3 ms·
This is a fundamental misunderstanding of how this security model works. You don't have to throw away anything, it just means you reinit that specific key. Hav
by ikiris 4y ago
This is a fundamental misunderstanding of how this security model works. You don't have to throw away anything, it just means you reinit that specific key.
Have multiple of them for redundancy, trust them all at your central auth point and this isn't an issue.
- smaudet 4y agoI disagree > Have multiple of them for redundancy. Yes so when I have 40 such tokens then I must worry about which ones to bring when for which devices, it's a usability nightmare. I contend you should rarely if ever use one, they are (often) more trouble than they are worth. Or, you are reusing them everywhere, and so you violate the principle of re-use. Yeah, you can daisy chain things and the like, but now you are just making your life needlessly complicated and error prone.
- ikiris 4y agoAgain you are fundamentally misunderstanding how this works. The key proves who you are. You don’t need 40 different ones. Just at least one.
- smaudet 4y agoI am really not, you are not understanding my core point - you should NOT have a single identifying key.
- ikiris 4y agodirect quote from my previous reply "Have multiple of them for redundancy, trust them all at your central auth point and this isn't an issue."
- mbreese 4y agoBut that’s a problem in and of itself… you don’t want to have 40 different keys that all prove that the bearer is “you”. Instead of having one thing to a worry about losing, you now have to worry about 40? And any of them would authenticate as “you”?
- ikiris 4y agoSo don't have 40 different keys that prove they're you that you didn't password protect and keep track of? This straw man is close to sentience at this point.