3 ms·

> No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Remember, 2fa is your second factor. It’s ri

> No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Remember, 2fa is your second factor. It’s right there in the acronym. It is there to protect against a bad actor stealing your password. By definition, a second factor won’t improve the ergonomics of logging in.

iudqnolq 4y ago
Not quite. A second factor would allow me to reduce the complexity of my password while retaining the same level of security. Without that the only benefit of a Yubikey over a strong password saved in a password manager is phishing protection, which I'm not willing to pay that amount of money for.
- hamandcheese 4y ago
  Not just phishing - you could lose your password via malware, or if services store passwords in clear text and get hacked.
  - iudqnolq 4y ago
    I use different passwords for every service. Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. If the service is hacked, the hacker probably has direct access to everything the password was protecting.
    - hamandcheese 4y ago
      > Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. Any well-secured service should protect critical actions with 2fa. “oh, are you sure you want to transfer all your funds? Please re-authenticate first”
      - snadal 4y ago
        So if your device is compromised, the attacker could trick you into entering 2FA for some minor action while it actually is transferring all your funds. If your PC or smartphone is compromised nothing will prevent you from losing control of your accounts.
        hamandcheese 4y ago
        Which gives you more chance at detecting such an attack. Without 2fa, the funds are already gone.
        xani_ 4y ago
        That's kinda problem of many 2FA systems, my bank's send me the reason for 2FA and amount + last few digits of account if it is money transactions.
        snadal 4y ago
        Yes, that is what I was trying to point out. With Yubikey or other 2FA devices you can not see the transaction details of what are you signing unless the device has a screen so a screenless device does not protect much more than this virtual yubikey.
- clhodapp 4y ago
  If you believe yourself essentially immune to phishing and password leakage, I don't think that you are very likely to be convinced that you should buy a Yubikey. The place where they shine is when you have already acknowledged that you want (or have been forced by your employer to use) 2FA.
jeroenhd 4y ago
This is definitely true but honestly I'd love more websites to switch everything around and use a password for the optional second factor. Many messenger apps already do something like this (using your phone numbers as a first factor and using an optional password for account protection) and IMO the login flow is much easier for services that I don't care about. Let me register and login with WebAuthn alone and I'll be very happy. You can even use the same logic you're already using for password resets, just re-enroll the FIDO key when someone clicks "I can't log in" and proces access to their email account. Immune to credential stuffing and many other digital attacks that can happen from the other side of the world while you're asleep!

iudqnolq 4y ago

Not quite. A second factor would allow me to reduce the complexity of my password while retaining the same level of security. Without that the only benefit of a Yubikey over a strong password saved in a password manager is phishing protection, which I'm not willing to pay that amount of money for.

hamandcheese 4y ago
Not just phishing - you could lose your password via malware, or if services store passwords in clear text and get hacked.
- iudqnolq 4y ago
  I use different passwords for every service. Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. If the service is hacked, the hacker probably has direct access to everything the password was protecting.
  - hamandcheese 4y ago
    > Malware on a device where I'm logged into the service can use that authenticated session to access all the things I want protected. Any well-secured service should protect critical actions with 2fa. “oh, are you sure you want to transfer all your funds? Please re-authenticate first”
    - snadal 4y ago
      So if your device is compromised, the attacker could trick you into entering 2FA for some minor action while it actually is transferring all your funds. If your PC or smartphone is compromised nothing will prevent you from losing control of your accounts.
      - hamandcheese 4y ago
        Which gives you more chance at detecting such an attack. Without 2fa, the funds are already gone.
      - xani_ 4y ago
        That's kinda problem of many 2FA systems, my bank's send me the reason for 2FA and amount + last few digits of account if it is money transactions.
        snadal 4y ago
        Yes, that is what I was trying to point out. With Yubikey or other 2FA devices you can not see the transaction details of what are you signing unless the device has a screen so a screenless device does not protect much more than this virtual yubikey.
clhodapp 4y ago
If you believe yourself essentially immune to phishing and password leakage, I don't think that you are very likely to be convinced that you should buy a Yubikey. The place where they shine is when you have already acknowledged that you want (or have been forced by your employer to use) 2FA.

jeroenhd 4y ago

This is definitely true but honestly I'd love more websites to switch everything around and use a password for the optional second factor. Many messenger apps already do something like this (using your phone numbers as a first factor and using an optional password for account protection) and IMO the login flow is much easier for services that I don't care about. Let me register and login with WebAuthn alone and I'll be very happy. You can even use the same logic you're already using for password resets, just re-enroll the FIDO key when someone clicks "I can't log in" and proces access to their email account. Immune to credential stuffing and many other digital attacks that can happen from the other side of the world while you're asleep!