Cierge – passwordless authentication

Re:Cierge – passwordless authentication by piotrkubisa on Friday January 12, 2018 @06:08AM (#16132015)

I am not a security expert, so I started looking for solution which I know from my personal experience: If we add additional complexity like MFA/2FA this problem seems to be mitigated.

It would be great if someone with more knowledge in this field could provide a better solution for this issue.

Edit: Also you could reset password on your e-mail account if was breached.

Edit 2: There are also push notifications sent on mobile apps which acts like boolean type to accept or deny logon process.

Edit 3: If MITM is also laid down in discussion about possible threats then I think end-to-end encryption may help.

Edit 4: Banks usually use "Fill 3, 4, 15, 22.. character from your [placeholder: password, auth card]" method to get rid of key-loggers on clients PCs.

[ Parent | on HN ]

Re:Cierge – passwordless authentication by rasengan on Friday January 12, 2018 @06:24AM (#16132100)

1- If your email was breeches it’s simply too late.

2- Great - this is 2fa and good.

[ Parent | on HN ]

Re:Cierge – passwordless authentication by piotrkubisa on Friday January 12, 2018 @06:32AM (#16132126)

2FA is overused term in these days. I thought like Cierge+U2F with some physical device like Yubikey or Google Authenticator.

Edit: If my email was breached (and I would know it) I would probably reset password and logon to change all services to populate them with brand new credentials. Then I will try to minimize the threat (i.e. by making impossible to use my accounts - bail out emails, resting credentials or even removing accounts and e-mail) and then find out the best solution for specified scenario and recover after breach with implemented better security.

[ Parent | on HN ]