This isn’t strictly a privacy question as a security one, so I’m asking this in the context of individuals, not organizations.

I currently use OTP 2FA everywhere I can, though some services I use support hardware security keys like the Yubikey. Getting a hardware key may be slightly more convenient since I wouldn’t need to type anything in but could just press a button, but there’s added risk with losing the key (I can easily backup OTP configs).

Do any of you use hardware security keys? If so, do you have a good argument in favor or against specific keys? (e.g. Yubikey, Nitrokey, etc)

  • @[email protected]
    link
    fedilink
    English
    18 months ago

    If I compromise your system. I can record the pin. Then I just need to steal the device.

    • @[email protected]
      link
      fedilink
      18 months ago

      Think, who are you, and who am i?

      I mean, how would you do it, and just why?

      This is a very very very improbable scenario, too complicated, and too unlikely

      There could be a thread model that would work with this feature well, but I don’t think any of us even theoretically is one of those people that would benefit from it

      Define your thread model, and work from it

      Most of the people have two main threads: hackers, and thieves, not hacker-thieves