4 ms·

Hardware keys are vulnerable to other things. Like getting stolen, getting lost, getting broken or getting hacked. Uasually at a moment where you can't readily

by megous 4y ago

Hardware keys are vulnerable to other things. Like getting stolen, getting lost, getting broken or getting hacked. Uasually at a moment where you can't readily replace them. Phishing is possible to avoid.

taeric 4y ago
"Phishing is possible to avoid" is almost as true as "it is possible to write safe C code." Technically true, but practically not so much. Now, I grant that for most of us, if you are the target of any nation state level actor, not much you can do. For the most part, they can just compel the party that has your data. That said, security keys are far safer than portable data.
- megous 4y ago
  I don't mind to differ on this one. Your reaction certainly didn't address any of my concerns about practicality of HW keys in any scenario where you're not just sitting at home and can lose your key, and will be fucked if you'll not be able to recover or downgrade your security for a little bit until everything's normal again. Maybe to secure corporate accounts against phishing, or whatever. But for my personal stuff, I need to be able to recover in many ways at any time with just a random computer and internet access without any special HW that may not be readily obtainable the moment I need it.
  - taeric 4y ago
    I don't think you are wrong, but I do find it funny how the threat models get built so differently. My personal feel is I'm ok not having my key with me when I'm "out and about." Is no different than my not having some of my ID cards with me. Such that, I'm already "locked out" of many of my financial accounts and such when I am not at home. But, I fully ack that that is a personal choice here. I just can't think of any situation I've been in, in a LONG time, where I was needing to randomly use a computer. Edit: It also occurs to me that keeping keys to get back into your home is almost certainly similar in concern here. As somewhat crazy as I think the "keychain" nature of these tokens is, it does address a large part of this problem.
Brian_K_White 4y ago
I just realized that there are a lot of kids out there with all the balls necessary to hold their parent's keys hostage. Even if you would never be tricked into giving up or losing your key, there are other people in your life who can do it either for themselves or be tricked or compelled into doing it for someone else while you're asleep or in the shower or any of 1000 opportunities every day. Would you immediately detect a good fake substitution? When would be the next important login that needed it?

by megous 4y ago

taeric 4y ago

"Phishing is possible to avoid" is almost as true as "it is possible to write safe C code." Technically true, but practically not so much. Now, I grant that for most of us, if you are the target of any nation state level actor, not much you can do. For the most part, they can just compel the party that has your data. That said, security keys are far safer than portable data.

megous 4y ago
I don't mind to differ on this one. Your reaction certainly didn't address any of my concerns about practicality of HW keys in any scenario where you're not just sitting at home and can lose your key, and will be fucked if you'll not be able to recover or downgrade your security for a little bit until everything's normal again. Maybe to secure corporate accounts against phishing, or whatever. But for my personal stuff, I need to be able to recover in many ways at any time with just a random computer and internet access without any special HW that may not be readily obtainable the moment I need it.
- taeric 4y ago
  I don't think you are wrong, but I do find it funny how the threat models get built so differently. My personal feel is I'm ok not having my key with me when I'm "out and about." Is no different than my not having some of my ID cards with me. Such that, I'm already "locked out" of many of my financial accounts and such when I am not at home. But, I fully ack that that is a personal choice here. I just can't think of any situation I've been in, in a LONG time, where I was needing to randomly use a computer. Edit: It also occurs to me that keeping keys to get back into your home is almost certainly similar in concern here. As somewhat crazy as I think the "keychain" nature of these tokens is, it does address a large part of this problem.

Brian_K_White 4y ago

I just realized that there are a lot of kids out there with all the balls necessary to hold their parent's keys hostage. Even if you would never be tricked into giving up or losing your key, there are other people in your life who can do it either for themselves or be tricked or compelled into doing it for someone else while you're asleep or in the shower or any of 1000 opportunities every day. Would you immediately detect a good fake substitution? When would be the next important login that needed it?