4 ms·
What is your objection to just leaving a yubikey plugged in? It eliminates most of the ways an attacker could impersonate me besides literally stealing my lapto
by wyager 6y ago
What is your objection to just leaving a yubikey plugged in? It eliminates most of the ways an attacker could impersonate me besides literally stealing my laptop, which is a high bar. Most people are valuable enough targets to phish or infect with malware or something, but not to plan a computer heist.
- kps 6y agoIf stealing the computer is enough, someone's seriously screwed up already — it's supposed to be 2FA, not 1FA.
- aidenn0 6y agoStealing the computer is usually enough, as a browser cookie serves as proof of authentication all on its own. Some destructive operations require extra auth, but in terms of data exfiltration, stealing a laptop gives you everything you need.
- izacus 6y agoWhat exactly does that have to do with YubiKeys though? Every time you use one you need to enter password. And you can also immediately revoke it as soon as you notice its stolen.
- aidenn0 6y agoI kind of omitted that part. Having a YubiKey in or not in the laptop won't really affect things (other than the fact that you will need to get into your account somehow without the yubikey if the yubikey is stolen).