4 ms·

The ideal solution should hopefully handle a "mugged in a foreign country" hypothetical. If a normal person traveling abroad loses both their wallet and phone,

by slg 5y ago

The ideal solution should hopefully handle a "mugged in a foreign country" hypothetical. If a normal person traveling abroad loses both their wallet and phone, would they be able to regain access to their digital life before they got home? With Sprint/T-Mobile's current approach, the answer would be yes. With WebAuthn, it is a big maybe and is probably a no for most people. We are back at the security versus convenience choice.

jdavis703 5y ago
I think most people carry their security keys on their keyring. And since most muggers don't demand keys I think people should generally be safe.
- eikenberry 5y ago
  Except many people keep their keyring in their bag and muggers often just grab the bag.
  - pishpash 5y ago
    Then keep another key somewhere else, like with a fellow traveler or at the hotel. This is why people make copies of physical keys. All security is physical security. We need to end the delusion that it is not or can somehow be bypassed, and embrace it instead.
    - tannedNerd 5y ago
      And when you get mugged in transit from the hotel to the airport or vis-versa your plan falls apart. Unless you are going to pay someone to drive a different route in a different car with your hardware key...
    - bashinator 5y ago
      You can’t duplicate hardware MFA keys. You’d have to individually set up the second device everywhere you use MFA, and many services only support a single device (looking at you, AWS).
      - buck4roo 5y ago
        > many services only support a single device (looking at you, AWS). We can (finally) take AWS off that list. I can say I was pleasantly surprised recently by being able to enroll multiple MFA Tokens and device types, for a single IAM SSO User. Don't know the restrictions on it, but https://aws.amazon.com/iam/features/mfa/ https://aws.amazon.com/iam/features/mfa/ probably has more details.
      - tialaramex 5y ago
        > many services only support a single device (looking at you, AWS) I really wish people would stop doing this. It's not "many services" it's one service. "Many women have played the role of Ellen Ripley in the Alien movies (looking at you, Sigourney Weaver)". No. One woman did that and you just named her, not many. Don't use "many" to mean, "Well, one, but when I wrote that it didn't seem like I had a point worth making". If you instead present this as "AWS is broken" then we see what the problem actually is and who needs to fix it.
      - lrvick 5y ago
        This is inaccurate. You can't duplicate entry level devices like Yubikeys but hardware wallets like Ledger and Trezor both support backup of FIDO seeds in the form of 24 english words you can store endless ways, or recover to a secondary device. I have duplicates of all my MFA keys. These devices are also more secure as they show you the website you are approving on screen to avoid being tricked by malware.
    - franga2000 5y ago
      Good luck making a copy of a security key - most are designed to prevent that (for valid-ish reasons) and the only other option (always enroll two keys) has a host of other problems, especially since in the "always carry two" case you need to also keep a third one at home.
      - lrvick 5y ago
        I have encrypted backups and duplicates of all my security keys. You simply need to choose a security key that supports BIP39 backups like a Trezor or Ledger. As an alternative most sites support enrolling multiple keys.
    - kortilla 5y ago
      > Then keep another key somewhere else, like with a fellow traveler or at the hotel Hotels aren’t safe for valuables and people travel alone. We’re getting pretty far removed from convenience here as well. Might as well suggest people keep their keys shoved up their ass.
      - _Algernon_ 5y ago
        Buttplug with yubikey integrated. Startup idea of the year :P
        lrvick 5y ago
        A 24 word mnemonic FIDO backup seed can fit AES256 encrypted in a 1K NFC tag, which come in sizes as small as a grain of rice. You can store it in a subdermal implant, under the sole of your shoe, a belt buckle, or in a finger ring or other jewelry. Options are endless.
    - thefr0g 5y ago
      Maybe we could just use something that can't be stolen. Something like a shared secret that is exchanged through secure channels beforehand and then only resides in the users permanent memory. The second party could even use some kind of novel mathematical function that maps arbitrarily sized secrets to a seemingly random fixed size value that is both sufficiently different for similiar inputs and big enough to avoid collisions. That would allow them to not store the secret in plain text as they could just compare the output of the function with the previously saved one to verify that the secret the user gave is most likely correct.
lrvick 5y ago
If someone loses their passport while traveling they are often locked out of access to their home country, let alone their digital life. It is not permissible to use digital backup copies of paper identity documents in most countries but with digital identity you can make all the backups you want and store them places hard to lose. Travelers would be wise to do so. It is free and reasonably easy. There is just a training gap, the tech is here. Personally I keep an AES encrypted backup needed for emergency recovery of my digital life implanted in my body. Others I know use NFC rings.
- anchpop 5y ago
  if you lose your passport while in a foreign country you’re permanently locked out of ever traveling back home? that can’t possibly be true. I can see it being hard if you have no living family though
- randomswede 5y ago
  First starting point for "I lost my passport" should be "visit your embassy in the country you are in". It may not be an instant solution, but should normally result in a temporary passport you can use to travel home with, then once home you should be able to bootstrap from there.

