Post #2238405
2026-04-17 19:32 UTC
@encthenet@flyovercountry.social @JensHannemann@mastodon.online That’s ultimately why “2FA” is a bad concept, as is know/have/are. The only real distinction in authentication is symmetric versus asymmetric.
Symmetric authentication ultimately always involves a shared secret. Passwords. RSA tokens. Yubikeys. It’s all shared between you and the service. Someone pops the service, they can impersonate you later. If a combination of two passwords doesn’t count as “2FA”, then neither does a combination of any two symmetric tokens.
Asymmetric authentication for users is pretty much just SSH keys, x509 client certs, and passkeys. Pop the site and you don’t get the ability to impersonate the user.
Replies (1)
-
@JensHannemann@mastodon.online 2026-04-17 22:39
@bob_zim@infosec.exchange @encthenet@flyovercountry.social FIDO2 and Yubikeys are asymmetric. Yubikeys are just physical implementations of passkeys (they can store symmetric credentials as well, but that’s not the main application). Storing a salted hash on the server mitigates the break-in risk, which is further reduced by 2FA, but yes, strong asymmetric credentials are the best choice. Compromising every holder of secret keys just doesn’t scale.