I read through your first link. And right off the bat I found it completely unrelated. First, the weakest reason why its unrelated is because Safenetwork is going to solve the password problem. Much of the argument against passwords is the fact that you have to have so many of them. Well, with safenetwork this is not the case, as its one password to access the entire network of apps, websites etc. Once you’re credentialed you’re in. So that is no longer a problem.
The second, much stronger reason, is that that research is completely contrived. Offline attacks are EXTREMELY difficult to pull off in real life, safenetwork or not. You actually have to steal the password file for them to work. If you cannot you can kiss cracking the network goodbye. The third reason is related to the second, offline attacks are IMPOSSIBLE on safe network. There is no master ‘password file’ stored somewhere to be stolen. So the objections present in that article do not apply at all because a cracker would need to go through the traditional login process. After so many attempts, you could be prevent from trying again for a period.
In short, of all of the complaints you have with passwords, none of them apply to safe. The safeNetwork gets around them quite nicely by removing the need for multiple passwords, and removing the ability for them to be stolen. In the case of the safe network, I stand by my claim that this is overengineering, especially when considering that we need the safe network yesterday.
Edit: the same criticism applies to your second link: Maidsafe returns password management to a useful level by removing the need for multiple passwords, thus decreasing the potential economic cost to users born by password management. If you only have to change your password once a year and its the only password that gains you access to everything, then you are no longer economically disadvantaged by network security as the cost is minimized dramatically.
And because the network is secured by many layers of encryption, it decreases the actual cost of attacks to near 0. The funny thing is that your second link basically lays out the security research community because their advice is excessive, costly to the user, and not guaranteed to work. Yet, we’re supposed to trust that this biometrics push won’t fall into the same trouble!? Once you drop the ball enough times, you don’t get to dictate future courses of action. Summarily, all the people who care about password attacks are NON-maidsafe users. Banks, institutions, CENTRALIZED SERVICES. Decentralizing the net and client-client interaction seems to have an added benefit of removing the security risk of password attacks. Who’da thunk it?
Edit 2: Your third link does better in that it analyzes both offline and online attacks. However, their strongest results continue to be in ‘offline attacks’ which as already stated cannot happen in Safe. Also, where it fails in regard to this discussion is that it revolves around transform-based approaches to password security (charlie01, charlie02) etc. But we’ve already discussed that this can be easily prevented by requiring a stronger new password. Further, as your link points out, not all transformations weaken passwords equally. Charlie01->charlie02 might be easy to arrive at via algorithm; however, cherlie21 is a completely different story. Increasing the difficulty while maintaining user-familiarity. Also to be noted, they could only break 17% of passwords in an online attack. Which is due to transformations to passwords making them easier, which is solved by requiring stronger new passwords. Not necessarily removing the idea altogether.
