21–30 of 154 posts
Neither of these methods are simple. I don't have a camera or fingerprint reader, idk what is FIDO security key or how to get one, and mobile phone can be lost or cease working at any moment so it's not a reliable method of authentication.
>Users log in with simple methods such as fingerprint readers, cameras, FIDO security keys, or their personal mobile device. Neither of these methods are simple. I don't have a camera or fingerprint reader, idk what is FIDO security key or how to get one, and mobile phone can be lost or cease working at any moment so it's not a reliable method of authentication.
So what happens if you lose one of those USB devices? Can you use multiple USB devices on the same site?
A good implementation of this approach allows you to add multiple tokens. GitHub does for example, but not all are good.
So what happens if you lose one of those USB devices? Can you use multiple USB devices on the same site?
For instance, you can set up multiple MFA mechanisms on Google, and I believe you can set up multiple U2F devices for any given account.
To this day you cannot set multiple MFA devices on an AWS account. No, enrolling multiple devices at the same time from the same screen does not count.
I was saying for a long time that a new protocol for a biometric driven login scheme should become the new default. We use biometrics to log into our phone, then a password manager uses the same biometric to authenticate on the same device to log me into a website by auto populating the username + password for me. Afterwards I'll get a 2FA confirmation on the same device which again I'll have to confirm via the same…
Biometrics are just fine as a username or one factor of a MFA, but they are terrible for usage as a password due to the simple fact that if they are ever compromised, they cannot be changed.
It's a good point which you raise, but ultimately biometrics will be the best way to authenticate someone. It might have to evolve and get smarter and better, but one day if someone is able to reproduce all your unique attributes of who you are then nothing will probably hold them back to reset your password manager, email and what not either. They will socially engineer whatever they need and even when a human will verify that you are you they will probably be able to provide enough believable evidence at which point it doesn't matter anymore if they hacked a biometric login or socially engineered your password manager.
Earlier quoted context omitted.
Biometrics are just fine as a username or one factor of a MFA, but they are terrible for usage as a password due to the simple fact that if they are ever compromised, they cannot be changed.
The truth is though that everyone is using biometrics to log into their device which controls everything from emails, to password managers and 2FA codes. Does it mean if your fingerprint gets compromised that you'll be unable to use the biometric feature of any device for the rest of your life? It's a good point which you raise, but ultimately biometrics will be the best way to authenticate someone. It might have to…
Technically, your fingerprint is probably already compromised, just nobody's bothered to put the pieces together yet because you're not a high-enough value target.
Check out some of the CCC conference videos on youtube, where they show how easy it is to reproduce someone's fingerprints to fool most biometrics.
However, once it becomes possible to do this at a low enough price point, that's when it realistically becomes a problem for the majority.
So what happens if you lose one of those USB devices? Can you use multiple USB devices on the same site?
Does anyone else find these informal specifications difficult to digest? The informative appendices link to papers on TPM and the like but it's hard to find a formal description of the protocol, or at least the sensitive parts, that could be independently validated or verified. Has there been any work to formally verify/validate the design of this protocol that I'm not seeing?
They fall in the category of any academic text. Be it from a uni, research group, specfication manual. I did not receive formal education in English so I don't understand those formal words. Every other sentence there's something I have to look up and then I'm in a rabbit hole.
Actually same goes for my native tongue in some respect since I dropped out of school before reaching university.
I've still managed to make a career in IT and often desire to read technical specifications but feel helpless when I try.
My strategy so far has been to wait for an implementation in a language I can understand like Python, hopefully.
Earlier quoted context omitted.
Biometrics are just fine as a username or one factor of a MFA, but they are terrible for usage as a password due to the simple fact that if they are ever compromised, they cannot be changed.
The truth is though that everyone is using biometrics to log into their device which controls everything from emails, to password managers and 2FA codes. Does it mean if your fingerprint gets compromised that you'll be unable to use the biometric feature of any device for the rest of your life? It's a good point which you raise, but ultimately biometrics will be the best way to authenticate someone. It might have to…
We would indeed, literally, have to evolve in order to supply repudiable biometrics. Regrowable fingers perhaps?