3 ms·
Hardware security modules mitigate the consequences of host PC compromise. At minimum, they expose signing and decryption operations over captive keys, so that
by closeparen 5y ago
Hardware security modules mitigate the consequences of host PC compromise. At minimum, they expose signing and decryption operations over captive keys, so that a remote attacker might use the key but can't get their own copy.
Good ones have out-of-band mechanisms for confirming and authorizing the operations, so a remote attacker would need the cooperation of someone physically present. The simplest form might just be a button (like a Yubikey). A hardware wallet like Trezor has a screen where you can actually read the destination address and amount of the transaction to sign.
- karmakaze 5y agoI don't think I'm a person who understands modern day security. How is a Yubikey permanently attached to my laptop that anyone can touch when needed better than using TouchID?
- kevincox 5y agoIt isn't. TouchID and Yubikey are in the same security class they are both HSM devices with physical presence tests. A HSM with a fingerprint reader is actually better than a Yubikey as it has a stronger presence verification. The only real advantage of a Yubikey in this case is portability. The parent is comparing to a key living in software, which TouchID is not.
- karmakaze 5y agoThe factor that TouchID verifies isn't merely presence, it's 'something I am'--others being something I have (laptop/Yubikey), and something I know.