Hacker News Reader

Comment by nmca | Hacker News Reader

hardware tokens are the way! Everyone has had a house key their whole lives, and understands how to keep a spare to prevent lock-outs.

View on HN

If only there was some kind of a physical tokem with a crypto key that is protected by a password and tied to one's bank account.

-s

The only bit we're lacking is the "tied to one's bank account". The rest already exists in the form of yubikeys and other hardware security tokens.

Your bank/credit/debit/etc. card is a “physical token with a crypto key that is protected by a password and tied to one's bank account”. FIDO and EMV even both use the same underlying ISO/IEC 7816 and 14443 protocols for communications.

Ah! I forgot about my debit card. I only use it ~once per month. Yeah, we'd need an additional piece of hardware to be able to connect it to our computers but that also could enable doing chip-based transactions over the internet so I think it would absolutely be worth it.

I know this was sarcasm, but bank card is not appropriate because you should have one hardware key for all services produced by an independent provider.

Why would I want to have one key for all them? To lose access or get them all compromised at the same time?

I think your threat model is bad — the isolation of accounts offers little and most people have effectively only the security of their email provider anyway.

That said, buying several keys would be a natural and happy path solution for the paranoid. Make sure to get three for each account (same as primary) as either you need a backup or the extra key offers no extra security.

Some of us don't want to have a dozen plus separate physical tokens (one for each of bank/credit card/tax, etc sites with sensitive financial information we have).

Okay, I will make the "S" mark bigger next time.

Not how it works. One key can keep dozens of entries.

I know plenty of people who have lost house keys. I have many Yubikeys and I am responsible with my things, but not everybody is like us.

Hardware tokens are a PITA. Sure everyone has a house key because they only have a house at a time. I have 3 bank accounts, a few brokerage accounts, some pension logins on top of the regular stuff. I'm not going to carry 15 hardware tokens with me.

You only need one, plus a couple recovery spares, in any sane implementation.

SecurID tokens suck but with FIDO2, you'd only need one key.

Of course, that breaks the UX analogy of the house key.

Reply on news.ycombinator.com