3 ms·
Some people, who are not me, say that it's still two because they have to have the device but also have to be able to unlock the device.
by Apreche 3y ago
Some people, who are not me, say that it's still two because they have to have the device but also have to be able to unlock the device.
- DangitBobby 3y agoDevices get snatched out of hands all the time.
- drexlspivey 3y agoEven if they snatch it unlocked they still can’t login because there’s an extra biometrics check required for WebAuthn
- SgtBastard 3y agoIn at least Apple's case, Device PIN is also a factor to unlock the secure enclave where the passkeys are kept - so, assuming there's no stronger enforcement that it must use FaceID/TouchID, shoulder surfing a PIN unlock of the device and then swiping it grants access to all accounts.
- deleted 3y ago[deleted]
- vbezhenar 3y agoThat makes sense (as long as device asks for PIN every time you use webauthn). Bank card uses the same logic: you present both card and PIN code and it counts as two factors.
- somat 3y agoI have heard arguments that using a password locked ssh key is two factor authentication for the same reason, that is, what you have(the ssh key) and what you know(the password to unlock it) However I am not convinced, I think it comes down to dependency of factors in the auth scheme, if one factor unlocks another factor there only really is one factor, all factors must independently lock.
- m-p-3 3y agoThe "something you have" shouldn't be easily replicated. If someone could capture your SSH key passphrase and copy the ssh private key then it's not an actual 2FA. a device like a Yubikey won't let you extract the stored keys, so the only way to gain access is to steal the physical key and that makes the attack much harder to do stealthily.