3 ms·
I guess what you're saying makes sense. But instead of "faking" U2F keys just go with something like authy or phone verification. I still believe it defeats th
by sdan 7y ago
I guess what you're saying makes sense.
But instead of "faking" U2F keys just go with something like authy or phone verification. I still believe it defeats the hardware purpose of u2f given that it's software (even if it's a backup)
- dmoy 7y agoauthy and phone also defeat one purpose of u2f, in that they are trivially phishable Any backup for a u2f that isn't another physical u2f is compromising in some way, it's just a matter of which way. In reality though I agree with you and use one time code backup for u2f, and just trust that I will be careful if I ever need to use them. (But maybe I'll be panicking already and get phished? Who knows...)