4 ms·
Unless you're asserting that the hardware token is just as crackable as a password, it's not a 1:1 replacement. The problem with passwords is that you have 10,0
by waisbrot 8y ago
Unless you're asserting that the hardware token is just as crackable as a password, it's not a 1:1 replacement. The problem with passwords is that you have 10,000 users and more than one of them has a bad password. The problem with hardware tokens is that I've stolen your token. So passwords are vulnerable to bots, while the hardware token requires a human to find/steal something and connect it with a specific account.
- Someone1234 8y ago> Unless you're asserting that the hardware token is just as crackable as a password That's completely outside the scope of what I was describing. You've taken my words out of context.
- hirsin 8y agoI'd be open to hearing the right context, since I read it the same way. "Replaces PWs 1:1" is only true in the context of... the attacker only uses stolen passwords and doesn't rely on password dumps? Even in a targeted attack scenario, where the attacker would have to specifically target you to steal creds, this is better, as they'd now have to physically find you and take the key.