News for hackers. Stuff that matters.

A comment on Why don't we expire passwords on the web?. Parent comment

Re:Why don't we expire passwords on the web? by arethuza on Monday December 13, 2010 @11:25AM (#2000933)
I've worked with systems that used USB tokens with X509 certificates for authentication and the tokens still required a password (as with Chip-n-Pin cards).

The "something you have" only really works as an additional authentication factor to the "something you know" of the passwords.

[ Parent | on HN ]
Re:Why don't we expire passwords on the web? by nodata on Monday December 13, 2010 @12:12PM (#2001121)
(I didn't say smartcards don't need passwords..)
[ Parent | on HN ]