4 ms·

A long, easy to remember, but hard go guess password, that is securely hashed on the other end, is an even better solution, that is proven and battle tested.

stavros 4y ago
No, it isn't. A password can be phished, a hardware key can't, among a ton of other benefits. The hardware key is orders of magnitude better than a password.
- TheChaplain 4y ago
  Until the moment you arrive at work after 1.2h commute, discovering that the key is still at home... I get your point, but the above pretty much illustrates why I ditched Yubikey and now go with 2fa-app on my mobile.
  - stavros 4y ago
    I don't know, my USB key is on my keychain. Turns out that if you couple your GitHub login to your way of entering your house, you never forget your GitHub login.
    - prophesi 4y ago
      Another decent solution is to seed the key, and keep the seed written down or in your password manager. Though I only know of the hacker version of SoloKey that lets you do that. Now you've got the convenience of passwordless login, and the peace of mind that you can always get a new spare.
      - stavros 4y ago
        This is an excellent idea, and I'm still waiting for BitWarden to implement soft-WebAuthn. That way I can just unlock my password manager (or, really, type in a passphrase that will generate the private key) and my browser can take care of all the authentication. No need to store passwords, you can securely have one password for all sites. You lose the ability of rotating it if it gets stolen, but it's unlikely to get stolen if you never enter it anywhere else.
  - mejutoco 4y ago
    Don't have a horse in this race but it sounds like having the Yubikey on the phone "cord" would also solve this problem.
- OtomotO 4y ago
  A hardware key can be stolen, while my brain is only hackable by torture
  - stavros 4y ago
    > A hardware key can be stolen, while my brain is only hackable by torture Or keyloggers, shoulder-surfing, phishing, etc etc. At this point, it just sounds like you don't want to like anything that's not passwords.
    - OtomotO 4y ago
      I would welcome something, but not the so called solutions that go under the buzzword "passwordless". Shoulder-surfing isn't a problem for me, phishing worked when I was 12 and the internet was new, keyloggers... Yup, possible, although unlikely given the choice of my OS. But alas, I digress and indeed it became personal, so let's stop it here, as I am not interested in personal discussions on the internet.

stavros 4y ago

No, it isn't. A password can be phished, a hardware key can't, among a ton of other benefits. The hardware key is orders of magnitude better than a password.

TheChaplain 4y ago
Until the moment you arrive at work after 1.2h commute, discovering that the key is still at home... I get your point, but the above pretty much illustrates why I ditched Yubikey and now go with 2fa-app on my mobile.
- stavros 4y ago
  I don't know, my USB key is on my keychain. Turns out that if you couple your GitHub login to your way of entering your house, you never forget your GitHub login.
  - prophesi 4y ago
    Another decent solution is to seed the key, and keep the seed written down or in your password manager. Though I only know of the hacker version of SoloKey that lets you do that. Now you've got the convenience of passwordless login, and the peace of mind that you can always get a new spare.
    - stavros 4y ago
      This is an excellent idea, and I'm still waiting for BitWarden to implement soft-WebAuthn. That way I can just unlock my password manager (or, really, type in a passphrase that will generate the private key) and my browser can take care of all the authentication. No need to store passwords, you can securely have one password for all sites. You lose the ability of rotating it if it gets stolen, but it's unlikely to get stolen if you never enter it anywhere else.
- mejutoco 4y ago
  Don't have a horse in this race but it sounds like having the Yubikey on the phone "cord" would also solve this problem.
OtomotO 4y ago
A hardware key can be stolen, while my brain is only hackable by torture
- stavros 4y ago
  > A hardware key can be stolen, while my brain is only hackable by torture Or keyloggers, shoulder-surfing, phishing, etc etc. At this point, it just sounds like you don't want to like anything that's not passwords.
  - OtomotO 4y ago
    I would welcome something, but not the so called solutions that go under the buzzword "passwordless". Shoulder-surfing isn't a problem for me, phishing worked when I was 12 and the internet was new, keyloggers... Yup, possible, although unlikely given the choice of my OS. But alas, I digress and indeed it became personal, so let's stop it here, as I am not interested in personal discussions on the internet.