4 ms·
> most of us actually know how to keep our passwords secure, at least relative to the average user. I'm an IT professional and despite using a password manage
by anilakar 4y ago
> most of us actually know how to keep our passwords secure, at least relative to the average user.
I'm an IT professional and despite using a password manager, I still prefer a physical security solution to a cybersecurity one. An attacker might be able to dump unencrypted secrets from my password manager, but they'll have to pry that U2F token out of my cold dead hands.
The password field in its current inlined form has to go in one way or another.
- V1ndaar 4y ago> but they'll have to pry that U2F token out of my cold dead hands. That is a trade off between attack surface and difficulty of the "hack" though. Depending on who and where you are, getting your physical token by force is trivial. If your token is important enough, there will be plenty of people that won't shy from using violence.
- folago 4y agohttps://xkcd.com/538/ https://xkcd.com/538/
- anilakar 4y agoGetting a password or a PIN code to a smart card by force is trivial, too. Even if one's physical wellbeing is protected by law, they can still be jailed[1] for failing to provide a password, even if no such password exists. The previous guy who educated me about rubber hose threat modeling later turned out to be running a drug dealing operation[2]. [1] https://www.saunders.co.uk/news/prosecuted-for-your-password/ https://www.saunders.co.uk/news/prosecuted-for-your-password... [2] https://www.newsbtc.com/all/douppikauppa-darknet-drug-lord-arrested-in-finland/ https://www.newsbtc.com/all/douppikauppa-darknet-drug-lord-a...