3 ms·
If stealing the computer is enough, someone's seriously screwed up already — it's supposed to be 2FA, not 1FA.
by kps 6y ago
If stealing the computer is enough, someone's seriously screwed up already — it's supposed to be 2FA, not 1FA.
- aidenn0 6y agoStealing the computer is usually enough, as a browser cookie serves as proof of authentication all on its own. Some destructive operations require extra auth, but in terms of data exfiltration, stealing a laptop gives you everything you need.
- izacus 6y agoWhat exactly does that have to do with YubiKeys though? Every time you use one you need to enter password. And you can also immediately revoke it as soon as you notice its stolen.
- aidenn0 6y agoI kind of omitted that part. Having a YubiKey in or not in the laptop won't really affect things (other than the fact that you will need to get into your account somehow without the yubikey if the yubikey is stolen).