Do you use passwordless authentication or what?

Marcus Vinicus · Jun 22, 2023

Curious to know how people here prefer to login and authenticate to keystuff like your bank account and other internet based resources such as online retailers.

State briefly what you use and optionally why it works for you.

I use passwordless via Windows Hello (facial recognition) when available.
MFA or an authenticator app (in my phone) when facial recognition isn't available.
I use LastPass to manage my passwords ( all critical logins have very long gobbledygook passwords).

Marcus Vinicus · Jun 22, 2023

Oops brain wasn't fully engaged. :weary:

I've posted this in the wrong subforum, meant to be the Antivirus, firewalls and security.
If the mods want to delete it I can repost it there.

Ghot · Jun 22, 2023

I use a Raven quill pen, dipped in the blood of a grey wolf, to enter my password on my screen, which converts to 200 year old parchment, on demand. It's impossible to duplicate.

One time, someone tried, and the curse still hasn't worn off. Muahahahaha.

badrobot · Jun 22, 2023

for bank logins, I use my phone for OTP (I get the pin code via SMS).
Others, I use the regular 2FA app.

For regular website, I use one note for encrypted passwords.
I have a sticky password premium account but I still haven't got the chance to use it.

TairikuOkami · Jun 23, 2023

I did this mistake once, login through one account (FB/Google), never again. Regaining access to my accounts was a challenge.
I do not use biometrics for sensitive apps, it could be cheated by a photo, though new devices have IR sensor, nothing beats PIN.

wiganken · Jun 23, 2023

By posting our preferences aren't we giving hackers an insight as to where to concentrate their efforts in hacking us? I'll abstain on this one.

Edwin · Jun 23, 2023

I go to the bank and stores in person.

zebal · Jun 23, 2023

My golden rule is to use password manager with autotype feature and virtual keyboard because this way passwords don't get copied to clipboard and so can't be stollen by malware, and virtual keyboard is to unlock password database to prevent keylogging.
I use password safe because it supports this and it is also open source and it's author is well known security specialist.

For every site it's own and complex password and if supported 2FA via email and phone.

I visit my bank personally.
For Windows login, local password with disabled auto enumeration of administrators.

TraderGary · Jun 23, 2023

Windows Hello
LastPass
2FA

windoc · Jun 24, 2023

I have authorized biometrics for certain apps such as my bank app, WhatsApp, Telegram, and more.

As for password management, I prefer Bitwarden. It's an open-source, and has all the features I require. I ensure that all my important accounts are protected with different forms of 2FA.

For Windows system encryption, I use VeraCrypt. This is because BitLocker stores the decryption key in TPMs, which still have unresolved vulnerability issues.

echo2446 · Jun 24, 2023

Use Windows Hello, passkeys, and WebAuthn keys for login whenever possible for safety and convenience.
Use Bitwarden as a password manager because it is free, cross-platform, and easily recommendable.
Use Authy for a TOTP app because it is the most cross-platform. I primarily get the code from my phone for safety.
Use email as the backup 2FA method, and only use SMS as a backup if I have no other choice.
Also use an offline password manager to store information that is not stored in the cloud-based manager for added security.

JAM83 · Jun 25, 2023

Marcus Vinicus said:
Curious to know how people here prefer to login and authenticate to keystuff like your bank account and other internet based resources such as online retailers.

State briefly what you use and optionally why it works for you.

I use passwordless via Windows Hello (facial recognition) when available.
MFA or an authenticator app (in my phone) when facial recognition isn't available.
I use LastPass to manage my passwords ( all critical logins have very long gobbledygook passwords).

I don't use passwords at all if i can help it. I hate them. . I have no passwords on my computers, phone or tablet. I'm the only one that uses them anyway.

Marcus Vinicus · Jun 25, 2023

JMedlock83 said:
I don't use passwords at all if i can help it. I hate them. . I have no passwords on my computers, phone or tablet. I'm the only one that uses them anyway.

They're becoming old hat and can make it to easy for cyber criminals.

echo2446 · Jun 25, 2023

Marcus Vinicus said:
They're becoming old hat and can make it to easy for cyber criminals.

Agreed. I put in a code for a retired lady who didn't enable her Android lockscreen, and had a bank app, locked down with the most commonly used numerical password. Doh!

JAM83 · Jun 26, 2023

Marcus Vinicus said:
They're becoming old hat and can make it to easy for cyber criminals.

Yeah, I do have 2FA enabled on Facebook and Gmail though

TairikuOkami · Jun 27, 2023

JMedlock83 said:
Yeah, I do have 2FA enabled on Facebook and Gmail though

Just make sure to remove SMS as the authentication method, but make a secondary 2FA backup.
SMS is insecure since 1970s, so it still applies: It is better to use no 2FA than to use SMS as 2FA.

CertiK says SMS is the 'most vulnerable' form of 2FA in use

SIM-swap attacks against crypto projects have been on the rise this year.

cointelegraph.com

SailorHF · Jun 30, 2023

TairikuOkami said:
Just make sure to remove SMS as the authentication method, but make a secondary 2FA backup.
SMS is insecure since 1970s, so it still applies: It is better to use no 2FA than to use SMS as 2FA.

CertiK says SMS is the 'most vulnerable' form of 2FA in use

SIM-swap attacks against crypto projects have been on the rise this year.

cointelegraph.com

Is it really true that SMS 2FA is less secure than no 2FA at all? How could that possibly be? For a SIM swap attack to work, the attacker at least has to fool your phone carrier... and actually know what that carrier is, before it can work, and they still need your password and user name of course. Without any 2FA, they have to do nothing except get your password and user name... But I may be missing something, as usual.

I use 2FA with some important things like banking and important emails, but mostly I do passwords. I keep them very long and unique, and store them encrypted. Passwordless doesn´t really appeal to me, at least not yet, although things like Windows Hello PIN are ok and I use those.

Comport Colin · Jun 30, 2023

Some ways to consider:
SmartCard+PIN logon for: windows, keepass, ssh (putty wincrypt), no password known to me. My PIN never touches the keyboard (secure PIN entry on an external reader).
Passwordsafe to browser transfer without using the clipboard (but rather the kee plugin or the masterpassword browser plugin)
The masterpassword browser plugin does not even store passwords at all; it is stateless and calculates them from your masterpassword, target domain and username combination.

TraderGary · Jun 30, 2023

Marcus Vinicus said:
Curious to know how people here prefer to login and authenticate to keystuff like your bank account and other internet based resources such as online retailers.

I've used LastPass password manager for more than 10 years.
All accounts have 20 character random generated passwords.
The Master Password is 32 characters.

echo2446 · Jun 30, 2023

SailorHF said:
Is it really true that SMS 2FA is less secure than no 2FA at all? How could that possibly be? For a SIM swap attack to work, the attacker at least has to fool your phone carrier... and actually know what that carrier is, before it can work, and they still need your password and user name of course. Without any 2FA, they have to do nothing except get your password and user name... But I may be missing something, as usual.

I think it's the use of SMS as an account/password recovery method that is the most troubling. If the user doesn't use 2FA, or the recovery process allows account recovery with no 2FA, then a SIM swap would allow the hacker to take over the account.

Here's the article that argues using SMS 2FA is better than nothing at all, but using other more secure methods are abundantly preferred. Why You Shouldn’t Use SMS for Two-Factor Authentication (and What to Use Instead) This article also mentions that the National Institute of Standards and Technology is no longer recommending the use of SMS messages for two-factor authentication.