2 ms·
> but they'll have to pry that U2F token out of my cold dead hands. That is a trade off between attack surface and difficulty of the "hack" though. Depending o
by V1ndaar 4y ago
> but they'll have to pry that U2F token out of my cold dead hands.
That is a trade off between attack surface and difficulty of the "hack" though. Depending on who and where you are, getting your physical token by force is trivial. If your token is important enough, there will be plenty of people that won't shy from using violence.
- folago 4y agohttps://xkcd.com/538/ https://xkcd.com/538/
- anilakar 4y agoGetting a password or a PIN code to a smart card by force is trivial, too. Even if one's physical wellbeing is protected by law, they can still be jailed[1] for failing to provide a password, even if no such password exists. The previous guy who educated me about rubber hose threat modeling later turned out to be running a drug dealing operation[2]. [1] https://www.saunders.co.uk/news/prosecuted-for-your-password/ https://www.saunders.co.uk/news/prosecuted-for-your-password... [2] https://www.newsbtc.com/all/douppikauppa-darknet-drug-lord-arrested-in-finland/ https://www.newsbtc.com/all/douppikauppa-darknet-drug-lord-a...