Krebs on Security:
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
Security Keys are inexpensive USB-based devices that offer an alternative approach to two-factor authentication (2FA), which requires the user to log in to a Web site using something they know (the password) and something they have (e.g., a mobile device).
Security keys have been around for a long time – I used one at an engineering firm I worked at 25 years ago – but I wonder if this kind of implementation will not only become more widely used but maybe trickle down to average consumers? Also, there are security concerns regarding plugging in USB devices at work and how secure those devices are in and of themselves. Still, a step towards a different future of passwords.
Maybe? I putting things behind a finger print is a better idea for most people. It’s probably even better for corporate users, but just not as good for their IT departments.
The challenge here is that you want two different independent factors, both revocable.
A fingerprint, in and of itself, isn’t enough. You could MITM it or clone it. You could certainly use a fingerprint as either a substitute for password /or/ security key.
I suppose there could be a well-designed protocol, combined with secure enclave, that could make it a fairly strong single factor that might be good enough. But that’s hard to get right, and especially if you work across a set of devices.
The problem with a fingerprint or any other biometric is that if it’s ever compromised, you’re screwed forever. You can change a password or a USB key, you can’t change your biometrics. A fingerprint is a great username, but a bad password, at least as a long term solution.
That’s not at all the approach I meant. 🙂