News for hackers. Stuff that matters.

A comment on Unpacking the Benefits of Zero Trust Architecture as Defined by NIST. Parent comment

Re:Unpacking the Benefits of Zero Trust Architecture as Defi... by 1101010010 on Saturday February 18, 2023 @10:42AM (#34847677)
Stealing or guessing a password is infinitely easier than compromising a Yubikey or otherwise hardware-based authentication factor. This is a demonstrable fact and any argument to the contrary is simply pearl clutching. I challenge you to find even a single incident resulting from a compromise of this 2nd factor, until you do there's nothing to discuss. And because you don't find it, it will ultimately demonstrate passwords are not even necessary when accounts are protected in this way.
[ Parent | on HN ]
Re:Unpacking the Benefits of Zero Trust Architecture as Defi... by badrabbit on Saturday February 18, 2023 @04:59PM (#34851550)
> This is a demonstrable fact and any argument to the contrary is simply pearl clutching

I agree. Lookup what a strawman argument is. No one made that claim.

> I challenge you to find even a single incident resulting from a compromise of this 2nd factor,...

Friend, do you read comments before replying to them? That is exactly my challenge to you. Passwordless usually means getting rid of 2fa and using one or more "next generation credential providers".

[ Parent | on HN ]
Re:Unpacking the Benefits of Zero Trust Architecture as Defi... by 1101010010 on Sunday February 19, 2023 @01:27AM (#34855054)
I'm thoroughly convinced you don't understand the U2F/WebAuthN standard, which makes intelligent discourse about the topic impossible. Good luck with your studies.
[ Parent | on HN ]
Re:Unpacking the Benefits of Zero Trust Architecture as Defi... by badrabbit on Sunday February 19, 2023 @07:36PM (#34863513)
We weren't talking about those two standards alone and you haven't brought them up as examples either. All i have learned from you is you use strawman arguments.

Ok, what part of U2F requires users to remember a secret? I have seen passwordless accounts you can take over simply by controlling a yubikey. I hate it when people seem to argue with me but argue against strawmans they're inventing. I agree, discourse here can't happen.

[ Parent | on HN ]