4 ms·

I feel like we're way better off just sending an email every time a user logs into a new device. We already have to assume the email is secure anyway... Having

I feel like we're way better off just sending an email every time a user logs into a new device. We already have to assume the email is secure anyway... Having to have tons of Yubikeys adds so much friction.

_8j50 4y ago
Death to email! Stop using email entirely unless users opt-in. Give users the option of FIDO or passwordless auth apps with a reset code or oauth federation with a third party.
- doliveira 4y ago
  I was listening to a security podcast in which the host was quite proud of having lots of Yubikeys around. No way this scales to the general population.
  - _8j50 4y ago
    For companies, I think it should be part of the employee badge's cost. Just another peripheral. I think it can indeed scale, people use USB drives a lot, think of it as another peripheral similar to mouse or keyboard. It is especially more attractive as a single factor auth when you go passwordless. It is a similar security model as physical keys and the cost is only ~1x more.