5 ms·
I would expect things to be more secure in many cases. People are pretty good at keeping physical items somewhat safe and notice when they’re gone. Yubikeys can
by Xylakant 9y ago
I would expect things to be more secure in many cases. People are pretty good at keeping physical items somewhat safe and notice when they’re gone. Yubikeys cannot easily be cloned. The password cannot be attacked remotely. 2FA is certainly safer, though.
- pishpash 9y agoPasswords are utterly broken. All the entropy of memorizable passwords among humans have probably been extracted by this point. All they give you is a false sense of security. The password portion of 2FA is mostly theater, conditioned on the notion that passwords are broken. Hardware keys is the way of the future.
- d4l3k 9y agoExcept that passwords at least protect you if your hardware key is stolen. Using just a hardware key seems similarly risky to just using a password.
- pishpash 9y agoWhat you need is a mechanism to detect loss of contact with the human and revoke. One way is to require several hardware tokens to combine their entropy to authenticate. Again, don't make a password be a part of this, use another token.
- e1ven 9y agoExactly - It's similar reason to the crypto keys use passphrases.
- r00fus 9y agoSo in this case, arent the two factors a) physical possession of desktop/laptop and b) the Yubikey ? How likely is it you'll lose both if you keep your keyring with you?
- tmd83 9y agoNot sure reading the article why would I need the computer. The way I read it, you enter the key to any computer and it logs in to the account of the key owner. Am I wrong?
- r00fus 9y agoFTA: "Organizations will soon have the option to enable employees and customers to sign in to an Azure AD joined device with no password, by simply using a Security Key to get single sign-on to all Azure AD based applications and services." Emphasis added. Device needs to be paired with Company's AD first. I also imagine that there are options for making e.g. the device unlock only require yubikey, but login to SSO require 2nd factor.
- freeone3000 9y agoYou can pair new devices with a company's active directory.
- emlun 9y agoThe two factors are a) the YubiKey and b) the PIN for the YubiKey.
- krupan 9y agoYour hardware key is in one place, controlled by you. Your password has been leaked all over the internet.
- closeparen 9y agoThe standard in high-assurance applications is to present a PIN to the hardware token before it can be used, ideally through an out-of-band keypad. In this context, it would be reasonable to have the Yubikey require a PIN entry from the computer. You could use the same PIN for all sites because it stays local; the relying party never handles it, only the Yubikey.
- emlun 9y agoThat's exactly how FIDO2 PIN on the new YubiKeys works.