Hacker News new | past | comments | ask | show | jobs | submit login

I have known a fair few people over the years who have had security tokens to be able to login at work.

They all keep them on their key chain so I don't agree with your premise.

The only thing I never understand is why, like the device pictured, they're designed with strings and thin plastic instead of chains and a beefy case.




Because they're expected to be kept on a keychain which is commonly kept in one's pocket and which you'd rather not have filled up with chains and bulky cases?


That's just their small device (NEO). I have two of their normal sized one that I use for several sites already for 2-Factor. The YubiKeys are actually pretty robust and safe enough to keep on a keyring.

The key to this is to still require something that you remember like your username (and/or a password), they will get stolen and it is too risky for these tokens to be the only authentication factor.

As long as users are educated that these tokens should in all ways be considered a set of keys then security can only be improved with them.


In one place I know, the company combined the door key and the computer key into the same device to practically force people to take the key with them when they leave. They reasoned that if users can't leave the building without unplugging the key from the computer, then that would be that.

Of course, people still leave the key at the computer when they go and eat, bathroom, or when they leave the building as a group.


I have known a fair few people over the years who have had security tokens --to be able to login at work.--

For work purposes, i.e. you need it to do your job so it may be required at any point. TFA is saying people will leave it just by the PC they use most often, i.e. at home, which defeats the point.

I think the use of smart phones for 2-factor is the way to go, since it is not something else I need to carry around. Up until recently Barclays Bank (in the UK) had a fairly bulky card reader which I would insert my card, tap in my pin and it would generate a secondary password (I also have to chose letter X and Y from my password). They now have a smart phone app. Much simpler for me now.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: