6 ms·
You won't because people are married to their phones now. Anything else is an alien concept. Cars don't use keys anymore, people are going to be dumbfounded why
by aliqot 4y ago
You won't because people are married to their phones now. Anything else is an alien concept. Cars don't use keys anymore, people are going to be dumbfounded why their computer suddenly does.
- bombcar 4y agoYou could solve 90% of this by having a yubikey be built into the phone itself. Non-techies would be "using their phone" and people who care could get a stand-alone yubikey thing.
- EduardoBautista 4y agoThis is basically what you are describing: https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-the-web/ https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-... It's not widely adopted, unfortunately.
- ghaff 4y agoWhat's the advantage relative to a soft token? (Though it's arguable that Apple/Android should have an installed soft token out of the box.)
- bombcar 4y agoIt can be a hard token utilizing the secure features of the phone itself. This has the downsides if you lose the phone you lose the token, but that downside exists for a physical token, too. The goal is to encourage them to support the tokens so that those who want to can go phone-free (by using a hardware yubikey instead).
- deleted 4y ago[deleted]
- zarzavat 4y agoIsn’t a “yubikey built into a phone” just equivalent to a password manager? What threat is actually prevented by that? You have to have some way to sync the “yubikey” so that the phone can be restored if it is lost.
- bombcar 4y agoNot necessarily - it could be the Secure Enclave thingy and yes, if you lost your phone it would be like losing your yubikey, but the goal would be to get more support for yubikey like things.
- zarzavat 4y agoThe point is people don’t buy just one yubikey. You are supposed to buy them in pairs at least. So whatever you put in a Secure Enclave needs cloud backup for normal people to be able to use it, at which point it’s not functionally a yubikey anymore.
- codegeek 4y agoI am talking about SMS specific. You could still do TOTP based/Authenticator app (not perfect but much better than SMS) and then have backups on multiple phones or even password managers as needed so that it is not tied to one single phone number.
- adrr 4y agoHow does my Aunt who only has a flip phone use an Authenticator app? She doesn’t even know who to use sms but understands the call verification on online banking.