W
w.2.f
Ye, unto you, my fellow brethren and sistern,
I have come here in search of a device. I may, or may not, have seen such devices on my travels before. Yet, I might be too rudimentary to understand the principles of '(account-, product- and system-) security', to see its disadvantages or leaks..
Why is there no Microsoft Authenticator? There is an option to use a Microsoft Authenticator, sure, but like nearly all other authenticator options out there, they make use of existing, proven to be vulnerable techniques and/or delivery channels. For example, Microsoft Authenticator uses an app, which is most likely installed on an android device, which brings in a truck load of vulnerability and security concerns, as it is nearly impossible to keep an android phone safe for more than two years - that is, if it even comes safe out-of-the-box - not even the high-end models. On top of that, phones come with internal batteries more and more, which practically limits their lifespan to, maybe, three years. I know this, I bought two highest-end models android phones, and none of them even lasted as long as I expected, seeing the $700-$800 I payed for them. And, besides, phones remain an insecure vessel when it comes to true two-factor authentication.
That is why I'm looking for something more safe, something I can entrust my 'master e-mail account' to, and can use to apply to everything a password should be used for, from Windows 10 login, to remote login, to SSH login, you name it. There must be something like this out there, like an USB stick or keychain, that can provide this - and ONLY this - sort of security.
I am talking about a device similar to which Blizzard introduced, the Blizzard Authenticator. Genius design, if you ask me. You hang them on your key-chain, and that physical device is linked to your Blizzard account. So it is simply impossible to access your account, account settings, or play the game, without having this physical authenticator, that does NOTHING else than authenticate. No android involved(which is a security risk), no SMS involved(which is a security risk), no writing down complex passwords which are hard to remember. Just a keychain.
With this concept as a basis, why can I not find such an autheticator for, well, everything. And universal authenticator, or a device built with an USB-stick connector for all I care, with one unique code/identity per stick that generates authentication codes, which you can use to unlock your 'master account', and possibly its derivatives. Like, when you just built a new PC, and install Windows 10, you get the option to link your product-license/product-code, to your authenticator, so when some one steals your PC or hacks into it, or whatever, they cannot access your data, use your computer, nor any of your linked accounts, cause it will just keep asking for the authenticator code. Unless they're on a zero-day, but those are hard to find.
It's a rocksolid principle, but its solidity is built on it being used for authenticating, and ONLY for authenticating. The device shouldn't be given any other tasks, as any other tasks breaks its principle of it being an authenticator. No extra options, just security. I don't want to make any photos with it, or share my authenticator code on Facebook and Twitter, no. Just security.
As Blizzard introduced this concept for over eight years ago, and it has proven itself to actually be brickwallsafe, I wonder why others have not taken up the concept. I like how Blizzard played it. They first concerned themselves with people whom were actually looking for security, and only later introduced the app, when all the 'aah, I can't be **** spending $14,- for security' kept getting their accounts compromised. They knew that there is safe, safe enough to cut costs, and unsafe. And in that order they provided solutions. I respect that.
So, is there something out there, that does what I'm talking about. Or something comparable. Or is it really logistically impossible to add a $14,- stick to every $200,- Windows 10 Home box. If there were such a device in it, and I could centralize my accounts/logins with it somehow, I'd might actually consider buying Windows 10 Home for $200,-. Else I'll just keep.. hanging around the OEM-bucket, and linux. Even though I value Microsoft's take on privacy over that of Google's, I just can't spend that much money for something that can be so easily fragmented, avoided, and can never be a 100% safe. And I'm sure there is a grandeur of reasons why the authenticator loses it's value after you've logged in.. but atleast you'll know no one can use the usual ways of logging in, without your keychain - which is NOT the case when using an app on a phone, or tablet, or even SMS.
I hope you guys can help me out here. The short question is: is there a comparable device like the Blizzard authenticator, that can be used for all two factor authentication processes, including Hotmail, Windows, whatever?
