6 ms·
The second factor for authentication is best handled by having it under the account holder's control. Either a client side TLS certificate or a Yubi key. The fo
by u801e 7y ago
The second factor for authentication is best handled by having it under the account holder's control. Either a client side TLS certificate or a Yubi key. The former is better in my opinion since it's compatible with application level protocols other than HTTP.
- baybal2 7y agoUSB smartcards worked flawlessly for 10+ years. Last gen titan key finally supports work in a driverless smartcard mode, but you have to custom order them as I understood
- tialaramex 7y agoA client side TLS key has some properties plenty of people don't want because it specifically assures the remote party of your identity. If I use a client TLS key with (examples are hypothetical) GitHub for my work as "Fast Jack The Javascript Hack" and Twitter as "Aunty Fa" to write posts calling out Nazis, then the effect is that data from GitHub and Twitter can be used to find out that "Jack" and "Aunty" are one and the same. Maybe they both give the data to cops who are actually Klan members, maybe it's stolen, maybe some goof uploads it to Pastebin. Doesn't matter, now my day job is destroyed because I used a TLS client certificate. If I use FIDO keys for U2F/ WebAuthn then nobody knows Jack and Aunty are the same person, unless they suspect this and they deliberately arrange for Twitter and GitHub to work together to test this /specific/ hypothesis, in which case frankly I'm probably screwed anyway.