Re:Google: Security Keys Neutralized Employee Phishing
by tptacek on Monday July 23, 2018 @02:03PM
(#17594503)
It's funny because I see it the opposite way: the problem with the nano is you'll want to leave it in all the time, which reduces your practical security. I go out of my way to keep the security key on my physical keychain; I don't even like leaving it in my bag, where it might get stolen along with the computer.
[ Parent
| on HN ]
Re:Google: Security Keys Neutralized Employee Phishing
by joshuamorton on Monday July 23, 2018 @04:48PM
(#17595837)
What's the threat model this protects against?
(In other words, what's better about having the security key being on your keychain vs. be a permanent part of your computer)
Re:Google: Security Keys Neutralized Employee Phishing
by tptacek on Monday July 23, 2018 @06:14PM
(#17596462)
I am less likely to lose both at the same time as I am to lose just one, and you'd need both of them to get access to accounts.
Re:Google: Security Keys Neutralized Employee Phishing
by ehsankia on Tuesday July 24, 2018 @12:13AM
(#17598070)
What do you mean you need both? The two in 2-factor is password + ubikey, not laptop + ubikey.
If someone gets your laptop with ubikey inside, they can't do anything without your password. And the whole point of a physical second factor is to basically limit the 99.9% of the people (mostly from other countries and cities) that have no physical access to you from hacking you.
Re:Google: Security Keys Neutralized Employee Phishing
by tptacek on Tuesday July 24, 2018 @12:25AM
(#17598106)
It's "Yubikey", not "ubikey". The Nano and Y4 keys do more than U2F; they also generate and store RSA keys. They aren't just 2FA devices; they're also small HSMs.