4 ms·
I don't think it's so much about features, but I do think there's a huge difference between having a nano and a normal sized one, especially on a laptop. Being
by ehsankia 8y ago
I don't think it's so much about features, but I do think there's a huge difference between having a nano and a normal sized one, especially on a laptop.
Being able to leave it in instead of having to take it out of your wallet and plug it in every time makes a big difference in usability, which in turn makes it much more likely that you'll want to use it everywhere.
- tptacek 8y agoIt's funny because I see it the opposite way: the problem with the nano is you'll want to leave it in all the time, which reduces your practical security. I go out of my way to keep the security key on my physical keychain; I don't even like leaving it in my bag, where it might get stolen along with the computer.
- joshuamorton 8y agoWhat's the threat model this protects against? (In other words, what's better about having the security key being on your keychain vs. be a permanent part of your computer)
- tptacek 8y agoI am less likely to lose both at the same time as I am to lose just one, and you'd need both of them to get access to accounts.
- ehsankia 8y agoWhat do you mean you need both? The two in 2-factor is password + ubikey, not laptop + ubikey. If someone gets your laptop with ubikey inside, they can't do anything without your password. And the whole point of a physical second factor is to basically limit the 99.9% of the people (mostly from other countries and cities) that have no physical access to you from hacking you.
- tptacek 8y agoIt's "Yubikey", not "ubikey". The Nano and Y4 keys do more than U2F; they also generate and store RSA keys. They aren't just 2FA devices; they're also small HSMs.
- GordonS 8y agoIf I have access to someone else's laptop with a nano key plugged into it, can I access all the SSH key files stored on the key, or are they also protected from access somehow?