3 ms·
> They see a future where you authenticate one device — your smartphone or something like a YubiKey — and then use that almost like a car key, to fire up your w
by kijin 14y ago
> They see a future where you authenticate one device — your smartphone or something like a YubiKey — and then use that almost like a car key, to fire up your web mail and online accounts.
> That means that if someone steals your card or your smart-ring, you’d better report it stolen pretty quickly.
I won't be surprised if thieves devised a method to extract online credentials from a stolen device in a matter of minutes, if not seconds. Since any password you have on your mobile device is unlikely to be strong (the article specifically mentions that you won't need a strong password on your device), it will also be a piece of cake to brute-force it. Meanwhile, you're without a phone, desperately looking for a payphone or Internet cafe where you can contact Google. Too slow.
- brennenHN 14y agoThis isn't necessarily true. At Clef(clef.io) we're storing keys on your smartphone and they're protected by a PIN wall. We used PIN-based encryption to keep a rooted device from being vulnerable to attackers. Generating the keys from the PINs take long enough to make a brute force attack time consuming. Since users can deactivate their devices remotely if they're stolen (so the public side of the key pair is deleted and the private side is worthless), even in cases of device theft, their identity is protected.