4 ms·
Whether you use a hardware key, or a password manager, in both cases the attacker needs both authentication factors: your password, and the hardware key or pass
by Freak_NL 9y ago
Whether you use a hardware key, or a password manager, in both cases the attacker needs both authentication factors: your password, and the hardware key or password manager.
With a hardware key you gain the advantage of the attackers having to physically gain access to that key.
- not_that_noob 9y agoThis is the misunderstanding attackers can exploit. Credentials need to be reissued because people lose them ocassionally. So that process now becomes a pathway for exploits.
- emlun 9y agoNo - that process _remains_ a pathway for exploits against the particular website being targeted. The process does not open new pathways for transferring exploits from one site to another - on the contrary, such exploits are made more difficult by the separation of credentials.
- not_that_noob 9y agoSee my reply to your other comment and review CTAP in the spec.