5 ms·

Passwords are utterly broken. All the entropy of memorizable passwords among humans have probably been extracted by this point. All they give you is a false sen

Passwords are utterly broken. All the entropy of memorizable passwords among humans have probably been extracted by this point. All they give you is a false sense of security. The password portion of 2FA is mostly theater, conditioned on the notion that passwords are broken. Hardware keys is the way of the future.

d4l3k 9y ago
Except that passwords at least protect you if your hardware key is stolen. Using just a hardware key seems similarly risky to just using a password.
- pishpash 9y ago
  What you need is a mechanism to detect loss of contact with the human and revoke. One way is to require several hardware tokens to combine their entropy to authenticate. Again, don't make a password be a part of this, use another token.
- e1ven 9y ago
  Exactly - It's similar reason to the crypto keys use passphrases.
- r00fus 9y ago
  So in this case, arent the two factors a) physical possession of desktop/laptop and b) the Yubikey ? How likely is it you'll lose both if you keep your keyring with you?
  - tmd83 9y ago
    Not sure reading the article why would I need the computer. The way I read it, you enter the key to any computer and it logs in to the account of the key owner. Am I wrong?
    - r00fus 9y ago
      FTA: "Organizations will soon have the option to enable employees and customers to sign in to an Azure AD joined device with no password, by simply using a Security Key to get single sign-on to all Azure AD based applications and services." Emphasis added. Device needs to be paired with Company's AD first. I also imagine that there are options for making e.g. the device unlock only require yubikey, but login to SSO require 2nd factor.
      - freeone3000 9y ago
        You can pair new devices with a company's active directory.
  - emlun 9y ago
    The two factors are a) the YubiKey and b) the PIN for the YubiKey.
- krupan 9y ago
  Your hardware key is in one place, controlled by you. Your password has been leaked all over the internet.

d4l3k 9y ago

Except that passwords at least protect you if your hardware key is stolen. Using just a hardware key seems similarly risky to just using a password.

pishpash 9y ago
What you need is a mechanism to detect loss of contact with the human and revoke. One way is to require several hardware tokens to combine their entropy to authenticate. Again, don't make a password be a part of this, use another token.
e1ven 9y ago
Exactly - It's similar reason to the crypto keys use passphrases.
r00fus 9y ago
So in this case, arent the two factors a) physical possession of desktop/laptop and b) the Yubikey ? How likely is it you'll lose both if you keep your keyring with you?
- tmd83 9y ago
  Not sure reading the article why would I need the computer. The way I read it, you enter the key to any computer and it logs in to the account of the key owner. Am I wrong?
  - r00fus 9y ago
    FTA: "Organizations will soon have the option to enable employees and customers to sign in to an Azure AD joined device with no password, by simply using a Security Key to get single sign-on to all Azure AD based applications and services." Emphasis added. Device needs to be paired with Company's AD first. I also imagine that there are options for making e.g. the device unlock only require yubikey, but login to SSO require 2nd factor.
    - freeone3000 9y ago
      You can pair new devices with a company's active directory.
- emlun 9y ago
  The two factors are a) the YubiKey and b) the PIN for the YubiKey.
krupan 9y ago
Your hardware key is in one place, controlled by you. Your password has been leaked all over the internet.