SoylentNews is people
SoylentNews
In a presentation at this year's RSA Conference, taking place in San Francisco this week, Dr L Jean Camp, a professor at Indiana University Bloomington in the US, and her doctoral candidate Sanchari Das, detailed their research into why people aren't using Yubico security keys or Google’s hardware tokens for multi-factor authentication (MFA).
For those who don't know: typically, you use these gadgets to provide an extra layer of security when logging into systems. You enter your username and password as usual, then plug the USB-based key into your computer and tap a button to activate it. The thing you're trying to log into checks the username and password are correct, and that the physical key is valid and tied to your account, before letting you in.
That means a crook has to know your username and password, and have your physical key to log in as you. We highly recommend you investigate activating MFA on your online accounts, particularly important ones such as your webmail.
What the pair found during their research work derails any previous assumptions that the lack of MFA uptake is because people are stupid, or can't use the technology. What it comes down to is education and communicating risk.
(Score: 0) by Anonymous Coward on Thursday March 07 2019, @09:17AM
90% of everything is shit, a well known fact.
But physical security is pretty great. It's all life has relied on forever (billions of years) except the few last decades.
I don't mind emptying the bank account of somebody who lives on the other side of the Earth. In many jurisdictions they do this all day long. But would I travel there first to try and steal some token only to find guy has $13,25 in his account? Don't think so. It's high bar.
Put more post-it notes on the monitors with all your passwords on them. Or at least use a password manager.
The "high security" locks and Large Men With Guns are there for a reason.
Besides MFA doesn't have to be anything sold, a piece of paper containing one-time passwords asked in random order suffices nicely...