<story><title>Patronizing Passwords</title><url>http://joelcalifa.com/blog/patronizing-passwords/</url></story><parent_chain><item><author>astazangasta</author><text>I have the perfect solution to this, but software systems aren&amp;#x27;t with me yet. The answer is: a keychain. Not a digital keychain, an actual one. On this I put my &amp;quot;infinity key&amp;quot; - it&amp;#x27;s a little USB flash drive with a LUKS-encrypted file system on it that holds a private key. Lots of tech people have something like this. It&amp;#x27;s great for SSH - I can add my infinity key to any host and be assured that I will always be able to login securely from any machine I want. We&amp;#x27;re all used to the physical metaphor of keys as security, and needing a physical key to get into things. This is not a huge change for us.&lt;p&gt;This could easily become the norm, and should. It requires only one key for all of us, it is perfectly secure, doesn&amp;#x27;t require storing secrets on the remote end, never needs to be changed, can&amp;#x27;t be forgotten because it doesn&amp;#x27;t need to be memorized (there is one password for the LUKS encryption). There is no penalty for using the same key in thousands of places.&lt;p&gt;The problem is, no website or browser supports this kind of authentication, and most people are not savvy enough to build this sort of thing for themselves. These are both problems that should be solved; we desperately need to move the Internet away from passwords, password resets, and so on.</text></item></parent_chain><comment><author>munin</author><text>&amp;gt; This could easily become the norm, and should.&lt;p&gt;a stronger version of this IS the norm in many countries in Europe and large security conscious enterprises in the united states: an ID card issued that is also a high security module. it&amp;#x27;s better than your scheme because the ID card is also a computer that can respond to signing requests by a host computer and the private key doesn&amp;#x27;t leave the ID card, ever. governments issue and service tens to hundreds of millions of these cards a year.</text></comment>
<story><title>Patronizing Passwords</title><url>http://joelcalifa.com/blog/patronizing-passwords/</url></story><parent_chain><item><author>astazangasta</author><text>I have the perfect solution to this, but software systems aren&amp;#x27;t with me yet. The answer is: a keychain. Not a digital keychain, an actual one. On this I put my &amp;quot;infinity key&amp;quot; - it&amp;#x27;s a little USB flash drive with a LUKS-encrypted file system on it that holds a private key. Lots of tech people have something like this. It&amp;#x27;s great for SSH - I can add my infinity key to any host and be assured that I will always be able to login securely from any machine I want. We&amp;#x27;re all used to the physical metaphor of keys as security, and needing a physical key to get into things. This is not a huge change for us.&lt;p&gt;This could easily become the norm, and should. It requires only one key for all of us, it is perfectly secure, doesn&amp;#x27;t require storing secrets on the remote end, never needs to be changed, can&amp;#x27;t be forgotten because it doesn&amp;#x27;t need to be memorized (there is one password for the LUKS encryption). There is no penalty for using the same key in thousands of places.&lt;p&gt;The problem is, no website or browser supports this kind of authentication, and most people are not savvy enough to build this sort of thing for themselves. These are both problems that should be solved; we desperately need to move the Internet away from passwords, password resets, and so on.</text></item></parent_chain><comment><author>jclulow</author><text>You can&amp;#x27;t really &amp;quot;add&amp;quot; your key to a computer you don&amp;#x27;t trust, though.  At best, it could destroy your USB device; at worst it could copy the contents out once you decrypt them.&lt;p&gt;This may be better than using one password for everything, but it&amp;#x27;s certainly not a panacea.</text></comment>