News for hackers. Stuff that matters.

A comment on Passwordless authentication with FIDO2–beyond just the web. Parent comment

Re:Passwordless authentication with FIDO2–beyond just the web by megous on Wednesday February 22, 2023 @02:26PM (#34901236)
I don't mind to differ on this one. Your reaction certainly didn't address any of my concerns about practicality of HW keys in any scenario where you're not just sitting at home and can lose your key, and will be fucked if you'll not be able to recover or downgrade your security for a little bit until everything's normal again.

Maybe to secure corporate accounts against phishing, or whatever. But for my personal stuff, I need to be able to recover in many ways at any time with just a random computer and internet access without any special HW that may not be readily obtainable the moment I need it.

[ Parent | on HN ]
Re:Passwordless authentication with FIDO2–beyond just the web by taeric on Wednesday February 22, 2023 @02:47PM (#34901567)
I don't think you are wrong, but I do find it funny how the threat models get built so differently.

My personal feel is I'm ok not having my key with me when I'm "out and about." Is no different than my not having some of my ID cards with me. Such that, I'm already "locked out" of many of my financial accounts and such when I am not at home. But, I fully ack that that is a personal choice here. I just can't think of any situation I've been in, in a LONG time, where I was needing to randomly use a computer.

Edit: It also occurs to me that keeping keys to get back into your home is almost certainly similar in concern here. As somewhat crazy as I think the "keychain" nature of these tokens is, it does address a large part of this problem.

[ Parent | on HN ]