5 ms·
True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. B
by mabbo 6y ago
True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious.
To login to my work VPN, the password is "<my pin><output from the yubikey>". Our SSO system requires both once per day as well.
It's a great system and I highly recommend it.
- aborsy 6y agoDo you use Pass to get out the VPN password? I like that set up, even though that’s a password manager and not like an ssh key held on Yubikey.
- JamesSwift 6y agoHow does that password scheme even work unless the plaintext pin is being stored somewhere?
- LordDragonfang 6y agoThe system knows how long a yubikey string is and can easily discard that part before hashing.
- v7p1Qbt1im 6y agoIdeally something you „are“ as well. Though in practice this might be overkill for most. I believe there‘s a new biometric yubikey in the works. A fingerprint version of the 5C NFC would be cool.
- ta89489544 6y agoI get the sense that biometrics are not very future proof. People leave fingerprints and DNA on everything they touch and faces and eyes are seen by cameras all the time. Biometrics work now, but in the near future I suspect the technology to take images of peoples faces/fingerprints and reproduce their likeness to fool a biometric sensor will be a commodity. Once that happens biometrics will be near useless because you essentially have no way to respond to leaked biometric data, it can't be changed.
- ymbeld 6y agoAah, but will the cameras get enough shots of my tongue? Linguametrics, you heard it here first, folks.
- v7p1Qbt1im 6y agoAlso genital scan.
- v7p1Qbt1im 6y agoPossible yeah. Though I don‘t see this happening for a while yet. It‘s certainly marginally more secure than not having biometrics (3 instead of 2 elements).
- biosed 6y agoAmazon?
- imwillofficial 6y agoShhh!
- athorax 6y agoWe use the AnyConnect VPN client which allows for a password & 2nd password field for yubikey, same concept. Agree that it works nicely
- taeric 6y agoThis is a bit muddied when talking about securing access to something you also have. That is, you aren't securing your vpn with two factors. You are securing access to your vpn. It is different. Similarly, for your computer, it is already something you have. Such that the password to login to the machine can already be seen as a second factor. My home password, as an example, is worthless to you without me home computer. I'm not sure on the argument regarding moving to a physical key to get in the machine. By and large, it seems to be a more transferable method of accessing something. Not more secure, per se. But not less, either. (Right?)
- mikeiz404 6y agoInteresting point. I never really thought of the laptop as something you have but it certainly is. I will say that a security key is far easier to carry on you in more situations than say a laptop is and certainly a desktop. And the key, depending on how it is used to secure the device, may help mitigate brute force password attacks in the event that the device is stolen. An argument could be made for defense in depth but for most people I would guess the amount of added security is probably not super beneficial and for those where it truly does matter then securing physical access to the device is probably more important any way.
- taeric 6y agoAgreed, I wasn't trying to say that your computer counts as enough of "what you have" to third parties. Is why I don't think it counts for most accounts you have access to. That said, your phone is growing to take that privilege.
- SahAssar 6y agoThe reason a computer usually isn't considered "something you have" is that malware can clone them or they can be configured for remote access. Half the point of a yubikey or other hardware token is that they are supposed to be unclonable (and hence tied to a single physical device). Some of that can be replicated with a TPM I'm guessing but that isn't the norm yet.
- jka 6y ago> Something you have can be stolen, and something you know can be tricked out of you. Yep, it's generally been a useful combination. The "something you know" part could risk becoming a lower barrier the more that data breaches occur, and the more that people share and can infer about each other on public social media. At the moment we tend to be very focused on securing individual identities and then assuring that what we say, do and write corresponds to those identities. Perhaps a longer-term strategy is to care a bit less about the identity and be able to accept (and reject) content regardless of source.
- deleted 6y ago[deleted]
- parliament32 6y agoSounds like our setup, OpenVPN + LinOTP? Pin + HOTP in a password field is a nice way to force 2FA into applications that don't support it natively.