On Sat, 2024-11-23 at 01:39 -0500, Jeffrey Walton wrote: > Folks should be using YubiKeys or other FIDO compliant gadgets > nowadays. They provide the following security properties: > > * high entropy > * phishing resistant > * replay resistant > > Each origin (domain) uses a different authenticator, so cross-origin > attacks (like reusing passwords) is difficult. > > If someone is willing to buy a $1000 phone and pay $75 a month for > service, they should be able to afford a $50 YubiKey. I have a few concerns with an extra gadget. There's the obvious: Being widely supported, or you have to have a plethora of different key gadgets for all your services, and continuing support for the thing. My bank and phone service provider had (different) ones with rolling code numbers that you were supposed to type in. It could be a pain if the login process (load page, type in details, etc), took too long. It was certainly a pain if the thing didn't work (flat batteries, dead buttons), or you didn't have it on you. And the dopiness of having a verification app on the same device as you're using. The fall back was either an old-fashioned login with username and password, taking you back to square one with bad security. Or, you had to phone their telephone support for a reset, which they were all too easily convinced to do with minimum verification. In fact, that's one of the banking hacks, the thief getting the bank to do a reset. And then there's the gadget that you plug in, or otherwise connect. There's going to be limitations to how you can connect to your thing without WiFi, without USB sockets. And do you really want to connect it to someone else's device if you had to authenticate? Your work PC, for instance? Or does your work want you to connect their device to your home PC? Good security is always a pain, and often incompatible with technically illiterate people. In a lot of ways I wish things could intelligently recognise me, as me, and I am the authentication. But they don't really have an person is doing it under-duress detection. Fingerprint scanners are easily fooled, and easily fail on people who do rough work with their hands. They've discovered retina scans can scan you at a distance without you knowing, so someone's is going to be able to do replay hack with that data. And if someone can somehow clone whatever bio data you're using, you can't change your bio data. -- uname -rsvp Linux 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 Boilerplate: All unexpected mail to my mailbox is automatically deleted. I will only get to see the messages that are posted to the mailing list. -- _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
