4 ms·

Still reading the comments, but is anyone actually saying passwords are more secure in general? I think most people are saying that they get locked out of their

Still reading the comments, but is anyone actually saying passwords are more secure in general? I think most people are saying that they get locked out of their account if they lose the token. How do you validate your account is your account if the only secret you have is lost? If you 100% require a hardware token, you need at least two and/or a method to auth that is not a hardware token so you can recover in a mode where you lost one. But on the security note. There are several types of security. Security from the people directly around you and security from everyone on the internet. Without any malware, I could pickup my friends keys and log into their account on my computer in seconds and without their knowledge. This is harder to do with a password. At the same time a password is much easier for someone who doesn't even know who I am to attack. It's why 2FA is so necessary, it helps defend against both methods of attack.

krupan 8y ago
"Security from the people directly around you and security from everyone on the internet." Are the people around you not on the internet? They are just a subset of that larger group, aren't they? Sorry if I'm not understanding your point there. And like I said in my edit, I really hope that Yubikey is not the one and only one way to store private keys. I personally would be perfectly happy, for most websites and apps, to manage keys just like I do for ssh. On my hard drive, backed up to another hard drive or two of mine, protected by a passphrase. I imagine most people would be pretty comfortable letting a service like lastpass manage most of their private keys for them, with multiple copies synced between devices and encrypted with a strong passphrase.
- toast0 8y ago
  The people around you are (probably) on the internet, but let me try to articulate the threats differently. If I'm worried about 'people on the internet' that's threats like brute forcing my weak password, or determining my password on one site (through phishing, password leaks, whatever) and trying it everywhere else and finding I reused it; potentially using malware to slurp up passwords.txt from the desktop where I keep my varied passwords. If I keep a strong password for each site in a journal near my computer, I'm fairly well protected from internet threats as long as I don't get a keylogger. If I make sure I keep a copy of my passport journal somewhere else too, I won't lose access. If I'm worried about people next to me, say roommates, office mates, or any one else who is near my computer, I'm more concerned about the physical security of my password journal; it might not be a good idea to keep it next to the computer if untrusted people will be there. These people could also be looking through password leaks, but they probably aren't.
  - krupan 8y ago
    Right. So to summarize, with passwords you worry about people near you and everyone on the internet, and with keys you only worry about people near you. This is a huge improvement!

krupan 8y ago

"Security from the people directly around you and security from everyone on the internet." Are the people around you not on the internet? They are just a subset of that larger group, aren't they? Sorry if I'm not understanding your point there. And like I said in my edit, I really hope that Yubikey is not the one and only one way to store private keys. I personally would be perfectly happy, for most websites and apps, to manage keys just like I do for ssh. On my hard drive, backed up to another hard drive or two of mine, protected by a passphrase. I imagine most people would be pretty comfortable letting a service like lastpass manage most of their private keys for them, with multiple copies synced between devices and encrypted with a strong passphrase.

toast0 8y ago
The people around you are (probably) on the internet, but let me try to articulate the threats differently. If I'm worried about 'people on the internet' that's threats like brute forcing my weak password, or determining my password on one site (through phishing, password leaks, whatever) and trying it everywhere else and finding I reused it; potentially using malware to slurp up passwords.txt from the desktop where I keep my varied passwords. If I keep a strong password for each site in a journal near my computer, I'm fairly well protected from internet threats as long as I don't get a keylogger. If I make sure I keep a copy of my passport journal somewhere else too, I won't lose access. If I'm worried about people next to me, say roommates, office mates, or any one else who is near my computer, I'm more concerned about the physical security of my password journal; it might not be a good idea to keep it next to the computer if untrusted people will be there. These people could also be looking through password leaks, but they probably aren't.
- krupan 8y ago
  Right. So to summarize, with passwords you worry about people near you and everyone on the internet, and with keys you only worry about people near you. This is a huge improvement!