4 ms·
That was bone-headed stupidity. RSA could easily have used more expensive HSM hardware, and the rest of us can spend a grand on two YubiHSMs or equivalent hardw
by lstamour 13y ago
That was bone-headed stupidity. RSA could easily have used more expensive HSM hardware, and the rest of us can spend a grand on two YubiHSMs or equivalent hardware. (Or trust Google's....)
There's little excuse to poor secret management if you run your own hardware.
- StavrosK 13y ago> (Or trust Google's....) What does that mean? Where do you need to trust Google's?
- lstamour 13y agoI meant, "or trust Google's ability to keep their two factor authentication keys secret (with their Authenticator app)". Though perhaps I also meant using Google Authenticator app with your own keys ... except you'd still need to keep them somewhere, which means ideally an HSM and we're back to square one. :)
- StavrosK 13y agoWhat do you mean by "their" two factor authentication keys? There are no "their" keys. TOTP/HOTP is an open standard and Google Authenticator is an open source app. You can audit it, or write your own. It's not even that hard to implement.