this post was submitted on 26 Jun 2024
304 points (95.8% liked)

Cybersecurity - Memes

2004 readers
1 users here now

Only the hottest memes in Cybersecurity

founded 1 year ago
MODERATORS
 
you are viewing a single comment's thread
view the rest of the comments
[–] jj4211 6 points 5 months ago (2 children)

While true, other scenarios do come into play, like "I'm using a FIDO key but I dropped it down a storm drain". Meaning you pretty much have to provide some recovery mechanism, since you can't really require the user to have a backup device.

[–] [email protected] 3 points 5 months ago* (last edited 5 months ago) (1 children)

That's why I don't use hardware tokens. They are more secure but they can break or get lost/stolen. My authentication app supports backups.

[–] jj4211 1 points 5 months ago (1 children)

Indeed, but some "security" guys frown deeply about the private key ever leaving a specific hardware device, because the second it can be backed up they freak out that it could, theoretically, be stolen. It's hardly a practical concern, but there's a lot of security people that don't care about practical considerations.

[–] [email protected] 4 points 5 months ago (1 children)

I see it more neutrally - the concern isn't wrong after all. Security is always to be balanced against convenience.

I consider being locked out for good so inconvenient that I'm willing to sacrifice a bit of security to avoid it. But everyone has to find what works best for them.

[–] [email protected] 3 points 5 months ago

Get out of here with your pragmatism. We'll have none of that in this security context.

[–] [email protected] 1 points 5 months ago

That's why it is called multi-factor