Continue reading...
I have come here in search of a device. I may, or may not, have seen such devices on my travels before. Yet, I might be too rudimentary to understand the principles of '(account-, product- and system-) security', to see its disadvantages or leaks..
Why is there no Microsoft Authenticator? There is an option to use a Microsoft Authenticator, sure, but like nearly all other authenticator options out there, they make use of existing, proven to be vulnerable techniques and/or delivery channels. For example, Microsoft Authenticator uses an app, which is most likely installed on an android device, which brings in a truck load of vulnerability and security concerns, as it is nearly impossible to keep an android phone safe for more than two years - that is, if it even comes safe out-of-the-box - not even the high-end models. On top of that, phones come with internal batteries more and more, which practically limits their lifespan to, maybe, three years. I know this, I bought two highest-end models android phones, and none of them even lasted as long as I expected, seeing the $700-$800 I payed for them. And, besides, phones remain an insecure vessel when it comes to true two-factor authentication.
That is why I'm looking for something more safe, something I can entrust my 'master e-mail account' to, and can use to apply to everything a password should be used for, from Windows 10 login, to remote login, to SSH login, you name it. There must be something like this out there, like an USB stick or keychain, that can provide this - and ONLY this - sort of security.
I am talking about a device similar to which Blizzard introduced, the Blizzard Authenticator. Genius design, if you ask me. You hang them on your key-chain, and that physical device is linked to your Blizzard account. So it is simply impossible to access your account, account settings, or play the game, without having this physical authenticator, that does NOTHING else than authenticate. No android involved(which is a security risk), no SMS involved(which is a security risk), no writing down complex passwords which are hard to remember. Just a keychain.
With this concept as a basis, why can I not find such an autheticator for, well, everything. And universal authenticator, or a device built with an USB-stick connector for all I care, with one unique code/identity per stick that generates authentication codes, which you can use to unlock your 'master account', and possibly its derivatives. Like, when you just built a new PC, and install Windows 10, you get the option to link your product-license/product-code, to your authenticator, so when some one steals your PC or hacks into it, or whatever, they cannot access your data, use your computer, nor any of your linked accounts, cause it will just keep asking for the authenticator code. Unless they're on a zero-day, but those are hard to find.
It's a rocksolid principle, but its solidity is built on it being used for authenticating, and ONLY for authenticating. The device shouldn't be given any other tasks, as any other tasks breaks its principle of it being an authenticator. No extra options, just security. I don't want to make any photos with it, or share my authenticator code on Facebook and Twitter, no. Just security.
As Blizzard introduced this concept for over eight years ago, and it has proven itself to actually be brickwallsafe, I wonder why others have not taken up the concept. I like how Blizzard played it. They first concerned themselves with people whom were actually looking for security, and only later introduced the app, when all the 'aah, I can't be **** spending $14,- for security' kept getting their accounts compromised. They knew that there is safe, safe enough to cut costs, and unsafe. And in that order they provided solutions. I respect that.
So, is there something out there, that does what I'm talking about. Or something comparable. Or is it really logistically impossible to add a $14,- stick to every $200,- Windows 10 Home box. If there were such a device in it, and I could centralize my accounts/logins with it somehow, I'd might actually consider buying Windows 10 Home for $200,-. Else I'll just keep.. hanging around the OEM-bucket, and linux. Even though I value Microsoft's take on privacy over that of Google's, I just can't spend that much money for something that can be so easily fragmented, avoided, and can never be a 100% safe. And I'm sure there is a grandeur of reasons why the authenticator loses it's value after you've logged in.. but atleast you'll know no one can use the usual ways of logging in, without your keychain - which is NOT the case when using an app on a phone, or tablet, or even SMS.
I hope you guys can help me out here. The short question is: is there a comparable device like the Blizzard authenticator, that can be used for all two factor authentication processes, including Hotmail, Windows, whatever?
Continue reading...