HN Explorer

19 comments

[ 48.7 ms ] story [ 135 ms ] thread
brennenHN
This is why we're storing important user credentials on a user's phone instead of all on a central server! (https://clef.io)
chunsaker
What happens if your phone gets stolen?
kdude63
Then wouldn't that be the user's fault/problem?
chunsaker
Sure, but designing around the inherent riskiness of user behavior/forgetfulness is an important part of security systems. Users want to be protected, not for blame to be shifted to them.
mistercow
Then one user's password gets stolen, as opposed to thousands.
chunsaker
Yes, it certainly mitigates the scale of a potential breach and I like that the reduced scale/potential value makes it a less attractive target to hackers (assuming the server side is also built in a secure way). I havent investigated, but it makes me nervous to think that if my phone is stolen, the thief gets my data too.
dasil003
0.0000014286% of the damage that happens when Sony's database gets hacked (assuming equal payload).
dmix
As a consumer though, I could change my password on a server if it gets stolen. But how would I reset it after my phone was stolen if authentication is all stored client side?
freehunter
Use a PIN, and if possible, encrypt your phone. It won't completely mitigate the risk, but it will reduce your surface area.
jlkinsel
Hmm...that seems to have potential, but it requires custom integration and users to use your app.

Is there an open protocol for this?

Looks like you're doing something similar to the mutual auth that wikid does...a whitepaper or two with more depth would be useful on the site

ScottWhigham
Is this just thinly veiled spam for that site? I can't tell if you work for them or not but, if you do, it's not in your profile. If so, I think it's pretty tacky when companies to take every possible opportunity to get their name out there...
chunsaker
Profile updated. Thanks, didn't mean to be disingenuous. Its okay to call me tacky - I actually think this stuff matters.
scrumper
I think ScottWhigham was talking about brennanHN rather than you. Nothing tacky about your submission.
anExcitedBeast
This is pointless. Solutions like keepass are just as good and don't require existing services to hook into new authentication API's. In fact, they're better because they don't run the risk of opening a whole new central attack surface.
michaelhoffman
Part of the $172 million Sony reports includes "rebuilding their user management and security systems." But having satisfactory user management and security systems in the first place is what would have allowed them to avoid such an attack. It's not an extra cost from failing to engineer things correctly; it's the cost of engineering things correctly.
pavel_lishin
Good point; the extra cost is what they paid to develop the original poorly designed systems. (I wonder how much that was?)
shaggyfrog
> That $400k is nothing compared to the total cost. Sony reported an estimated outlay of $171M for insurance, customer support, and rebuilding their user management and security systems. Since the breach, partially due to a drop in customer confidence, Sony’s stock price has dropped from $30 to $13.

Post hoc ergo propter hoc.

expralitemonk
Sounds like a great reason to form an LLC for any software endeavor.
eurleif
Most of the costs mentioned here are business costs, not legal liability. And I doubt a small developer would get a $400k fine for a password breach.