2 ms·
Allow me to reiterate my argument against passwordless. The same people that shouldersurf a pin will still your yubikey. This is why you need MFA at every auth
by _8j50 4y ago
Allow me to reiterate my argument against passwordless. The same people that shouldersurf a pin will still your yubikey.
This is why you need MFA at every authentication control. MFA means layered defense. Two factors are superior than one regardless of how good that one factor is. I support passwordless with MFA, in which case "passwordless" is just a marketing ruse because you still have to remember a secret similar to a password. And no, biometric auth "who you are" is the equivalent of a username not a secret you can use to authenticate (can be replicated but can't be revoked).
- PassageNick 4y agoPasswordless is actually MFA -- Something you have (your device) Something you are (your biometric) Those are definitely two factors that are required to be together for passwordless to work
- _8j50 4y agoPasswordless is not one thing. A yubikey does not do biometric auth. More than that "who you are" should not be used as a factor of auth but as a user id aka username. It identifies, it does not authenticate unless you can revoke it and guarantee it can't easily be reproduced.
- PassageNick 4y agoNot sure I follow.... Biometrics are very difficult to impossible to reproduce short of physical coercion.
- _8j50 4y agoThat's not true, many years ago all you needed was long range camera or even photo to reproduce finger print and fool iphones. Especially with ML advances and considering future capabilities, biometrics is just about the worst choice. When you pick a cipher in crypto for example, you want it to resist future attacks and take small cracks seriously because they can be improved upon right? Same thing here except biometrics are a fixed immutable identifier.