21–30 of 154 posts
> Another big challenge with establishing consistency and continuity will be the long transition to passkeys alone. If I wanted passwordless login, why wouldn't I just hit the big 'sign in with facebook' button practically every website has these days?
No, on this website I signed up with Github. I think?
Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...
> also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... May I humbly suggest you RTFM before posting FUD. You can set a PIN on the Yubikey (or on the Yubikey Bio's, your fingerprint). Further, the PIN will block after three failed attempts, requiring the PUK to reset the PIN. Key loggers are of course defeated by the Yubikey's touch requiremen…
Earlier quoted context omitted.
> also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... May I humbly suggest you RTFM before posting FUD. You can set a PIN on the Yubikey (or on the Yubikey Bio's, your fingerprint). Further, the PIN will block after three failed attempts, requiring the PUK to reset the PIN. Key loggers are of course defeated by the Yubikey's touch requiremen…
Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? if so keyloggers would work as before
Just give me password auth back. I work in a lab that requires fingerprint login (TrustKey FIDO keys) with no fallback. Every 6-8 weeks I need to have my keys reset with new prints, which is a process that involves meeting a member of the security team in a room for 20 minutes so my key and the backup key (kept in a safe by the firm) can both be reset. Everyday, without fail, I sit there like a chimp taking on averag…
Do they expect your fingerprints to have changed?
Cut your thumb slicing tomatoes? Have fun logging in for the next few days.
Took up a fun new hobby, like, say, blacksmithing, or ceramic sculpture? Say permanent goodbye to your fingerprints ever scanning correctly again...
> Another big challenge with establishing consistency and continuity will be the long transition to passkeys alone. If I wanted passwordless login, why wouldn't I just hit the big 'sign in with facebook' button practically every website has these days?
Because passkey is owned by you (as in - whichever software vault you're using) and not Facebook. It's no different than stored random 32 character passwords in a password manager... it's pretty much the same really, just that you don't have to copy/paste it in a form.
Do consumers perceive a significant difference between "login with Facebook" and "login with LastPass"? In both cases I'm delegating my security credentials to a cloud service I have limitted influence over.
Part of the problem is that right now the most convenient use of things like yubikeys is that the most convenient use of them is just leave them in your computer wherever they may be. That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...
This is an extraordinarily bad take. :) - The biggest threat almost all users face is in the form of remote attackers: password phishing, database leaks + password reuse, tricking users into installing malware, etc. Local attackers are so far down the list of concerns that, really, using unique passwords and storing them on Post-Its is, for most people, an improvement in security! - Leaving a Yubikey in the computer…
I'm not sure what users you interact with most on a regular basis, but for a pretty significant portion of the population, the most likely threats to their online (and offline) safety are jealous boyfriends/spouses/parents
Why is there no discussion on users losing their private keys? Ask all those cryptocurrency users who lost their private keys. Now don't tell that there are crypto wallets/vaults that manage private keys; there are many ways key can be lost even when using wallets/vaults.
We engineers live in a different world, disconnected from the regular users who have no clue what public-private keys are!
Earlier quoted context omitted.
> also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... May I humbly suggest you RTFM before posting FUD. You can set a PIN on the Yubikey (or on the Yubikey Bio's, your fingerprint). Further, the PIN will block after three failed attempts, requiring the PUK to reset the PIN. Key loggers are of course defeated by the Yubikey's touch requiremen…
Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? if so keyloggers would work as before