3 ms·
The big problem with using the same password on multiple sites is that if any of the sites record your password (because of maliciousness or incompetence), they
by AgentME 8y ago
The big problem with using the same password on multiple sites is that if any of the sites record your password (because of maliciousness or incompetence), they can re-use your password to log in as you on any other site.
Using a security token is more like a password manager with random passwords everywhere than that (the attacker needs to get access to your password manager to get access to your accounts; it's not enough for someone to hack a single site you use), but more secure because it's generally not copyable and the attacker needs physical access to use it. (A virus on your computer can't clone your security token, even if it's plugged in.)
- ehsankia 8y agoThat's fair. Although, for my password manager, you need both password and 2FA to access it, whereas a FIDO key would just require stealing the physical key. Does there exist FIDO key (other than phones) that require a password to "enable"? For example, when it's plugged into a new device, the key locks until you input some master password?
- jontro 8y agoThe Ledger Nano S requires you to enter a pin code at least
- rkeene2 8y agoMost smartcards require you to authenticate to them before they will perform operations using their private cryptographic keys. I'm adding WebAuthn support to my smartcard middleware [0]. [0] https://cackey.rkeene.org/ https://cackey.rkeene.org/
- forgotmypw7 8y agoWho said anything about using the same password on different sites?
- MaulingMonkey 8y ago"Isn't this almost close to using the same password on every site?" is in the post AgentME is replying to.