3 ms·
If MYPASSWORDS.txt is encrypted and can only be decrypted with a key stored in some sort of HSM, then it is still MFA.
by growse 3y ago
If MYPASSWORDS.txt is encrypted and can only be decrypted with a key stored in some sort of HSM, then it is still MFA.
- charcircuit 3y agoThe point is if you can export the key from the HSM then it no longer requires that HSM as the exported key and MYPASSWORDS.txt can be bundled together. Knowing the contents of that bundle is a single factor of authentication.
- growse 3y agoYes, but this is tautological. "If I can clone a physical key, or create a copy, then it's not a good physical key" isn't particularly insightful.
- Dalewyn 3y agoSo what you're saying is it's not encrypted, not secured, and should not be trusted? Seriously, how many key leaks and other compromises do we have to witness before we do away with the notion they're secure and trustworthy?
- stavros 3y agoThere is no notion that "something is secure". It literally doesn't exist. There is a notion that something is secure under a specific threat model, and there are many threat models for which keys are secure and passwords are not.