4 ms·
Looks like a logistical nightmare to me. You think forgetting a password is a pain in the ass, just wait until you loose your security key. It won't be one serv
by transfire 10y ago
Looks like a logistical nightmare to me. You think forgetting a password is a pain in the ass, just wait until you loose your security key. It won't be one service you have to reset through an alternate verification route, but every single one you ever used! I also foresee potential issues with data corruption on keys, and multiple-keys getting out of sync (e.g. work vs home). And I have no doubt that clever hackers will find ways to get the codes off those keys (they will be plugged into a computer all the time and at the very least even the most cautious are susceptible to phishing). Also, it just doesn't seem as secure as an SMS code b/c the SMS code doesn't exist but for a short window of time and is transmitted by a completely separate communications channel -- but I suppose that's also why the big companies want to get rid of it, SMS costs more money.
The more I think about it, it seems to me that the Internet itself really needs to be a two-channel system. If communication has two separate physical channels then it becomes much easier to ensure security.
- Analemma_ 10y agoIs it really that big a deal? I just have it on my key ring, which I'm not really in danger of losing. And if it is a concern, get something like Tile or TrackR. Seems less likely than forgetting the 15-character fully random passwords we're supposed to memorize.
- NickBusey 10y agoI recently lost my security key. Now I have to pull out my phone and type in 6 digits from Google Authenticator instead. It's been such a nightmare, let me tell you..
- draw_down 10y agoActually, the saddest part is what a pain it is when it's all working correctly.
- eeZah7Ux 10y agoThat's why you buy two keys. No, they don't have anything to "sync".
- unknownsavage 10y agoOne issue with buying two keys is they internally have different keys, so you need to connect both to each new account which is a pain in the ass and stops you just keeping one somewhere very safe (i.e. safety deposit box, or a safe at a friends house)
- nickik 10y agoHopefully this will be addressed in FIDO 2.0. That is the goal at least.
- tptacek 10y agoSee also: https://news.ycombinator.com/item?id=13493100 https://news.ycombinator.com/item?id=13493100
- arnarbi 10y agoThat's like saying you shouldn't lock your house because you might lose the key. w.r.t: > I also foresee potential issues with data corruption on keys, and multiple-keys getting out of sync (e.g. work vs home). and > Also, it just doesn't seem as secure as an SMS code b/c the SMS code doesn't exist but for a short window of time and is transmitted by a completely separate communications channel Are you talking about U2F? There are no synchronization issues there. And it is more secure than OOB codes because they can be phished. For U2F your browser is in the loop, and the origin to which you are authenticating is folded into the signature. Thus it is detectable by the RP if the signature was generated on a phisher's non-legitimate website.
- plttn 10y agoAFAIK, there's no "codes in stasis" in U2F. http://google.com/ http://google.com/ sends you a challenge, your U2F device receives the challenge and makes a response signed with the private keypair that exists. Each CR pair is nonced and only valid for the originating site.