4 ms·
If your FIDO2 key is compromised, you can bin it and change to a new key. If your fingerprint is compromised, where can get new fingerprints? Device based sec
by iso1631 6y ago
If your FIDO2 key is compromised, you can bin it and change to a new key.
If your fingerprint is compromised, where can get new fingerprints?
Device based security (like a FIDO2 key, or even a phone with an authenticator app) is great, beuacse when it's compromised, you can change it.
Biometrics though is even worse than a userID, it's public, left everywhere, and can't be changed
- lstamour 6y agoThere's a difference. If your FIDO2 key has biometrics (such as touch ID) then it's still a FIDO2 key. It means if it gets compromised (lost or stolen, for example) then you need both the device and the biometrics to gain access. If your fingerprints are lifted/leaked from a glass, for example, then published, your attackers also still need physical access to the device you use biometric security against. If that's public, such as your house front door, I agree, you've a problem. If that's your cellphone, then you have to ensure you don't leave your phone unsupervised. The same is frankly true of other exploits that can be done in-person, such as USB attacks or PIN code screen bypass, and so on. Once you have physical access to a device, you can authenticate via many means, not just biometrics. I'd point out that a password can also be compromised. https://xkcd.com/538/ https://xkcd.com/538/