Hacker News new | past | comments | ask | show | jobs | submit login

I think the answer is that if you share seeds and lose a device, then you really need to invalidate and reprovision all of your remaining devices. If you use separate seeds and lose a device, you just invalidate the one device and move on.

From a user's perspective, it seems like a good feature; I'm fine with reprovisioning my 2-3 devices, no big deal, I'm in control of that. From an admin or business perspective, it's less acceptable because if I see something weird and need to invalidate a device, I'm actually preventing my user from authenticating altogether - and that could require more work to recover from depending on where my user is and what my provisioning process looks like.




Why does losing the device require invalidating seeds? If I lose my phone or its stolen, those seeds are still behind a lock screen, and even if they get out, an attacker would need my password.


Maybe 'requires' is too strong a word. It's hardly mandatory, but I'd argue you should invalidate a lost or stolen seed for the same reason you should reset a lost or stolen password.

Of course it is not possible to access something protected by MFA if you only have one factor. But I don't think it follows that making it easy for an attacker to obtain a factor since you have two is OK; the whole point of MFA is that single factors are too easy to guess or steal. Solutions that encourage seed export and sharing make it easier to steal the seed, and leaving a seed active if a device it's on has been lost or stolen is like saying you don't care.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: