4 ms·

I can't even register more than 1 yubikey in almost any service that I use. We are faaar away from easy, secure and also robust authentication in the web. On to

I can't even register more than 1 yubikey in almost any service that I use. We are faaar away from easy, secure and also robust authentication in the web. On top of that, I don't like big central services to control my authentication and collect data about me. Thank you, but until we arrive there, I'm happy to stick to my password manager. This post just comfirms my impressions.

valenterry 3y ago
Oh and to expand on that. I like to be able to setup my own authentication without having having to rely on 3rd party software, just in case. Relying on cryptographic hashes (for password hashing) is already kind of bad, but at least there are open source libraries who are hopefully checked by professionals on regular basis.
taeric 3y ago
Most places, I thought, finally allow multiple keys? Who is left not doing it?
- valenterry 3y ago
  All 3 of my (german) banks for example. One bank here (N26) even only allows a single(!) smartphone for 2FA. So if I lose my phone... well, screw me.
  - taeric 3y ago
    I was curious if it was going to be banks. I don't think any of my banks allow yubikeys, yet. Will have to look into that.
    - mderazon 3y ago
      Banks are especially bad. I know one bank that has you memorize 7 digits access codes and for authentication asks 4 digits at random places each time.
nathanaldensr 3y ago
I'm with you. Using a password manager is brain-dead simple nowadays. Gone are the days of syncing KeePass databases on cloud drives. Bitwarden is completely free and reliable, for example. Autofill works on all major browsers on both mobile and PC. The real problem here is user ignorance and apathy. We can try to force things down users' throats but they literally do not care about robust account security practices. They'll just lose the dongle or key or whatever you give them anyway, which will force some kind of centralized approach that introduces its own drawbacks (e.g., being deplatformed or canceled).

valenterry 3y ago

Oh and to expand on that. I like to be able to setup my own authentication without having having to rely on 3rd party software, just in case. Relying on cryptographic hashes (for password hashing) is already kind of bad, but at least there are open source libraries who are hopefully checked by professionals on regular basis.

taeric 3y ago

Most places, I thought, finally allow multiple keys? Who is left not doing it?

valenterry 3y ago
All 3 of my (german) banks for example. One bank here (N26) even only allows a single(!) smartphone for 2FA. So if I lose my phone... well, screw me.
- taeric 3y ago
  I was curious if it was going to be banks. I don't think any of my banks allow yubikeys, yet. Will have to look into that.
  - mderazon 3y ago
    Banks are especially bad. I know one bank that has you memorize 7 digits access codes and for authentication asks 4 digits at random places each time.

nathanaldensr 3y ago

I'm with you. Using a password manager is brain-dead simple nowadays. Gone are the days of syncing KeePass databases on cloud drives. Bitwarden is completely free and reliable, for example. Autofill works on all major browsers on both mobile and PC. The real problem here is user ignorance and apathy. We can try to force things down users' throats but they literally do not care about robust account security practices. They'll just lose the dongle or key or whatever you give them anyway, which will force some kind of centralized approach that introduces its own drawbacks (e.g., being deplatformed or canceled).