4 ms·

That's an interesting point, replacing a lost key is always going to be the weak point in any security scheme, unless you intentionally make the process hard/cu

That's an interesting point, replacing a lost key is always going to be the weak point in any security scheme, unless you intentionally make the process hard/cumbersome enough that it isn't, but makes losing the key a very unpleasant, costly event both for the user, and the service you're trying to access. Why would businesses like Facebook implement such a scheme? As you predict it would probably end up in them losing a lot of customers when keys are lost. I think any business, even where security is critical, would worry about this too. I.e. 'what, my bank makes me call up their customer service, wait on hold, speak to 8 different individuals, then wait three days for processing, if I lose my key? No thanks, remembering a strong password seems an easier alternative - I'll just go to a competitor that allows that'. That's not even to mention wrapping up the scheme in an easy-to-use way for non-technical users. It'd be fine until the point it isn't, at which point the customer service / PR fallout cost of things going wrong is very high. Everyone understands passwords. I think there are enough problems here that such a scheme would likely not have enough adoption to become mainstream. But I think more importantly, isn't the fact that your key(s) would have to be tied to a physical client the true deal-breaker? A website that you can only access from a certain set of physically secured devices with the correct keys installed throws away perhaps the biggest advantage of the web.

lifeisstillgood 11y ago
I remain unconvinced. Most web sites deliver very little value to the end user. I mean if the government right now made us pay for each site we used, how many would you choose as worth ten bucks a month? So when there is a base level of security that makes us question the value of access to a given site, we shall see changes in how identity and personally identifiable data is used. This I think is a Good Thing. So, it is highly likely two factor auth will be a minimum standard for any site that's got anything of value - look at Target or the OPM. And if you want to connect to and use those sites you must have the right dongle. That's is a real pain. But you won't be allowed in otherwise. Target will still let you in the front door to spend money, but as they really cannot give every shopper a Target two factor auth, they will subcontract that out to hardware suppliers like Apple Pay. So we stop spreading our pollution every which way and start building sewers - Apple as the data sewer pipe provider ... Hmm. Now two factor auth is from the site owner to us. A physical key exchange. A web of trust is a much different proposition (liberty wise) and might come through things like OPM debacle. Giving every Covil servant a dongle might work but giving them a master cert and then signing the Certs they generate for their phone every so often seems more manageable - and will flow out to passports, drivers licences etc. So I do t really know much - and my brain is under flu-like attack but the ideas are floating out there.

lifeisstillgood 11y ago

I remain unconvinced. Most web sites deliver very little value to the end user. I mean if the government right now made us pay for each site we used, how many would you choose as worth ten bucks a month? So when there is a base level of security that makes us question the value of access to a given site, we shall see changes in how identity and personally identifiable data is used. This I think is a Good Thing. So, it is highly likely two factor auth will be a minimum standard for any site that's got anything of value - look at Target or the OPM. And if you want to connect to and use those sites you must have the right dongle. That's is a real pain. But you won't be allowed in otherwise. Target will still let you in the front door to spend money, but as they really cannot give every shopper a Target two factor auth, they will subcontract that out to hardware suppliers like Apple Pay. So we stop spreading our pollution every which way and start building sewers - Apple as the data sewer pipe provider ... Hmm. Now two factor auth is from the site owner to us. A physical key exchange. A web of trust is a much different proposition (liberty wise) and might come through things like OPM debacle. Giving every Covil servant a dongle might work but giving them a master cert and then signing the Certs they generate for their phone every so often seems more manageable - and will flow out to passports, drivers licences etc. So I do t really know much - and my brain is under flu-like attack but the ideas are floating out there.