer is standardized and occurs through a browser account such as google chrome account or firefox account. This would be standardized so you can pull keys from various browser vendors. Still don't like this bec…

3:46 PM

and told my mom or dad "Its like a house key"

they would get it :)

regardless, there is no mention of keys or dealing with keys

for #2 you could implement "(when you log into the other PC, you need to confirm its trusted on an already set up machine)" for signing into the browser account

P.S. browser account would probably still use a password for now which goes back to troy hunt's point

@JBis Too bad my already set-up machine is broken

@MechMK1 that's out of scope for this protocol, browser would have to deal with that. Maybe they just don't have that requirement or some kind of backup email.

Anonymous

Absolutely it is not the same implications as using a password manager.

@J-- How so?

Anonymous

3:50 PM

You're suggesting sites give the private keys to other sites and all browsers?

Anonymous

Terrible idea.

@J-- what no

Anonymous

Then I don't understand that last part.

If I have my phone and my computer. I created the account on my computer so the key is on my computer. I want to sign in on my phone. I need to either transfer my phone's public key to website (idea #1) or transfer private key from my computer to my phone (idea #2).

In idea #2, computer would upload private key to google servers and sync with phone device in the same fashion chrome browsers perform password syncing https://support.google.com/chrome/answer/6197437?co=GENIE.Platform%3DAndroid&hl=en

@JBis That's a bit shit then, innit? Imagine I have one device where I registered and store all my authentication tokens, and suddenly it breaks. I am fucked then.

What other sites do is store your private key in a "paper format". They give you a list of words you have to write down and keep safe. Those words are your "private key", just in a different format.

3:55 PM

@MechMK1 You would likely have it auto backed up to chrome servers

@JBis I can't authenticate with those though

Because the only device where my private key is stored has just exploded 2 seconds ago

No. Google would have your private keys albeit encrypted.

@JBis And how can I prove to google that I am who I am?

@MechMK1 same way you do now, signing to your gmail account

@JBis And how do I sign into my Gmail account?

3:57 PM

7 mins ago, by JBis

P.S. browser account would probably still use a password for now which goes back to troy hunt's point

So yeah, we're back to passwords

Of course

But we are still at a better place than we were before

Which just shows that we can't get rid of passwords, at least not until people understand how public key crypto works

I am not seeking to get rid of all passwords

like 99% of them (where possible)

wouldn't you agree if everyone was doing that, we'd be in a better situation?

even if they still had a gmail password

Anonymous

We never really disagreed with that...

3:58 PM

I said repeatedly that I wished that this was done

Anonymous

We disagreed you can get this working with non-technical users.

But it is impossible

Anonymous

^ for now

Because users are not tech-literate

Anonymous

for a long while..

3:59 PM

And you need tech-literate users for that

You keep saying that

Anonymous

Yes.

Because it's the crux of the argument

but in all the solutions i've proposed you've yet to point out an instance where they would actually need to know anything

idea #1 and idea #2, neither of them mention keys

sign up and sign in don't mention keys

nothing mentions keys or any synonym

Anonymous

As I already said, if this was so easy to implement and it would not impact non-techy users then Facebook, Google, Twitter, Apple, etc, etc would have already done it.

Anonymous

4:01 PM

The fact they have not should be your answer.

@J-- somethings not done until its done

Anonymous

Nobody disagrees that it is a good technical solution.

Anonymous

That is not an answer...

Anonymous

That is an avoidance of my point.

Anonymous

And now I am going to exit this conversation and go to the store.

4:02 PM

You are saying "well if it could be done it would have been done already"

Anonymous

I know what I said.

Anonymous

You don't need to quote me.

Anonymous

Take care. Back soon.

Alright, either way thanks all for talking this out with me!

o/

Sure thing

4:26 PM

I know I'm late to this argument. But I think the problems on the user's side could be worked out eventually.

However, to get this to work, you'd have to make a standard for this. Then get the browsers to implement it. Then get websites to start implementing it. Then get the users to switch over to this (that's the most difficult part, not because people won't understand (you can abstract things away) but because people don't like to change their workflow.) All this is going to take a long long long long time to happen.

And it might never even take off. Which is probably why Facebook, Google, Twitter, Apple, etc haven't bothered to try implementing this

@nobody i think this is fair. Well the first step is making a good spec for browsers to implement, ill start with that.

Another interesting point is privacy. If the browser provided the same public key each time a website asked for it, it could be used for cross site tracking. I the browser would need to generate a new key pair for each website?

4:42 PM

Of course

If you used one key and it got compromised, then you'd have to go to every site you ever went and change your key with them

@JBis Just remember that steps 3 and 4 are a chicken and egg problem. Users won't adopt it unless the majority of sites use this (cuz why would I adopt a separate auth mechanism for just that one site)? Sites won't implement it unless a significant percentage of users use it (why waste dev time for something nobody will use?)

true

i wonder if a more general spec would be better (public-keys would be an extension later on). A persistent browser API for storing and retrieving private random secure values. One use case would be passwords. Instead of having a user enter a password, the browser generates one and stores it. Similar to a password manager but built into the browser and transparent to the user. Websites could retrieve it when needed for authentication.

In fact, it would be extremely easy to implement for developers. Transparent for users. And simply an abstraction on top of passwords (for now).

@JBis cookies?

lol, sorta but not always sent and stored differently

iirc chrome encrypts cookies the same way it encrypts passwords

but cookies are synced with devices (annoyingly)