4 ms·
Wow.. This certainly goes to show, the more "secure" you try to make things, the easier they'll try to make it and ruin your security. www.insecam.org/en/view/
by kefka 10y ago
Wow.. This certainly goes to show, the more "secure" you try to make things, the easier they'll try to make it and ruin your security.
www.insecam.org/en/view/386702/ - Somebody's RSA keyfob with automatic button presser.
- saganus 10y agoWow.... wtf? I'm guessing someone just dropped the camera on a desk without realizing it was on... but still... holy cow... Edit: I guess you are right. It does seem a bit improbable that you would get such a good reading on the numbers. Definitely scary as fuck...
- xyzzy4 10y agoSeems intentional to me. They just don't want to carry the keychain around.
- rspeer 10y agoI've heard of this being done because many people are sharing the same 2FA login.
- sargun 10y agoNo, this was probably intentional. When there is security, especially corporate mandated, people will find a way to work around it to gain efficiency.
- colemickens 10y agoMicrosoft makes me/us do 2FA ~5-20 times a day, doesn't support U2F and implements 2FA in a way that forces you to type a PIN into the phone rather than the other way around (massive phishing hole they don't seem to care about - sometimes I'll be flooded with 2FA prompts and have no idea which ones were initiated by me or by an attacker). I've joked about writing an app on my phone that would just auto-respond to all the 2FA prompts with my PIN, and have been told that other people actually tried to (or did) implement such an application. Meanwhile I was at a Googler's place a year ago and watched him tap a U2F device on the side of his laptop to complete the second factor. Sigh.
- saganus 10y agoHow does MS make you do 2FA 5-20 times a day? You mean you work there and accessing services or tools requires you to do 2FA every time? I hope they are already planning to overhaul that because it does seem like a very cumbersome and insecure way of "securing" accesses.
- wesleytodd 10y agoYou are probaly referring to https://www.yubico.com/ https://www.yubico.com/ I just bought one the other day for personal use, pretty cheap, cant say more becuase I have yet to receive it, but I have high hopes.
- kevhito 10y agoI've had one for about 6 months that I use for gmail. I like it, easy to set up, works pretty much out of the box, security story seems reasonable, and device is physically pretty sturdy so far. For at least 2 linux boxes I use, I needed to add udev rules for the yubikey. That wasn't immediately obvious and took a few minutes to figure out why it wasn't working.
- pacaro 10y agoI'm a fan. It would be nice if there was more support. I can use it on gmail, github, and dropbox. I'm not aware of any other online services that support it (that I use)
- mmcconnell1618 10y agoIf you work for Microsoft (I do) that doesn't sound right. There are times when I get 2FA but not often on my work machine. Microsoft employees get a smart card and if your machine has a TPM chip you can create a virtual smart card accessed with a pin or biometric factor like fingerprint or Windows Hello.
- colemickens 10y agoI don't use Windows except when interacting with the 15 year-old payroll time entry system. I have nothing nice to say about support for non-Windows users, though most of that is unrelated to 2FA (though supporting U2F would sure be a lot more friendly than proprietary apps that surf on top of the TPM)
- cm2187 10y agoWhat's absurd is that there is an RSA iphone app now...
- ocdtrekkie 10y agoThe funny thing is, if they had reasonably secured their webcam, this wouldn't have been that bad. It still protects them from pretty much all automated/dragnet attacks and compromised login info. And it's incredibly unlikely one would expect someone's webcam feed would contain their RSA key. And it's hard to tell whose account on what system this key belongs to.
- aivosha 10y agomy bet is they just put it somewhere so they dont loose it and can access it from literally anywhere !