by slg 5y ago

jdavis703 5y ago

I think most people carry their security keys on their keyring. And since most muggers don't demand keys I think people should generally be safe.

eikenberry 5y ago
Except many people keep their keyring in their bag and muggers often just grab the bag.
- pishpash 5y ago
  Then keep another key somewhere else, like with a fellow traveler or at the hotel. This is why people make copies of physical keys. All security is physical security. We need to end the delusion that it is not or can somehow be bypassed, and embrace it instead.
  - tannedNerd 5y ago
    And when you get mugged in transit from the hotel to the airport or vis-versa your plan falls apart. Unless you are going to pay someone to drive a different route in a different car with your hardware key...
  - bashinator 5y ago
    You can’t duplicate hardware MFA keys. You’d have to individually set up the second device everywhere you use MFA, and many services only support a single device (looking at you, AWS).
    - buck4roo 5y ago
      > many services only support a single device (looking at you, AWS). We can (finally) take AWS off that list. I can say I was pleasantly surprised recently by being able to enroll multiple MFA Tokens and device types, for a single IAM SSO User. Don't know the restrictions on it, but https://aws.amazon.com/iam/features/mfa/ https://aws.amazon.com/iam/features/mfa/ probably has more details.
    - tialaramex 5y ago
      > many services only support a single device (looking at you, AWS) I really wish people would stop doing this. It's not "many services" it's one service. "Many women have played the role of Ellen Ripley in the Alien movies (looking at you, Sigourney Weaver)". No. One woman did that and you just named her, not many. Don't use "many" to mean, "Well, one, but when I wrote that it didn't seem like I had a point worth making". If you instead present this as "AWS is broken" then we see what the problem actually is and who needs to fix it.
    - lrvick 5y ago
      This is inaccurate. You can't duplicate entry level devices like Yubikeys but hardware wallets like Ledger and Trezor both support backup of FIDO seeds in the form of 24 english words you can store endless ways, or recover to a secondary device. I have duplicates of all my MFA keys. These devices are also more secure as they show you the website you are approving on screen to avoid being tricked by malware.
  - franga2000 5y ago
    Good luck making a copy of a security key - most are designed to prevent that (for valid-ish reasons) and the only other option (always enroll two keys) has a host of other problems, especially since in the "always carry two" case you need to also keep a third one at home.
    - lrvick 5y ago
      I have encrypted backups and duplicates of all my security keys. You simply need to choose a security key that supports BIP39 backups like a Trezor or Ledger. As an alternative most sites support enrolling multiple keys.
  - kortilla 5y ago
    > Then keep another key somewhere else, like with a fellow traveler or at the hotel Hotels aren’t safe for valuables and people travel alone. We’re getting pretty far removed from convenience here as well. Might as well suggest people keep their keys shoved up their ass.
    - _Algernon_ 5y ago
      Buttplug with yubikey integrated. Startup idea of the year :P
      - lrvick 5y ago
        A 24 word mnemonic FIDO backup seed can fit AES256 encrypted in a 1K NFC tag, which come in sizes as small as a grain of rice. You can store it in a subdermal implant, under the sole of your shoe, a belt buckle, or in a finger ring or other jewelry. Options are endless.
  - thefr0g 5y ago
    Maybe we could just use something that can't be stolen. Something like a shared secret that is exchanged through secure channels beforehand and then only resides in the users permanent memory. The second party could even use some kind of novel mathematical function that maps arbitrarily sized secrets to a seemingly random fixed size value that is both sufficiently different for similiar inputs and big enough to avoid collisions. That would allow them to not store the secret in plain text as they could just compare the output of the function with the previously saved one to verify that the secret the user gave is most likely correct.

lrvick 5y ago

If someone loses their passport while traveling they are often locked out of access to their home country, let alone their digital life. It is not permissible to use digital backup copies of paper identity documents in most countries but with digital identity you can make all the backups you want and store them places hard to lose. Travelers would be wise to do so. It is free and reasonably easy. There is just a training gap, the tech is here. Personally I keep an AES encrypted backup needed for emergency recovery of my digital life implanted in my body. Others I know use NFC rings.

anchpop 5y ago
if you lose your passport while in a foreign country you’re permanently locked out of ever traveling back home? that can’t possibly be true. I can see it being hard if you have no living family though
randomswede 5y ago
First starting point for "I lost my passport" should be "visit your embassy in the country you are in". It may not be an instant solution, but should normally result in a temporary passport you can use to travel home with, then once home you should be able to bootstrap from there.