> [effective and meaningful] Security is hard. We should build systems that make...

bsder · on Nov 15, 2020

Not necessarily.

What's your threat?

Most people are not trying to stop a determined attacker. Most people just want random people to not get be able to get into their stuff--same as a physical lock.

They carry a physical key on their person. It's not too much to ask them to carry a "digital" key on their key ring.

The problem is that most "digital" keys are a pain in the ass:

1) Mostly because everybody wants to "centralize" authentication so that they can charge you and administrate you.

2) Secondarily because there is no good solution for talking to the key on your person. NFC sucks. USB requires that I plug my key in. WiFi requires that the device be able to hit your network. BLE has no access from web pages.

BLE is probably the best choice, but there is no real money in making it work.

senectus1 · on Nov 15, 2020

Any tool used to create another tool, is the very tool that will be used to help dismantle that other tool.

There is no way around this... Security isn't a state, it s a process. It relies on the human to propagate it. A bit like a garden.

Make the process simple for the user (but not thoughtless) and that is about as good as is going to get.