4 ms·

Two-factor authentication improves security, but cannot solve the online security problem for most people, because the vulnerabilities are primarily CULTURAL: t

by cs702 14y ago

Two-factor authentication improves security, but cannot solve the online security problem for most people, because the vulnerabilities are primarily CULTURAL: the average person does not understand the risks nor what they could do to ameliorate them. Compare the attitude towards security that people have in the physical world with their attitude online. No sane person would ever want to use the same exact key to open their home, car, desk, safety deposit box, etc., because that would obviously be unsafe. Yet most people today will happily use the same easy-to-remember password for all online accounts without giving it a second thought. Similarly, no sane person would ever lend their wallet and keys to a stranger, because that would obviously be unsafe. Yet most people today will happily walk into an Internet cafe or hotel business center and enter all their online credentials without giving it a second thought. Providers of online services like Google, Amazon, Apple, etc. will find it difficult to solve the security problem until society has evolved its understanding of, and attitude towards, online security. -- Edit: softened the tone of the last paragraph to make it more accurately reflects my views.

sigkill 14y ago
I do agree with you on the key analogy but there's a security breach there as well. Most of the keys are generally found on the same keyring. So, in effect it's identical to using a single password.
- cs702 14y ago
  That's true only to some extent: people keep on their keyring only those keys they need for daily use. Less frequently used keys (e.g., keys to a safety deposit box at the bank, keys to a home safe, keys to a second home) are typically stored in a drawer, a closet, or a safe. Also, note that having different keys means one can give copies of different keys to different persons for different purposes -- e.g., copy of the home key to a baby sitter, copy of the desk key to a co-worker, copy of the home key to trusted neighbors. People today intrinsically understand that they have to be mindful about whom they lend their keys to, who gets copies of their keys, and where the keys are stored.
  - maxerickson 14y ago
    On the other hand, typical house locks are (apparently) only locks by way of cultural convention. (I say apparently because the ease of using things like bump keys is pretty widely publicized but I have never actually tried it myself)
    - dredmorbius 14y ago
      Conventional locks are far less secure than most people would realize. That said, your house isn't directly connected to 2.26 billion people who can make hundreds (or thousands or billions) of bump-key attempts per second.
      - sigkill 14y ago
        In that respect it's like a bcrypted safe with a 4 character password and limited bandwidth.
BenOfTomorrow 14y ago
I bet a lot of people would use the same key to open all those places if it were actually a plausible option. That said, physical keys are different enough that an analogy breaks down. They're much easier to circumvent (break a window), while their use by a thief is much more impractical (finding the lock and avoiding detection at the location). Criminals in possession of your physical keys will be local (or irrelevant) and limited in numbers. It's easy to get back in your house after a criminal has entered.

by cs702 14y ago

sigkill 14y ago

I do agree with you on the key analogy but there's a security breach there as well. Most of the keys are generally found on the same keyring. So, in effect it's identical to using a single password.

cs702 14y ago
That's true only to some extent: people keep on their keyring only those keys they need for daily use. Less frequently used keys (e.g., keys to a safety deposit box at the bank, keys to a home safe, keys to a second home) are typically stored in a drawer, a closet, or a safe. Also, note that having different keys means one can give copies of different keys to different persons for different purposes -- e.g., copy of the home key to a baby sitter, copy of the desk key to a co-worker, copy of the home key to trusted neighbors. People today intrinsically understand that they have to be mindful about whom they lend their keys to, who gets copies of their keys, and where the keys are stored.
- maxerickson 14y ago
  On the other hand, typical house locks are (apparently) only locks by way of cultural convention. (I say apparently because the ease of using things like bump keys is pretty widely publicized but I have never actually tried it myself)
  - dredmorbius 14y ago
    Conventional locks are far less secure than most people would realize. That said, your house isn't directly connected to 2.26 billion people who can make hundreds (or thousands or billions) of bump-key attempts per second.
    - sigkill 14y ago
      In that respect it's like a bcrypted safe with a 4 character password and limited bandwidth.

BenOfTomorrow 14y ago

I bet a lot of people would use the same key to open all those places if it were actually a plausible option. That said, physical keys are different enough that an analogy breaks down. They're much easier to circumvent (break a window), while their use by a thief is much more impractical (finding the lock and avoiding detection at the location). Criminals in possession of your physical keys will be local (or irrelevant) and limited in numbers. It's easy to get back in your house after a criminal has entered.