5 ms·

I don't understand your point. Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The popula

I don't understand your point. Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The population there is hardly uneducated, yet they still had quite a few break-ins. Some of the companies have also nearly removed passwords, changing the minimum length requirement to something like 5 lowercase characters. They still experience a near zero, or zero, phishing success rates.

jdthedisciple 3y ago
Sure, you could even reduce phishing attack success rates to nearly 0% by having users authenticate with a sample of their DNA. Does that mean it's a great idea? What about losing the yubikey? In any case it's a different matter when it comes to high stake scenarios, in which case I don't mind something slightly more sophisticated. But not as the default for everything.
- superkuh 3y ago
  >having users authenticate with a sample of their DNA. I know it's not your point and I agree with everything you're saying in this thread 100%, but DNA based login would be a username, not a password. Like all biometrics. And it'd have a really bad false positive rate if you're just doing restriction enzyme cut location tests like lots of "police work". A full exome scan ~$300-500/per might do it.
  - antonjs 3y ago
    And as you point out, the problem with biometrics is that once they're stolen or copied, there's no changing them. Particularly your DNA.
- JCharante 3y ago
  > What about losing the yubikey? I have 5 yubikeys on multiple continents. If I lose one I can log in with the others and remove login access with the compromised yubikey.
  - xormapmap 3y ago
    > I have 5 yubikeys on multiple continents Are you actually retarded or just disingenuous? This is hardly a workable solution even for security nuts, let alone the average person.
akira2501 3y ago
> Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The actual question is: "Did they see an INCREASE in other types of attacks after using yubikeys?" To presume that these actors who were willing to go to some illegal lengths to get this information in the first place just "gave up" because "yubikeys exist" is a dangerous way to process these facts.
ghusto 3y ago
> Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? His point (my emphasis): > User picked passwords (1FA) are and will always be the single best solution that has ever existed for authentication, _considering everything from security to usability and practicality, wholistically_ So his point is that if you consider all aspects wholistically, including usability and practicality, passwords are the best solution. I'm not saying I agree, but a 100% reduction of successful phishing attacks after introducing Yubikeys only considers security, and not the other factors.

jdthedisciple 3y ago

Sure, you could even reduce phishing attack success rates to nearly 0% by having users authenticate with a sample of their DNA. Does that mean it's a great idea? What about losing the yubikey? In any case it's a different matter when it comes to high stake scenarios, in which case I don't mind something slightly more sophisticated. But not as the default for everything.

superkuh 3y ago
>having users authenticate with a sample of their DNA. I know it's not your point and I agree with everything you're saying in this thread 100%, but DNA based login would be a username, not a password. Like all biometrics. And it'd have a really bad false positive rate if you're just doing restriction enzyme cut location tests like lots of "police work". A full exome scan ~$300-500/per might do it.
- antonjs 3y ago
  And as you point out, the problem with biometrics is that once they're stolen or copied, there's no changing them. Particularly your DNA.
JCharante 3y ago
> What about losing the yubikey? I have 5 yubikeys on multiple continents. If I lose one I can log in with the others and remove login access with the compromised yubikey.
- xormapmap 3y ago
  > I have 5 yubikeys on multiple continents Are you actually retarded or just disingenuous? This is hardly a workable solution even for security nuts, let alone the average person.

akira2501 3y ago

> Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? The actual question is: "Did they see an INCREASE in other types of attacks after using yubikeys?" To presume that these actors who were willing to go to some illegal lengths to get this information in the first place just "gave up" because "yubikeys exist" is a dangerous way to process these facts.

ghusto 3y ago

> Do you know that major tech companies saw a near 100% reduction of successful phishing attacks after adding yubikeys? His point (my emphasis): > User picked passwords (1FA) are and will always be the single best solution that has ever existed for authentication, _considering everything from security to usability and practicality, wholistically_ So his point is that if you consider all aspects wholistically, including usability and practicality, passwords are the best solution. I'm not saying I agree, but a 100% reduction of successful phishing attacks after introducing Yubikeys only considers security, and not the other factors.