Google's New 2 Step Auth.
- Thread starter BHW-News
- Start date
TheVigilante
Banned - Multiple Rules Violations
- Aug 31, 2010
- 14,993
- 16,105
I have the normal two step verification for like 2 years now...
tb303
Supreme Member
- Dec 18, 2011
- 1,238
- 909
Dont be so paranoid its capacitive touch not a finger print reader.
What happens if you loose or damage the key though? Does it then fall back to standard "forgot my password" stuff? If so theres the vulnerability. Also if someone spoofs user agent to mobile they wont be asked for the key anyway.
Cant be used by mobile or in many work places. Seems a bit of a fad to me.
What happens if you loose or damage the key though? Does it then fall back to standard "forgot my password" stuff? If so theres the vulnerability. Also if someone spoofs user agent to mobile they wont be asked for the key anyway.
Cant be used by mobile or in many work places. Seems a bit of a fad to me.
- Mar 26, 2013
- 14,954
- 11,759
If the key is lost, no one else can use it and you just go back to normal 2 step. Apparently can't be spoofed either.
SocialMediaManager
Elite Member
- Sep 20, 2012
- 1,702
- 750
Good luck plugging a USB key into your iPad, or letting your security-sensitive workplace let you plug arbitrary USB keys into your workstation, or convincing your bank that you really did not send your entire balance to Nigeria, even though you signed that transaction with a tap, etc etc...
Remember Mt.Gox? That's Yubico's most public failure so far
Strong authentication needs to be out-of-band, and support transaction signing, and work everywhere, or there's no point using it. You can't get "out of band" with anything that you "plug in" - that's simply connecting it directly to the same threats.
Remember Mt.Gox? That's Yubico's most public failure so far
Strong authentication needs to be out-of-band, and support transaction signing, and work everywhere, or there's no point using it. You can't get "out of band" with anything that you "plug in" - that's simply connecting it directly to the same threats.
D
Deleted member 720373
Guest
Third comment on the blog:
Are some people just too paranoid??
Are some people just too paranoid??
Wilson Grant Fisk
Elite Member
- Nov 10, 2012
- 15,677
- 46,846
Good luck plugging a USB key into your iPad, or letting your security-sensitive workplace let you plug arbitrary USB keys into your workstation, or convincing your bank that you really did not send your entire balance to Nigeria, even though you signed that transaction with a tap, etc etc...
Remember Mt.Gox? That's Yubico's most public failure so far
Strong authentication needs to be out-of-band, and support transaction signing, and work everywhere, or there's no point using it. You can't get "out of band" with anything that you "plug in" - that's simply connecting it directly to the same threats.
Deja Vu, I could swear I have read that before.
http://googleonlinesecurity.blogspo...howComment=1413903286554#c3539073133029923080