3 ms·
> No worries, I just tap my security token to my phone and I'm logged in. What allows you to tap your token on your phone and register a passkey-stored-on-pho
by abdullahkhalids 3y ago
> No worries, I just tap my security token to my phone and I'm logged in.
What allows you to tap your token on your phone and register a passkey-stored-on-phone registered with TotallyCoolService? Did you previously set your phone and token to be "mutually trusted devices" in some way?
Or what's preventing a thief from tapping my token on their phone to register it on TotallyCoolService?
- vel0city 3y agoIt requires a PIN to give a resident key, and too many pin failures wipes it. Other authenticators have biometric requirements.
- abdullahkhalids 3y agoI see. So the weakest link in the security chain is that someone discovers the <6 digit pin on your usb key (easy on a security camera), and then manages to steal it for 2 min. Not terrible for anyone whose threat model is not targeted attacks. But quite bad for people whose threat model is exactly that.