4 ms·
All the complaints made about yubikey and webauthn could be made about 2fa 5-10 years ago. Hardware tokens gated by software (ala yubikey + webauthn) are clearl
by mapgrep 6y ago
All the complaints made about yubikey and webauthn could be made about 2fa 5-10 years ago. Hardware tokens gated by software (ala yubikey + webauthn) are clearly the next step in auth.
It’s an accident of circumstance you even need to buy a yubikey - your iPhone, iPad, laptop, android whatever can do everything a yubikey does. There just needs to be enough demand and time for OS and hardware vendors to come around to shipping and integrating this stuff by default. Suddenly you’ll own 3 or 4 yubikey equivalents without buying any special auth devices.
25 years into the web and our login tools remain pretty barbaric. Maybe in 25 years we’ll have it sorted out. But change is coming. Call it 2fa, webauthn, whatever - regardless of the details username/password auth (on its own) is dead.
- snarf21 6y agoYeah. It is mostly about integrating and standards. Private keys in the secure enclave already does everything Yubikey does. All phones already have it. The OSes just need to support FIDO and then we don't need passwords anymore (assuming a passcode lock on device). Essentially everyone would have 3FA (something you know, something you have and something you are)
- BlackFly 6y agoSecure enclaves as a second factor break the assumptions of 2FA threat models. If I compromise a single factor (your device) then I can gain both your password and your second factor. The best second factors are separate devices with their own screens that indicate what you are authenticating to/for before you provide your authentication. Of course, nothing ever stops a user from deputizing malware.
- snarf21 6y agoI guess I'm not seeing the difference between the secure enclave in a phone and the secure chip in a Yubikey in regards to threat models.
- deleted 6y ago[deleted]
- m463 6y agoWhy don't we just skip to 4fa, now. (though it might be tough for chimeras who have 2 sets of dna)
- captaincrowbar 6y agoMaybe they can pioneer 5fa.