3 ms·

Eh... cars are really big. A better way of phrasing this is, "if this were true, your wallet/phone would get stolen a lot more often." But aren't wallet/phone

Eh... cars are really big. A better way of phrasing this is, "if this were true, your wallet/phone would get stolen a lot more often." But aren't wallet/phone thefts relatively common? > You're less secure from targeted attacks from people who know you IRL I'm also not completely certain this is true. If a YubiKey is the only thing securing most people's accounts, I don't need to target you. I can walk into a coffee shop, or locker room, or office and steal as many YubiKeys as I can find. And then I can check later whether or not any of them are linked to bank accounts. I don't know the stats; are most petty wallet/phone thefts targeted?

kortilla 7y ago
A wallet is useful to a thief, a yubikey is not. There is little overlap between petty thieves and people trying to get into a particular target’s account.
- danShumway 7y ago
  > There is little overlap between petty thieves and people trying to get into a particular target’s account. But isn't that the point? There's little overlap because right now we have a multi-factor system where stealing one part of the authentication mechanism from a random person in the street isn't enough to get into their account. If everyone's account is secured with just a YubiKey, then you don't have to target a specific person. What's to prevent any petty thief from grabbing a bunch of wallets and/or YubiKeys, walking into a library, and just checking a few of the most common banks to see if any of them log in? Maybe I'm missing something? It's not clear to me why an MFA attack would ever need to be targeted in a world without passwords. I guess maybe you're hoping that petty thieves can't figure out your username? But that's just treating your username like a password. For a lot of bank accounts, your username will be some variant of your first and last name, which is helpfully printed on the drivers license in the wallet I just stole. I don't need to know who you are beforehand.

kortilla 7y ago

A wallet is useful to a thief, a yubikey is not. There is little overlap between petty thieves and people trying to get into a particular target’s account.

danShumway 7y ago
> There is little overlap between petty thieves and people trying to get into a particular target’s account. But isn't that the point? There's little overlap because right now we have a multi-factor system where stealing one part of the authentication mechanism from a random person in the street isn't enough to get into their account. If everyone's account is secured with just a YubiKey, then you don't have to target a specific person. What's to prevent any petty thief from grabbing a bunch of wallets and/or YubiKeys, walking into a library, and just checking a few of the most common banks to see if any of them log in? Maybe I'm missing something? It's not clear to me why an MFA attack would ever need to be targeted in a world without passwords. I guess maybe you're hoping that petty thieves can't figure out your username? But that's just treating your username like a password. For a lot of bank accounts, your username will be some variant of your first and last name, which is helpfully printed on the drivers license in the wallet I just stole. I don't need to know who you are beforehand.