4 ms·

Yeah I don't see how this is any different from the standard Google Authenticator style affair. Without a security enclave (which devices are starting to inclu

• oneplane 8y ago
  I think that using a soft token or push notifications are better than nothing, but a company putting a (often known vulnerable) phone at the same level as a security key seems like setting a bad precedent. Then again, at least it's not SMS-verification. Perhaps in future leaks and scrapes of end-user deviced we don't just get data dumps and passwords, but also internal key seeds and tokens... It's the secure enclave and the purpose-built firmware that makes a security key a security key. I'm sure some specific Android devices have a safe implementation, and I'm sure that some SIM cards and perhaps the recent iPhone Secure Elements have properties that allow them to be safely used as a security key, but putting it forward that phones can be seen and used that way in general lacks that important distinction.
• verdverm 8y ago
  Connects via Bluetooth to the device you wish to sign into.
• lern_too_spel 8y ago
  Android 7 added support for key attestation, making it possible to verify that a key came from a secure enclave. That's presumably why the blog post says Android 7 and above. https://source.android.com/security/keystore https://source.android.com/security/keystore
• christiaanbrand 8y ago
  It’s resistant against phishing. That’s solving the problem. OTPs are not.