8 ms·

Repeat after me: we need FIDO2 in exactly the same physical form factor as your house key. Give ‘em away all over the place, make it the default conference swag

Repeat after me: we need FIDO2 in exactly the same physical form factor as your house key. Give ‘em away all over the place, make it the default conference swag. SMS is not good.

sergiomattei 4y ago
Agreed, but they need to be sold cheaper first. A YubiKey costs me around $40 and it’s the only brand I trust. That’s inaccessible to a lot of people.
- meristem 4y ago
  And then there are UI/UX constraints. The Venn diagram of "knows how to use SMS", "knows how to use 2FA" and "knows how to use yubikey etc" does not have a lot of overlap outside a tech audience.
- seoaeu 4y ago
  They used to offer an $18 yubikey, but the cheapest one today seems to be $25. So a bit better than $40 but still way more than say a house key costs
- SAI_Peregrinus 4y ago
  The FIDO2/webauthn ones (the Security Key series) are $25 for USB A or $29 for USB C. You can't use them for storing OAUTH keys, they're not smart card compatible, they can't store your PGP keys, and can't create one-time passwords or store a static password securely... but they are cheaper.
LeoPanthera 4y ago
What happens when you lose it?
- quadrifoliate 4y ago
  FIDO keys should only be sold in 2-packs in my opinion. You should never have a single key as your second factor. That being said, one-time use backup codes are a standard way out of the problem.
  - mr_toad 4y ago
    > That being said, one-time use backup codes are a standard way out of the problem. Hardly any services seem to give that option unfortunately.
jtsiskin 4y ago
Built-in to laptops and phones is the only way we’ll get mass adoption
cortesoft 4y ago
But I don't carry a house key, because my door is opened by my phone.
saurik 4y ago
I mean... please don't trust a random key given to you at an event by someone you will never see again and might not even be affiliated with the company they are claiming to be from to not have a copy floating around in a database?

Repeat after me: we need FIDO2 in exactly the same physical form factor as your house key. Give ‘em away all over the place, make it the default conference swag. SMS is not good.

sergiomattei 4y ago

Agreed, but they need to be sold cheaper first. A YubiKey costs me around $40 and it’s the only brand I trust. That’s inaccessible to a lot of people.

meristem 4y ago
And then there are UI/UX constraints. The Venn diagram of "knows how to use SMS", "knows how to use 2FA" and "knows how to use yubikey etc" does not have a lot of overlap outside a tech audience.
seoaeu 4y ago
They used to offer an $18 yubikey, but the cheapest one today seems to be $25. So a bit better than $40 but still way more than say a house key costs
SAI_Peregrinus 4y ago
The FIDO2/webauthn ones (the Security Key series) are $25 for USB A or $29 for USB C. You can't use them for storing OAUTH keys, they're not smart card compatible, they can't store your PGP keys, and can't create one-time passwords or store a static password securely... but they are cheaper.

LeoPanthera 4y ago

What happens when you lose it?

quadrifoliate 4y ago
FIDO keys should only be sold in 2-packs in my opinion. You should never have a single key as your second factor. That being said, one-time use backup codes are a standard way out of the problem.
- mr_toad 4y ago
  > That being said, one-time use backup codes are a standard way out of the problem. Hardly any services seem to give that option unfortunately.

jtsiskin 4y ago

Built-in to laptops and phones is the only way we’ll get mass adoption

cortesoft 4y ago

But I don't carry a house key, because my door is opened by my phone.

saurik 4y ago

I mean... please don't trust a random key given to you at an event by someone you will never see again and might not even be affiliated with the company they are claiming to be from to not have a copy floating around in a database?