Hacker News Reader

Comment by kyrra | Hacker News Reader

For 2FA, having multiple of these or some kind of recovery code tends to be the answer, as you can remove the keys from sites you use it on.

I am less willing to use something like this for passwordless logins. These types of devices should be part of the "something you have" part of 2FA, which should always be paired with a "something you know".

Maybe I'm missing a step here, but why would you ever use this for passwordless?

View on HN

For U2F you're right that it becomes single factor if you use the device as the only factor. With FIDO2 (which is what makes passwordless available), however, the device supports a local PIN as the "something you know" factor - and it's also a better kind of knowledge factor than a traditional password since it's never sent over the network.

Because the something you know part isn't all that secure anyway?

https://xkcd.com/538/

it is a different level of security. The comic is fully correct, but you should still use a secret. That is why there are 3 different types of authentication. The first is something you have - a card or key. The second is something you know - a password. The third is something you are - a fingerprint. Each provides protection against a different attack and is vulnerable to different attacks. The more important the secret the more of them you should use.

Note that you quickly get to the point where you need more than one person involved. You can compromise one person as much as you want, but if that person doesn't have the complete secret it doesn't do any good.

Calling a fingerprint "something you are" is a stretch. You are leaving fingerprints everywhere, they can be lifted from any smooth surface you touched (or even high-resolution photo) and then used to open biometric locks.

The fingerprint belongs to you. Calling it 'something you are' is conveying this, without claim to it being somehow difficult to clone or entirely unique. Mother's maiden name is similar in this regard.

> The third is something you are - a fingerprint.

A fingerprint isn't “something you are”, because it can be destroyed while you remain, and information about it can be captured and reproduced by attackers who are not you.

It's just a particularly hard to lose (but easy to discover, and impractical to replace if compromised, at least more times than you have fingers) “something you have.” In security factor terms, I'm not convinced the idea of a distinct “something you are” category is coherent, since most candidates seem similar to that.

DNA is something you are.

Maybe? Although not yet practical, in theory it too can be captured and reproduced.

The reason DNA is useful as criminal evidence is you leave it everywhere; that makes it a horrible security factor: like fingerprints it's an impractical to replace wheb compromised “thing you have” that you leave everywhere for attackers.

That is a very good reason to not use it alone. However when combined with other it provides a good indication that someone was actually there. Either that, or the attacker went through more effort to get the secrets.

"Something you are" is a term of art, not a very specific statement of fact to be legally overanalyzed. A fp is very much "something you are".

> "Something you are" is a term of art,

Yes, what I am saying is that in practice what that term of art refers to is not an independent, orthogonal kind of security factor from “have” and “know” but a strictly worse form of “have”.

I honestly think the better one would be: "Hit his wife and kids until he tells us the password."

Much more effective.

Reply on news.ycombinator.com