21–30 of 41 posts
Earlier quoted context omitted.
Isn't this typically the case anyways? A hacker with access to your email account can just use the password reset mechanism to get a sign-in link to your other web sites.
Yes! It is the typical situation. That's why 2fac auth comes in.
of course the issue with 2 factors is that: - you can still social engineer your way out (!) - "oh i lost my phone and the recovery keys" "heres my name address cc number, etc please help!" (ie nothing has been solved) - its quite annoying to use - it doesnt solve everything, only weak passwords/brute force - it locks you out if you lose your phone/token until you get back home to get your recovery keys - compromisin…
My password doesn't get used for anything, all my applications have a 1 app only password.
An attacker would still need my password...
Joking aside, once you start down the road to two-factor authentication, you might as well go to three factors if you are truly concerned about security. Moreover, at least one of those factors would need to be based on physical properties, i.e., biometrics, or some other intrinsically unique property that can't be forgotten or copied.
of course the issue with 2 factors is that: - you can still social engineer your way out (!) - "oh i lost my phone and the recovery keys" "heres my name address cc number, etc please help!" (ie nothing has been solved) - its quite annoying to use - it doesnt solve everything, only weak passwords/brute force - it locks you out if you lose your phone/token until you get back home to get your recovery keys - compromisin…
Earlier quoted context omitted.
Oh yeah, that'll be way more convenient. Right up until you need to login when your phone is out of batteries, not in wireless coverage, under water, etc.
"I wish I could log in and check my account balance. If only I hadn't burned one finger, and got a cut on the other!"
I applied for citizenship 3 times over a period of 3 years, and each time got rejected due to poor quality of fingerprints.
Finally I stopped rowing and then got my citizenship. I'm sure there's some way around it, but it was kind of amusing and frustrating at the time.
We hope to launch a service precisely to help with this (toofactor.com). It's great to see this additional attention and options in the space. Google Authenticator is a great service imho, but I find myself moreso pleased with the 'application specific' password feature which allows me to abstract my exposure even further.
If someone built a system which could restrict passwords or keys by some kind of capabilities (e.g. my Adium gtalk password could only be used to authenticate to Google's Jabber servers), that would be useful. It would be complex to manage, especially as your applications change over time, but not impossible.
If only they had built it with two thousand and one factors of authentication! Joking aside, once you start down the road to two-factor authentication, you might as well go to three factors if you are truly concerned about security. Moreover, at least one of those factors would need to be based on physical properties, i.e., biometrics, or some other intrinsically unique property that can't be forgotten or copied.
of course the issue with 2 factors is that: - you can still social engineer your way out (!) - "oh i lost my phone and the recovery keys" "heres my name address cc number, etc please help!" (ie nothing has been solved) - its quite annoying to use - it doesnt solve everything, only weak passwords/brute force - it locks you out if you lose your phone/token until you get back home to get your recovery keys - compromisin…
Unless I've misunderstood how 2-factor authentication works, this is misinformation. The entire point of 2-factor authentication is that you need _both_ factors; i.e., having only one does not compromise the system.