3 ms·
>Revoking keys is great but doesn't help after they've given full access. That's true in a lot of infosec, but in identification, you can revoke everything and
by jon_richards 9y ago
>Revoking keys is great but doesn't help after they've given full access.
That's true in a lot of infosec, but in identification, you can revoke everything and wait for meat-space verification to start again.
- tylersmith 9y agoOnly once you've noticed it. Automated systems could be used but there's always the potential for large impacts before automated systems recognize the issue. And if the keys are ID related you can easily revoke it. You can't revoke a SSN, fingerprint, DNA, or a face scan.
- jon_richards 9y ago>Typically the SS number is used for identification, and you have password + one-time code on top of that. Isn't that what this was addressing? The attacker has to get both your password and one-time codes before you change either. All the ID related stuff is used like usernames, not keys. If an attacker does get both, you presumably go in to a government office, have your fingerprints taken, choose a new password, and get given a new set of codes.