6 ms·

That depends basically entirely on what the second factor is and how often you are requiring it. Imagine futuretopia with me for a moment; when you are hired a

That depends basically entirely on what the second factor is and how often you are requiring it. Imagine futuretopia with me for a moment; when you are hired at a company they send a very secure cryptographic keygen to your subdermal ID implant. Maybe with 3 different fields for "employee" "division" "role" When you enter the building, implant comms automatically using "employee" with the mantrap pads acting as a second factor as you type in your yearly revolving 9 digit employee passcode Same with the workstation when you log in using "division", and maybe when you specifically access certain files "role". They all last a user session length, and can all use the employee 9 digit as primary login This scenario gives you effortless 2 factor, 3 different times, and the employee only has to put in their simple 9 digit code thrice daily, maybe 6 times account for lunch break. Does this scenario seem like two factor that's on the way out and causing more problems and inconvenience than it's worth? Two factor sms where you have to type the code in yourself and sms is insecure? Sure that's dog shit. But we can make a better future instead of disregarding a pretty solid security concept

tialaramex 3y ago
> Imagine futuretopia with me for a moment; when you are hired at a company they send a very secure cryptographic keygen to your subdermal ID implant. Maybe with 3 different fields for "employee" "division" "role" This is immediately the wrong design and is confusing authentication with authorisation. Your "subdermal implant" needs only one feature, (two if we wanted greater privacy than exists for employees today, but let's not get ahead of ourselves) 1. "I am still me". The implant can produce a copy of its public key, and will cheerfully sign simple freshness challenges allowing the employer to confirm that this is the same implant that the person hired had. That's all you need, that's the whole thing. The question of whether you're in Org Unit A9 or ZQ, whether you're a Deputy Senior Assistant or a Senior Deputy Assistant, whether you're part of Divison F or not, these aren't authentication they are authorisation questions and there is no need for them to belong to you, they can live near the decision since they can be changed by other people - you can be demoted or promoted, moved, reshuffled, fired - that's not a decision for you it's a decision for somebody else.

tialaramex 3y ago

> Imagine futuretopia with me for a moment; when you are hired at a company they send a very secure cryptographic keygen to your subdermal ID implant. Maybe with 3 different fields for "employee" "division" "role" This is immediately the wrong design and is confusing authentication with authorisation. Your "subdermal implant" needs only one feature, (two if we wanted greater privacy than exists for employees today, but let's not get ahead of ourselves) 1. "I am still me". The implant can produce a copy of its public key, and will cheerfully sign simple freshness challenges allowing the employer to confirm that this is the same implant that the person hired had. That's all you need, that's the whole thing. The question of whether you're in Org Unit A9 or ZQ, whether you're a Deputy Senior Assistant or a Senior Deputy Assistant, whether you're part of Divison F or not, these aren't authentication they are authorisation questions and there is no need for them to belong to you, they can live near the decision since they can be changed by other people - you can be demoted or promoted, moved, reshuffled, fired - that's not a decision for you it's a decision for somebody else.