3 ms·

What about MFA?

dheera 9y ago
You can feel free to disagree but I don't believe in the current incarnations of MFA; at least not those done with a phone. Stolen phone = insecure system. Dead batteries or dead SIM = stranded. Biometric MFA, I'm slightly more in support of. I should be able to identify myself to any electronic system I own or control, using only what's in my mind and body, and nothing else. For now I use pretty much only passwords everywhere. With passwords I can walk and move freely about the world without worrying about losing stuff or forgetting to carry stuff. I always hated physical keys, because I forget them and lose them, and I hate anything that resembles a physical key in that respect. I love combination locks to apartments and bicycles, by the way. You can head out the door and get around town with exactly nothing in your pocket. Maybe just a credit card to pay for food, at most. It's refreshingly simple and awesome to not have to carry stuff.
- stephengillie 9y ago
  Authenticating yourself that way is fine. How do you propose to prevent other people from authenticating as yourself? How entropic are your memorized passwords? How entropic are combination locks? And vulnerable to picking - I've had to pick a 3-dial Realtor lock before in an emergency. It's easy with an aluminum-foil shim and Youtube instructions.
  - dheera 9y ago
    > How entropic are your memorized passwords? Quite entropic. And I use PBKDF-HMAC-SHA256 to generate other passwords from a master password on any machine I own without having to store or carry a database or keystore. > How entropic are combination locks? What is the attack vector here? A lot of key locks are easy to pick. My apartment door's key lock is a lot more insecure than some of the better combination locks out there. If someone really wants to get in, they can smash the windows. At that point I think having a security camera system or alarm system would be a better investment.

What about MFA?

You can feel free to disagree but I don't believe in the current incarnations of MFA; at least not those done with a phone. Stolen phone = insecure system. Dead batteries or dead SIM = stranded. Biometric MFA, I'm slightly more in support of. I should be able to identify myself to any electronic system I own or control, using only what's in my mind and body, and nothing else. For now I use pretty much only passwords everywhere. With passwords I can walk and move freely about the world without worrying about losing stuff or forgetting to carry stuff. I always hated physical keys, because I forget them and lose them, and I hate anything that resembles a physical key in that respect. I love combination locks to apartments and bicycles, by the way. You can head out the door and get around town with exactly nothing in your pocket. Maybe just a credit card to pay for food, at most. It's refreshingly simple and awesome to not have to carry stuff.

stephengillie 9y ago
Authenticating yourself that way is fine. How do you propose to prevent other people from authenticating as yourself? How entropic are your memorized passwords? How entropic are combination locks? And vulnerable to picking - I've had to pick a 3-dial Realtor lock before in an emergency. It's easy with an aluminum-foil shim and Youtube instructions.
- dheera 9y ago
  > How entropic are your memorized passwords? Quite entropic. And I use PBKDF-HMAC-SHA256 to generate other passwords from a master password on any machine I own without having to store or carry a database or keystore. > How entropic are combination locks? What is the attack vector here? A lot of key locks are easy to pick. My apartment door's key lock is a lot more insecure than some of the better combination locks out there. If someone really wants to get in, they can smash the windows. At that point I think having a security camera system or alarm system would be a better investment.