3 ms·
Having your 2FA tokens on something where the keys available to the user changes it to something you know. An encrypted file with that an application decrypts
by georgyo 6y ago
Having your 2FA tokens on something where the keys available to the user changes it to something you know.
An encrypted file with that an application decrypts is still available to the user. ie, they keys are loaded into memory. In most phone and hardware tokens the key is done by a dedicated security chip and is never loaded into main memory.
- UncleMeat 6y agoSo? The code is what matters, not the key. Keeping the key on a dedicated chip doesn't matter if the adversary wants the code and has the capability of reading your process memory. "One thing you have, one thing you know" is a nice heuristic but it isn't an actual threat model analysis.