News for hackers. Stuff that matters.

A comment on FIDO2 security key company releases hardware that's open source and uses Rust. Parent comment

Re:FIDO2 security key company releases hardware that's open ... by baby on Friday February 12, 2021 @10:45PM (#26121225)
Some websites also allow you to disable or rotate your 2FA creds if you're already logged in, without having to re-authenticate with your second authenticator.
[ Parent | on HN ]
Re:FIDO2 security key company releases hardware that's open ... by jabbany on Friday February 12, 2021 @11:33PM (#26121414)
This seems a little dangerous since now the logged in state (likely cookies but maybe also hashed with identifiers like IP etc.) becomes considerably more valuable to steal.

I actually see the opposite done, where any changes to login related things (passwords, 2fa keys) mandate a 2fa re-auth.

[ Parent | on HN ]
Re:FIDO2 security key company releases hardware that's open ... by baby on Saturday February 13, 2021 @02:32PM (#26126028)
Heh, stealing a logged state is bad no matter what unless you’re requiring re-auth on important operations. The risk of one losing their second factor is much much higher.
[ Parent | on HN ]