3 ms·
PINs and passwords on HSM keys like this are typically very secure as they will wipe themselves or at least lock themselves after a small number of failed attem
by kevincox 3y ago
PINs and passwords on HSM keys like this are typically very secure as they will wipe themselves or at least lock themselves after a small number of failed attempts. For example if you only allow 5 failed attempts a 4 digit random PIN has a 0.05% chance of being guessed and a 6 digit PIN is 0.0005%.
So the only real risk is key extraction, hardware key extraction is always possible but likely incredibly expensive, so for most threat models it is not an issue. (Software key extraction or side channels is a different problem which may be easier but in theory is not possible.)
- franga2000 3y agoPIN+limit is still a much worse user experience than a password: - a PIN is hard to memorize, so people are more likely to use personally-relevant or common numbers, whereas a password can be easily be both complex and memorable - it's easy to burn through even 10 login attempts through any combination of temporary/permanent disability, stress, being drunk, damaged device... - a wipe-after-failed-attempts system is trivial to abuse, be it by a prankster or a real adversary - it's much easier to see someone's PIN over their shoulder or film them entering it
- Ferret7446 3y agoPINs can include all characters just like a password. They're called PINs for historical reasons. (This does depend on the specific key/protocol.)
- GenerocUsername 3y agoGreat, so we are back to passwords then
- aprilnya 3y agoNo, because passwords are just something-you-know (one factor) while a passkey that’s protected with a password is both something-you-have and something-you-know (two factors)
- vdfs 3y agoSo like a password manager?
- aprilnya 3y agoNo, because a password manager still just stores passwords (one factor!); if someone got that password they can get in The whole point of a passkey is that it’s something you have, not know: - you can’t guess it because it’s a really long encryption key - you can’t phish it because using a passkey does not give the passkey to the site, it just proves that you have the key (typical priv/pub key auth) - you can’t steal it because passkeys are meant to never be moved from the device — it’s supposed to be impossible to extract them, as they’re supposed to live on a secure enclave type chip that is impossible to extract from So, no, not like a password manager