4 ms·
This is exactly why I’m only faithful to FIDO U2F keys. Got a couple and ensure they’re safe. No one’s hacking my accounts unless they crack both my passwords a
by sdan 7y ago
This is exactly why I’m only faithful to FIDO U2F keys. Got a couple and ensure they’re safe. No one’s hacking my accounts unless they crack both my passwords and rob me physically... which at this point doesn’t seem like it’s going to happen.
- rb808 7y agoWhat happens if the keys get lost or destroyed? It seems like a never ending problem.
- sliken 7y agoGet 2 keys, keep one in a safe place. Add both to your important accounts. Then also setup TOTP, so if you lose both keys and have a working cell phone with the app installed you can still login.
- song 7y agoThat's if important accounts allow you to do that. For example AWS only allow one MFA key
- sdan 7y agoI have one at work/keep on my computer and one at home. Some websites allow TOTP which is still safer than SMS, but if I lose one, I'll get another one while I use the 2nd.
- rb808 7y ago> I have one at work This seems really easy to steal. > one at home Most people I know have been burgled too.
- munchbunny 7y agoKeep two or three, put one in a bank or a safe at home. That should be enough redundancy for most people. As long as you can still get in to revoke/enroll stuff you should be okay. It’s not so much a problem as it is a balance of security, redundancy, and effort. You decide where you want to be on that balance of considerations.
- bsder 7y ago> Keep two or three, put one in a bank or a safe at home. That should be enough redundancy for most people. Yeah, good luck. I don't know of any system that lets me enroll 3 security keys for an account.
- henkslaaf 7y agoDoesn't Google let you set an arbitrary amount?
- munchbunny 7y agoYes, as does Github and Facebook. I forget whether AWS does.
- cookingrobot 7y agoSafe deposit boxes aren’t safe: https://www.google.com/amp/s/www.nytimes.com/2019/07/19/business/safe-deposit-box-theft.amp.html https://www.google.com/amp/s/www.nytimes.com/2019/07/19/busi...
- dev_dull 7y ago“Hello thanks for calling. I understand you want to reset your password. To verify it’s really you may I have your cryptographically impregnable super token? Oh it’s lost, I see, how about can you verify your billing zip? Splendid you’re all reset.”
- 55555 7y agoI think he's saying that the private keys to his crypto never leave physical hardware. There is no phone number to call if he loses them, but on the other hand what you are describing is impossible.
- sdan 7y agoSuppose we take Coinbase (I don't use it, but I've heard SIM swapping is done regularly with Coinbase): Suppose you lose all your physical keys: I don't think you can social engineer hack Coinbase (pretty sure most companies won't allow people to just give away your password/send a reset email to some other email). Or suppose you get them to send me an email to reset my password. But my email also has FIDO u2f! And I know as a fact you can't social hack my email provider.
- 7y ago