5 ms·

The theory is that the two factors are something you have (your phone) and something you are (your biometric).

hospitalJail 3y ago
I'm happy that my important stuff is behind both a password + my phone. Having both behind your phone makes it easy to drug someone and get inside.
- howinteresting 3y ago
  I largely agree, though with something like 1password it definitely is convenient to not type in your master password each time.
- pphysch 3y ago
  If someone has your phone, they probably have your emails/authenticators, which means they have most of your passwords. Passkeys simplify the email reset/OTP loop, for the most part.
- hot_gril 3y ago
  Even people using 2FA are probably storing the passwords on the phone via a password manager. Those without a password manager are probably reusing passwords or choosing insecure ones. I'd maybe be worried about the drugging if I'd ever heard of it happening to someone I know.
  - derefr 3y ago
    > Even people using 2FA are probably storing the passwords on the phone via a password manager. Yes, but this is the reason that password managers encrypt your other passwords with a master password, rather than a master biometric. The master password is still the "something you know" factor.
    - hot_gril 3y ago
      Most don't ask for the master password by default. Mac Keychain for example is "unlocked" at login unless you change that. iPhone Keychain will input passwords from just FaceID, no passcode prompt. Desktop Chrome and Firefox just autofill passwords no questions asked.
      - derefr 3y ago
        Password managers are designed around the idea that after you fully authenticate with your something-you-know credential, then they'll mostly trust that you're "still there" for a certain period of time, requiring only a something-you-are factor for re-authentication while the something-you-know credential remains cached in memory. This "safety interval" usually ticks down more slowly while the device remains active (because continuous use implies "you" didn't wander off such that someone else could slip in), and more quickly while the device is idle/locked. When the "safety interval" expires, or if you fully shut off the device, or if you manually trigger a "something unusual is happening" mode (https://www.idownloadblog.com/2017/08/21/how-to-disable-touch-id-lock-screen-ios-11/ https://www.idownloadblog.com/2017/08/21/how-to-disable-touc...), then the password manager will lose this cached "already mostly satisfied" state, and so will require you to present the "actual" something-you-know credential again. > Mac Keychain for example is "unlocked" at login unless you change that. That's because you just fully authenticated it by providing your master password (which for the macOS local keychain is your local account's login password, which you had to present in order to unlock the FDE disk at startup.) In fact, ignoring FDE, this is what "logging in" means on macOS: decrypting the local-account keychain. You'll notice that this doesn't apply to your iCloud keychain, since that doesn't use the same password as your local account, and so you didn't present that keychain's unlock password when you signed in. Interestingly, this also doesn't apply if you set your FDE unlock password to be different than your local account sign-in password. The FDE unlock password will do some magic that gets you logged into your account; but you will end up in your account with your local-account keychain still locked — which will cause a lot of annoying prompts on login. (I ran macOS like this for a while back in ~2013, because I wanted a really secure boot passphrase, but didn't want to have to type it every time I locked the screen, and TouchID didn't exist yet on Macs. Wasn't worth it.) > iPhone Keychain will input passwords from just FaceID, no passcode prompt Again, that's because you signed into your phone with a password recently-enough to make it satisfied with you; and this safety interval is much wider on a phone than on a PC, because people keep phones "securely" with them, rather than e.g. letting them sit turned-on and unguarded at work when they go home for the day. You'll find that companies that have confidentiality requirements, deploy MDM policies for employees' mobile devices which make this safety interval much shorter — if they even allow it at all. (I worked for IBM Canada, and my phone would force a password unlock after being locked for just 30 seconds.) > Desktop Chrome and Firefox just autofill passwords no questions asked. This is true, and because of this, security people do not consider these browser "autofill" features to be "password managers." Don't use them! They don't encrypt your passwords at rest, either! Viruses can steal your passwords right out of these autofill databases, and many modern viruses do do that! (I would note that Chrome does prompt you for your [local-account login] password in order to be able to browse your autofill passwords — which is at least something. But this is just security theatre; you can still read the passwords right off the disk without knowing your login password.)
lostmsu 3y ago
This makes no sense. Two different factors are two different factors. I might want two devices to be involved to setup a new login to critical services. One I'd always have at home so only with access both to me and my home you'd be able to login.
- ricardobeat 3y ago
  I think you can do exactly that by using a Fido key instead of face / touch authentication for your device.
  - lostmsu 3y ago
    But that's the problem. If I understood correctly, Google won't ask you for your FIDO key if you use their passkey.

