Would You Implement Passwordless Login?

[unwesen]

Let’s start with SMS: http://www.washingtonpost.com/blogs/the-switch/wp/2014/12/18/german-researchers-discover-a-flaw-that-could-let-anyone-listen-to-your-cell-calls-and-read-your-texts/

Email suffers from other problems. There is very little security built into the email protocols, and there’s a bunch of issues with HTTPS being discovered recently.

Can I create a more secure login system than Gmail? Easily. Note, though, that that is only part of the problem.

Here is what you do:

1. Generate a key pair for public key cryptography. You can do this in JS in the browser these days.
2. Send the public key to your server along with whatever user identifying information you want.
3. Have the server sign it if it is happy with the user information, and send it back signed.
4. Install the private key part and the signed public key as a client certificate and use that for authentication from now on.

Is this convenient? With some effort, it could be made to work. Mostly, though, there are some lessons to be learned from it:

1. Password based authentication is insecure, get over it.
2. Replacing it with less security (as proposed) is a terrible idea, unless you work for the NSA. A more secure future requires more key management, not less. The key is to drive browser adoption of good key management solutions. Good key management makes using unique site keys easier, too.
3. This is still a bad solution; get used to the idea that SSL/TLS is a stopgap solution for security. We need more end-to-end security, and less transport security. But that leads off into an entirely new direction.

[gidday]

Back in the day when I was writing CMS for a few clients I always used this idea. Most of the people I was coding for were were using the CMS from work where they were already on their email. It made sense because it was easy (enter your email address and click on the link when it arrives) and you know when someone else is trying to enter the system using your email.

[ceeb]

@unwesen

There’s very little secure about either.

Therefore, any system which allows you to reset password or - worse - have it emailed to you is inherently insecure. Passwordless login is no more or less dangerous. Of course, it doesn’t need to be email or SMS - it’s just that those are the two most likely systems people use.

[unwesen]

You’re right. They are insecure.

Read my argument again. I’m not suggesting passwordless login is less secure than password based (though I haven’t really tried to analyze it; it might well turn out that it there is a significant flaw). I just commented that “email security” makes me laugh.