I disagree with this take because of the way people share passwords OOB right now meets zero security criteria.
- signal requires both users have signal and those personal contacts, as many regulated businesses can't use signal.
- Keybase isn't something people whose world is spreadsheets and slide decks encounter.
- 1Password requires an app or extension install.
Commercial options are so not economical that the OP went and built something.
I've worked on authenticator products, some which were standards candidates, along with a lot of identity and security architecture, and at limited scales, there is no risk in a third party generating the secret you're going to use for something that said party has no way to find.
Honestly, a lot of security concern reduces to bullshit, and for a limited set of use cases, like sending a password protected zip file between organizations, this online tool is pretty good. I commented elsewhere on the thread about some conditions, but really, this tool is just what most people need.
friction from cumbersome security workflows that people avoid creates more risk than using useful tools with some risk in them. pathological risk aversion is not security value either.
I'd like you to walk someone whose job isn't tech through generating a keypair, explaining to their counter party how to do the same, and they're going to exchange the secret using GPG for a zip file they are emailing. In 99% of cases it's stupid and discredits security as a field to raise histrionic criticisms and concerns.
Some secrets are more secret than others, and for low sensitivity tokens like temporary passwords, the risk/reward on this solution disqualifies the objections in your comment.
I was commenting more on "here's your password for this or that service", or a manual password reset process -- anything that would go into a table of hashes for an online service.
Risk I see is that this service is a target for folks who want to add some "known passwords" to their set. (Or maybe it's a honeypot for them, on account of how obvious of a target it is.)
Comments
I disagree with this take because of the way people share passwords OOB right now meets zero security criteria.
- signal requires both users have signal and those personal contacts, as many regulated businesses can't use signal.
- Keybase isn't something people whose world is spreadsheets and slide decks encounter.
- 1Password requires an app or extension install.
Commercial options are so not economical that the OP went and built something.
I've worked on authenticator products, some which were standards candidates, along with a lot of identity and security architecture, and at limited scales, there is no risk in a third party generating the secret you're going to use for something that said party has no way to find.
Honestly, a lot of security concern reduces to bullshit, and for a limited set of use cases, like sending a password protected zip file between organizations, this online tool is pretty good. I commented elsewhere on the thread about some conditions, but really, this tool is just what most people need.
friction from cumbersome security workflows that people avoid creates more risk than using useful tools with some risk in them. pathological risk aversion is not security value either.
I'd like you to walk someone whose job isn't tech through generating a keypair, explaining to their counter party how to do the same, and they're going to exchange the secret using GPG for a zip file they are emailing. In 99% of cases it's stupid and discredits security as a field to raise histrionic criticisms and concerns.
Some secrets are more secret than others, and for low sensitivity tokens like temporary passwords, the risk/reward on this solution disqualifies the objections in your comment.
I 100% agree with you for that use case.
I was commenting more on "here's your password for this or that service", or a manual password reset process -- anything that would go into a table of hashes for an online service.
Risk I see is that this service is a target for folks who want to add some "known passwords" to their set. (Or maybe it's a honeypot for them, on account of how obvious of a target it is.)