Hacker News Reader

Depends on how you define "insecurity". Availability is one of the pillars of security, so even your joke falls apart.

Several years ago the trendy thing to do for security was to get a USB-A security dongle and lock your important accounts with it. Nowadays, laptops from several major manufacturers no longer ship with a USB-A port, so if you need to log in again and don't have a USB-C dock handy, you're locked out until you can find one.

View on HN

Isn't availability usually from the service still being accessible in a technical sense? Password lockout policies will also result in people being locked out often until manual review or the use of some (hopefully secure) second factor. With hardware tokens there just needs to be an established - and efficient - process to replace them or allow access on an ad-hoc basis for exceptional cases (a bit iffy perhaps but also possibly necessary given practicalities). There's no dispute that passwords mean you don't have to worry about things like what USB ports your laptop has, but that's mainly because of the fact they're just strings that you type in which is also their entire issue for phishing/hacking etc.

Either way, availability can be compromised by a hack due to passwords being phished and I think I'd prefer dealing with hardware tokens than the fallout of being phished or otherwise suffering credential compromise. That said at this point I probably wouldn't issue hardware tokens en masse until proper processes are in place to manage them (and their loss/breakage/etc) - it's certainly not solved to my satisfaction yet.

Reply on news.ycombinator.com