6 ms·
For 2FA, having multiple of these or some kind of recovery code tends to be the answer, as you can remove the keys from sites you use it on. I am less willing
by kyrra 8y ago
For 2FA, having multiple of these or some kind of recovery code tends to be the answer, as you can remove the keys from sites you use it on.
I am less willing to use something like this for passwordless logins. These types of devices should be part of the "something you have" part of 2FA, which should always be paired with a "something you know".
Maybe I'm missing a step here, but why would you ever use this for passwordless?
- lugg 8y agoBecause the something you know part isn't all that secure anyway? https://xkcd.com/538/ https://xkcd.com/538/
- bluGill 8y agoit is a different level of security. The comic is fully correct, but you should still use a secret. That is why there are 3 different types of authentication. The first is something you have - a card or key. The second is something you know - a password. The third is something you are - a fingerprint. Each provides protection against a different attack and is vulnerable to different attacks. The more important the secret the more of them you should use. Note that you quickly get to the point where you need more than one person involved. You can compromise one person as much as you want, but if that person doesn't have the complete secret it doesn't do any good.
- pps43 8y agoCalling a fingerprint "something you are" is a stretch. You are leaving fingerprints everywhere, they can be lifted from any smooth surface you touched (or even high-resolution photo) and then used to open biometric locks.
- rikkus 8y agoThe fingerprint belongs to you. Calling it 'something you are' is conveying this, without claim to it being somehow difficult to clone or entirely unique. Mother's maiden name is similar in this regard.
- dragonwriter 8y ago> The third is something you are - a fingerprint. A fingerprint isn't “something you are”, because it can be destroyed while you remain, and information about it can be captured and reproduced by attackers who are not you. It's just a particularly hard to lose (but easy to discover, and impractical to replace if compromised, at least more times than you have fingers) “something you have.” In security factor terms, I'm not convinced the idea of a distinct “something you are” category is coherent, since most candidates seem similar to that.
- bluGill 8y agoDNA is something you are.
- dllthomas 8y agoMaybe? Although not yet practical, in theory it too can be captured and reproduced.
- dragonwriter 8y agoThe reason DNA is useful as criminal evidence is you leave it everywhere; that makes it a horrible security factor: like fingerprints it's an impractical to replace wheb compromised “thing you have” that you leave everywhere for attackers.
- bluGill 8y agoThat is a very good reason to not use it alone. However when combined with other it provides a good indication that someone was actually there. Either that, or the attacker went through more effort to get the secrets.
- jiveturkey 8y ago"Something you are" is a term of art, not a very specific statement of fact to be legally overanalyzed. A fp is very much "something you are".
- NedIsakoff 8y agoI honestly think the better one would be: "Hit his wife and kids until he tells us the password." Much more effective.
- emlun 8y agoFor U2F you're right that it becomes single factor if you use the device as the only factor. With FIDO2 (which is what makes passwordless available), however, the device supports a local PIN as the "something you know" factor - and it's also a better kind of knowledge factor than a traditional password since it's never sent over the network.