3 ms·

Umm ... your conclusion is kind of funny and wrong. You might not be familiar with cryptography, modern smartcard technologies, and how those can actually keep

by markkum 15y ago

Umm ... your conclusion is kind of funny and wrong. You might not be familiar with cryptography, modern smartcard technologies, and how those can actually keep a secret. I agree with your assessment on facial recognition and fingerprints, though the biggest problems with the fingerprint authentication are the lack of ubiquitous sensors and privacy issues. But password manager software is better than nothing ;)

jayfuerstenberg 15y ago
I'm quite familiar with cryptography and the principles of secret keeping. I am not as knowledgable about smartcards I admit. Is there something that makes a smartcard based USB key work differently when held by a person other than its rightful owner? My impression of them, perhaps incorrect, is that they are akin to Hanko ( http://en.wikipedia.org/wiki/Hanko_(stamp)#Japanese_usage http://en.wikipedia.org/wiki/Hanko_(stamp)#Japanese_usage ). Basically a system of using possession combined with a fairly unique set of data as a means of distinguishing and authenticating its owner. But in practice its far less than perfect.
- markkum 15y ago
  Good smartcard in general cannot be copied and it will not work without the user's pin code. It can also lock itself if the pin code is entered wrong too many times. But most importantly, the keys/certificates inside the smartcard can be revoked remotely if the smartcard is lost. So even if the wrongful holder of the key has somehow got hold of the pin code, he cannot use the key for long. Nothing is perfect of course. The risk/threat is very similar to someone stealing your phone and has somehow gotten to know your master password to your password management software. However, password management does not really solve neither the usability or the security problems of usernames and passwords ... although a good piece of software can certainly help.
  - jayfuerstenberg 15y ago
    Thanks for the thorough reply! It sounds promising.

by markkum 15y ago

jayfuerstenberg 15y ago

I'm quite familiar with cryptography and the principles of secret keeping. I am not as knowledgable about smartcards I admit. Is there something that makes a smartcard based USB key work differently when held by a person other than its rightful owner? My impression of them, perhaps incorrect, is that they are akin to Hanko ( http://en.wikipedia.org/wiki/Hanko_(stamp)#Japanese_usage http://en.wikipedia.org/wiki/Hanko_(stamp)#Japanese_usage ). Basically a system of using possession combined with a fairly unique set of data as a means of distinguishing and authenticating its owner. But in practice its far less than perfect.

markkum 15y ago
Good smartcard in general cannot be copied and it will not work without the user's pin code. It can also lock itself if the pin code is entered wrong too many times. But most importantly, the keys/certificates inside the smartcard can be revoked remotely if the smartcard is lost. So even if the wrongful holder of the key has somehow got hold of the pin code, he cannot use the key for long. Nothing is perfect of course. The risk/threat is very similar to someone stealing your phone and has somehow gotten to know your master password to your password management software. However, password management does not really solve neither the usability or the security problems of usernames and passwords ... although a good piece of software can certainly help.
- jayfuerstenberg 15y ago
  Thanks for the thorough reply! It sounds promising.