3 ms·
The ability to send SMSes or authenticate from your phone are both things you know.
by whatshisface 3y ago
The ability to send SMSes or authenticate from your phone are both things you know.
- tunesmith 3y agoNo they aren't; not unless access to that phone (including accessing the 2FA functionality) is in turn protected by a passcode/passphrase that you "know".
- whatshisface 3y agoAnyone with the right information can do either one. Including send SMSes: phone company customer support can let other people use your phone number.
- tunesmith 3y agoYour comment isn't clear enough to make sense... it sounds like you are agreeing with me, but I'm guessing since you are replying you disagree.
- cchance 3y agoFrom what i've seen every passkey implementation requires the device + a password or touchid or faceid to actually unlock the passkey authenticator... thats 2 things... the device key vault + your face
- whatshisface 3y agoAn image of your face is something you know. It's also a password that you can't change, and that is written down on a sticky note... on your face.
- tunesmith 3y ago"Something you know" means something in your head that other people can't access, and that is protected by the 5th amendment. The image of your face is not; it's something other people see every day. So it's not "something you know".
- tunesmith 3y agoThe whole point is to not equate "password" with "touchid/faceid". The former is "something you know", and the latter are not. In the US, it's legal to get access to someone's finger or face. It's not legal to torture someone to reveal a thought.
- aftbit 3y agoAgreed - if you want true "thing you have", it needs to be a standalone hardware token, and it needs to be fundamentally impossible to extract the key from it. Otherwise, its key just becomes another "thing you know".