Re:Google: Security Keys Neutralized Employee Phishing
by tptacek on Monday July 23, 2018 @03:38PM
(#17595311)
What the actual fuck is this "cryptosteel" thing?
Re:Google: Security Keys Neutralized Employee Phishing
by Fnoord on Monday July 23, 2018 @03:41PM
(#17595333)
There's a FAQ on the bottom of the page.
Re:Google: Security Keys Neutralized Employee Phishing
by tptacek on Monday July 23, 2018 @04:19PM
(#17595616)
I know, I read it. What the actual fuck is this? Who would spend money on this? How is this not an insane product concept?
Re:Google: Security Keys Neutralized Employee Phishing
by CiPHPerCoder on Monday July 23, 2018 @04:25PM
(#17595679)
> Who would spend money on this?
https://www.kickstarter.com/projects/zackdangerbrown/potato-...
https://en.wikipedia.org/wiki/Juicero
etc.
> How is this not an insane product concept?
I thought sanity died years ago.
Re:Google: Security Keys Neutralized Employee Phishing
by tptacek on Monday July 23, 2018 @04:28PM
(#17595693)
It costs $199 and you can't even store '@' with it!
Re:Google: Security Keys Neutralized Employee Phishing
by carbocation on Monday July 23, 2018 @04:54PM
(#17595879)
It doesn't even do its job: https://medium.com/@lopp/metal-bitcoin-seed-storage-stress-t...
Because if they lose access to the 2FA secrets, you lose access to your account. If that's just one account, recovery might be doable (depending on who ultimately is root on the machine). If its your Bitcoin wallet or FDE though, you're toast.
There's also a variety of protocols used for 2FA. I've seen: USB2, USB3, USB-C, BlueTooth, NFC.
As for how people do this: they use a second key, save their key on a cryptosteel(-esque) device [1] (IMO overpriced, YMMV), USB stick, a piece of paper, or gasp CDROM. Where its saved differs. Could be next to a bunch of USB sticks, in a safe, at a notary (my recommendation though does cost a dime or two), in a basement under a sack of grain, ...
[1] https://cryptosteel.com