3 ms·

Does nobody else here have an actual key to unlock their car / housing? Like this was a solution that has worked for a long time. Sure houses/cars get broken i

Does nobody else here have an actual key to unlock their car / housing? Like this was a solution that has worked for a long time. Sure houses/cars get broken into all the time but so do online accounts and judging my my spam mail, more people I know have had their online account hacked than their car/house broken into. And I know many more instances of people forgetting their password and reseting it than them locking their keys in the car.

lolinder 4y ago
The difference between houses/cars and online accounts is that a physical key must be joined to the single matching physical lock, which reduces the number of possible attackers dramatically and forces them to operate in meatspace. This means that a less secure solution is viable because there are fewer attackers and they are more likely to get caught. It also means that an easily-lost solution is more acceptable because it's easier to persuade a locksmith or police officer that I actually own the property: I can hand them my driver's license in person, and I'd be risking immediate arrest by even trying to pull off a social engineering attack. This allows recovery of a key to be far easier in the real world. Physical keys to digital accounts cannot be as easy to replace because if they were, anyone anywhere might be able to persuade the digital "locksmith" that they're me, and the worst case scenario for the social engineer is that their attack fails and they try again later.
- lesuorac 4y ago
  > The difference between houses/cars and online accounts is that a physical key must be joined to the single matching physical lock, which reduces the number of possible attackers dramatically and forces them to operate in meatspace. Sure but a digital physical key uses a much more difficult password than you could memorize so even though there are more attackers the difficult of breaking the key has gone up. > Physical keys to digital accounts cannot be as easy to replace because if they were, anyone anywhere might be able to persuade the digital "locksmith" that they're me, and the worst case scenario for the social engineer is that their attack fails and they try again later. I fail to see how this is different from the current password status quo. This is quite literally a well published attack vector into accounts, call up support and pretend to be the other person using their data from w/e leak happened recently enough. With a physical key there's going to be way less people forgetting their password so the same staff can spend more time verifying that somebody is who they say they are (or a company can do the same quality will less staff).

lolinder 4y ago

The difference between houses/cars and online accounts is that a physical key must be joined to the single matching physical lock, which reduces the number of possible attackers dramatically and forces them to operate in meatspace. This means that a less secure solution is viable because there are fewer attackers and they are more likely to get caught. It also means that an easily-lost solution is more acceptable because it's easier to persuade a locksmith or police officer that I actually own the property: I can hand them my driver's license in person, and I'd be risking immediate arrest by even trying to pull off a social engineering attack. This allows recovery of a key to be far easier in the real world. Physical keys to digital accounts cannot be as easy to replace because if they were, anyone anywhere might be able to persuade the digital "locksmith" that they're me, and the worst case scenario for the social engineer is that their attack fails and they try again later.

lesuorac 4y ago
> The difference between houses/cars and online accounts is that a physical key must be joined to the single matching physical lock, which reduces the number of possible attackers dramatically and forces them to operate in meatspace. Sure but a digital physical key uses a much more difficult password than you could memorize so even though there are more attackers the difficult of breaking the key has gone up. > Physical keys to digital accounts cannot be as easy to replace because if they were, anyone anywhere might be able to persuade the digital "locksmith" that they're me, and the worst case scenario for the social engineer is that their attack fails and they try again later. I fail to see how this is different from the current password status quo. This is quite literally a well published attack vector into accounts, call up support and pretend to be the other person using their data from w/e leak happened recently enough. With a physical key there's going to be way less people forgetting their password so the same staff can spend more time verifying that somebody is who they say they are (or a company can do the same quality will less staff).