3 ms·
There are a number of reasons. - Clicking button is far easier and faster (it really does make a difference). - Your smartphone is complex software and often
by nickik 10y ago
There are a number of reasons.
- Clicking button is far easier and faster (it really does make a difference).
- Your smartphone is complex software and often attacked. Secrets can be stolen.
- Based on public-key crypto, no secret on the server.
- Built in phishing protection
- Your own private key is secure hardware that you can't read the key from
To be fair, a smartphone could also implement U2F and you would get some of the same benefits. Samsung phones for example already support UAF (the other FIDO) protocol.
- flavor8 10y agoDoesn't this mean that Yubi has the potential to know what your private key is (since they have to bake it into firmware before selling you the device)?
- xemdetia 10y agoMost key dongles or smartcards let you load your own key on the device in a write-only fashion, or use the inherent secure cryptographic operations from the device to generate a key (which could subsequently tested if it is random enough through examining the public key portion and multiple tests).
- lmm 10y ago> use the inherent secure cryptographic operations from the device to generate a key (which could subsequently tested if it is random enough through examining the public key portion and multiple tests). It's not really possible to verify randomness this way - particularly for a device that already has a decent chunk of storage and crypto operahtions. Suppose the "random" number generator is actually an AES keystream coming from a key controlled by the NSA - how would you tell?