News for hackers. Stuff that matters.
Re:Stop forcing arbitrary password rules by danieldk on Saturday October 24, 2015 @07:02AM (#10443190)
With keys such as a U2F key, you can use it for multiple sites (each site will have a site-specific keypair). Most sites allow you to associate multiple U2F keys as well. Since U2F keys typically cost 7 to 15 Euro, it's really not much of a problem to buy one for use and to put one as a backup in a fire-proof safe.

That said, I think it's bad to rely on one factor. If the key gets stolen, security is compromised. The combination of a password and a security token is far more secure. People should just stop memorizing passwords for every site and e.g. use a password manager.

Re:Stop forcing arbitrary password rules by netheril96 on Saturday October 24, 2015 @08:02AM (#10443340)
People in developing countries probably won't ever buy a U2F key. 7 to 15 Euros are too expensive for them (and me).
Re:Stop forcing arbitrary password rules by CydeWeys on Saturday October 24, 2015 @09:15AM (#10443495)
A lot of banks already give them away to their customers because the hardware costs are less than the fraud costs associated with compromised accounts. And in an ideal world, said keys would be general use, not just for logging into the bank's site.
Re:Stop forcing arbitrary password rules by codedokode on Saturday October 24, 2015 @08:31AM (#10443398)
U2F looks very promising. The prices will probably go down as the standard will get adopted and there will be more competition.