I'm happy that my important stuff is behind both a password + my phone. Having both behind your phone makes it easy to drug someone and get inside.

howinteresting 3y ago
I largely agree, though with something like 1password it definitely is convenient to not type in your master password each time.
pphysch 3y ago
If someone has your phone, they probably have your emails/authenticators, which means they have most of your passwords. Passkeys simplify the email reset/OTP loop, for the most part.
hot_gril 3y ago
Even people using 2FA are probably storing the passwords on the phone via a password manager. Those without a password manager are probably reusing passwords or choosing insecure ones. I'd maybe be worried about the drugging if I'd ever heard of it happening to someone I know.
- derefr 3y ago
  > Even people using 2FA are probably storing the passwords on the phone via a password manager. Yes, but this is the reason that password managers encrypt your other passwords with a master password, rather than a master biometric. The master password is still the "something you know" factor.
  - hot_gril 3y ago
    Most don't ask for the master password by default. Mac Keychain for example is "unlocked" at login unless you change that. iPhone Keychain will input passwords from just FaceID, no passcode prompt. Desktop Chrome and Firefox just autofill passwords no questions asked.
    - derefr 3y ago
      Password managers are designed around the idea that after you fully authenticate with your something-you-know credential, then they'll mostly trust that you're "still there" for a certain period of time, requiring only a something-you-are factor for re-authentication while the something-you-know credential remains cached in memory. This "safety interval" usually ticks down more slowly while the device remains active (because continuous use implies "you" didn't wander off such that someone else could slip in), and more quickly while the device is idle/locked. When the "safety interval" expires, or if you fully shut off the device, or if you manually trigger a "something unusual is happening" mode (https://www.idownloadblog.com/2017/08/21/how-to-disable-touch-id-lock-screen-ios-11/ https://www.idownloadblog.com/2017/08/21/how-to-disable-touc...), then the password manager will lose this cached "already mostly satisfied" state, and so will require you to present the "actual" something-you-know credential again. > Mac Keychain for example is "unlocked" at login unless you change that. That's because you just fully authenticated it by providing your master password (which for the macOS local keychain is your local account's login password, which you had to present in order to unlock the FDE disk at startup.) In fact, ignoring FDE, this is what "logging in" means on macOS: decrypting the local-account keychain. You'll notice that this doesn't apply to your iCloud keychain, since that doesn't use the same password as your local account, and so you didn't present that keychain's unlock password when you signed in. Interestingly, this also doesn't apply if you set your FDE unlock password to be different than your local account sign-in password. The FDE unlock password will do some magic that gets you logged into your account; but you will end up in your account with your local-account keychain still locked — which will cause a lot of annoying prompts on login. (I ran macOS like this for a while back in ~2013, because I wanted a really secure boot passphrase, but didn't want to have to type it every time I locked the screen, and TouchID didn't exist yet on Macs. Wasn't worth it.) > iPhone Keychain will input passwords from just FaceID, no passcode prompt Again, that's because you signed into your phone with a password recently-enough to make it satisfied with you; and this safety interval is much wider on a phone than on a PC, because people keep phones "securely" with them, rather than e.g. letting them sit turned-on and unguarded at work when they go home for the day. You'll find that companies that have confidentiality requirements, deploy MDM policies for employees' mobile devices which make this safety interval much shorter — if they even allow it at all. (I worked for IBM Canada, and my phone would force a password unlock after being locked for just 30 seconds.) > Desktop Chrome and Firefox just autofill passwords no questions asked. This is true, and because of this, security people do not consider these browser "autofill" features to be "password managers." Don't use them! They don't encrypt your passwords at rest, either! Viruses can steal your passwords right out of these autofill databases, and many modern viruses do do that! (I would note that Chrome does prompt you for your [local-account login] password in order to be able to browse your autofill passwords — which is at least something. But this is just security theatre; you can still read the passwords right off the disk without knowing your login password.)

lostmsu 3y ago

This makes no sense. Two different factors are two different factors. I might want two devices to be involved to setup a new login to critical services. One I'd always have at home so only with access both to me and my home you'd be able to login.

ricardobeat 3y ago
I think you can do exactly that by using a Fido key instead of face / touch authentication for your device.
- lostmsu 3y ago
  But that's the problem. If I understood correctly, Google won't ask you for your FIDO key if you use their passkey.