3 ms·
You do not need 2 factors with this solution, which is the whole point. This isn’t a 2FA token anymore. 2FA was a mitigation against phishing and credential the
by lawnchair_larry 7y ago
You do not need 2 factors with this solution, which is the whole point. This isn’t a 2FA token anymore. 2FA was a mitigation against phishing and credential theft. This solves that problem with a single factor. It is a password replacement.
- bonzini 7y agoFingerprints can be stolen. A fingerprint is an obfuscated username, it's not a replacement for a password.
- ryeights 7y agoUnlike a password, a court (in the US) might be able to compel you to provide access to your accounts/encrypted disks via your YubiKey + fingerprint.
- LinuxBender 7y agoIf I were defending against legal duress, then I would design the system to require my MFA and there would be a prompt to a team in another region that has to "approve" my login real time. This method is not perfect, because that team has to be an entirely different company/organization to not be included in the same legal order and there are other legal issues with that setup. I am not a lawyer and would never pass the bar. Anyway, my MFA would decrypt part of the key and the other team would provide the remainder of the decryption of the key if they approve my access. Some old secure mainframes were setup in this fashion.
- daxelrod 7y agoWhile the cases in which a court could compel you to provide your password are much narrower, note that they still do exist. https://arstechnica.com/tech-policy/2017/03/man-jailed-indefinitely-for-refusing-to-decrypt-hard-drives-loses-appeal/ https://arstechnica.com/tech-policy/2017/03/man-jailed-indef...
- kerng 7y agoI'd still prefer mfa for important stuff, because two factors are better then one. Since the one thing we know about security is that we don't know or understand it that well, and time works against security engineering.