5 ms·

> you have to manually maintain a list of where you've registered them For an individual, the answer there might be to limit the usage of the device to your "c

> you have to manually maintain a list of where you've registered them For an individual, the answer there might be to limit the usage of the device to your "core" services, and rely on good password hygiene for everything else.

lxgr 2y ago
> rely on good password hygiene for everything else. Usually this means using a password manager, and these days many of them also support WebAuthN in a way not tied to a specific device (or platform/ecosystem).
- davidt84 2y ago
  But if you store everything in the password manager, it's no longer two factor.
  - lxgr 2y ago
    Yes, but I don’t need/want 2FA everywhere, and it’s still a strictly better single factor than a password (since WebAuthN is resilient against server-side database leaks and phishing).
  - hypeatei 2y ago
    It's still two factors regardless of storage. Say you accidentally paste your password into the wrong field and post it on a forum. Whoever gets that still needs the second factor. Sure, if your password vault gets breached then everything is exposed but that's extremely unlikely and you have a lot of work to do in that event regardless. It's an inherent risk to using a password manager: everything is centralized so it's a valuable target.
    - davidt84 2y ago
      It is not extremely unlikely, all it takes is for you to unlock your password database on a device with some malware. The point of a second separate factor is to reduce that risk.
      - duckmysick 2y ago
        If there's malware on my device, isn't it game over already? Even if I have a second factor elsewhere, the malware can access session keys to whatever service I logged into from that device, among other things.
        davidt84 2y ago
        It's certainly not good, but if you require 2FA to, say, change the email address attached to your account, or make withdrawals, or other important actions, it's not game over.
        Matumio 2y ago
        In theory. But if everything is in the password safe, the malware can just grab that and upload? And cover its traces. As opposed to patching every application/service you might use, and get access only when you use it.
remus 2y ago
> For an individual, the answer there might be to limit the usage of the device to your "core" services, and rely on good password hygiene for everything else. What's the advantage here over password + yubikey? Isn't password + yubikey always going to be at least as secure as password, even if the yubikey gets lost/stolen/compromised?

lxgr 2y ago

> rely on good password hygiene for everything else. Usually this means using a password manager, and these days many of them also support WebAuthN in a way not tied to a specific device (or platform/ecosystem).

davidt84 2y ago
But if you store everything in the password manager, it's no longer two factor.
- lxgr 2y ago
  Yes, but I don’t need/want 2FA everywhere, and it’s still a strictly better single factor than a password (since WebAuthN is resilient against server-side database leaks and phishing).
- hypeatei 2y ago
  It's still two factors regardless of storage. Say you accidentally paste your password into the wrong field and post it on a forum. Whoever gets that still needs the second factor. Sure, if your password vault gets breached then everything is exposed but that's extremely unlikely and you have a lot of work to do in that event regardless. It's an inherent risk to using a password manager: everything is centralized so it's a valuable target.
  - davidt84 2y ago
    It is not extremely unlikely, all it takes is for you to unlock your password database on a device with some malware. The point of a second separate factor is to reduce that risk.
    - duckmysick 2y ago
      If there's malware on my device, isn't it game over already? Even if I have a second factor elsewhere, the malware can access session keys to whatever service I logged into from that device, among other things.
      - davidt84 2y ago
        It's certainly not good, but if you require 2FA to, say, change the email address attached to your account, or make withdrawals, or other important actions, it's not game over.
      - Matumio 2y ago
        In theory. But if everything is in the password safe, the malware can just grab that and upload? And cover its traces. As opposed to patching every application/service you might use, and get access only when you use it.

remus 2y ago

> For an individual, the answer there might be to limit the usage of the device to your "core" services, and rely on good password hygiene for everything else. What's the advantage here over password + yubikey? Isn't password + yubikey always going to be at least as secure as password, even if the yubikey gets lost/stolen/compromised?