2522: Two-Factor Security Key - Revision history

Quantum: /* Explanation */ Cleaned up the awkward phrasing around it being maybe a security key because it clearly is from the title

2025-07-20T16:03:06Z

‎Explanation: Cleaned up the awkward phrasing around it being maybe a security key because it clearly is from the title

141.101.109.191 at 16:35, 10 April 2025

2025-04-10T16:35:08Z

162.158.74.68: /* Explanation */ Better with the right case/capitals, and a link. Although it seems clear that the comic doesn't use as sensible item as that.

2024-09-28T21:04:47Z

‎Explanation: Better with the right case/capitals, and a link. Although it seems clear that the comic doesn't use as sensible item as that.

172.71.182.245: yubikey

2024-09-28T18:39:21Z

yubikey

Jacky720: rv

2022-05-04T21:00:09Z

Show changes

Ex Kay Cee Dee at 20:58, 4 May 2022

2022-05-04T20:58:45Z

Show changes

Davidy22: Reverted edits by X. K. C. D. (talk) to last revision by 172.70.126.87

2022-05-04T01:58:11Z

Reverted edits by X. K. C. D. (talk) to last revision by 172.70.126.87

Show changes

X. K. C. D. at 01:00, 4 May 2022

2022-05-04T01:00:25Z

Show changes

172.70.126.87: /* Explanation */

2022-02-17T01:21:21Z

‎Explanation

172.70.98.107: /* Trivia */ fix

2021-10-05T01:43:16Z

‎Trivia: fix

@@ Line 8: / Line 8: @@
 ==Explanation==
-{{w|Multi-factor authentication|Two factor security authentication}} (also see [[#Trivia]]) is something that [[Ponytail]] has clearly been talking to [[Cueball]] about. In this strip, Cueball is telling her that he has finally buckled down and gotten the two factor security key that she has pestered him to get.
+{{w|Multi-factor authentication|Two factor security authentication}} (also see [[#Trivia]]) is something that [[Ponytail]] has clearly been talking to [[Cueball]] about. In this strip, Cueball is telling her that he has finally buckled down and gotten the two factor security key (such as a {{w|YubiKey}}) that she has pestered him to get.
-He recites the trials that he endured in "installing" the key, all of which seem plausible configuration issues for setting up a proper two-factor authentication from scratch.  However it is then revealed that all this work was just the task of attaching the 'key' (which looks like it could be a common brand of physical two-factor key fob or dongle) onto his metal keyring.
+He recites the trials that he endured in "installing" the key, all of which seem plausible configuration issues for setting up a proper two-factor authentication from scratch.  However it is then revealed that all this work was just the task of attaching the security key onto his metal keyring.
 Metal {{w|keyring}}s are reliably secure as far as keeping a key attached, but this is in part because of how notoriously difficult it is to add a key to or remove a key from them. The rings must be forced apart and ''held'' apart while the key traverses however many layers the ring has (usually two or three, though keyrings with more layers are not unheard of). Cueball confidently asserts (to off-screen Ponytail, who probably was expecting something more practical) that his key is ''not'' coming off, indicating both a (well-founded) faith in the keyring's ability to keep his key, and a desire to not go through the same process in reverse.  Presumably all his effort was in "installing" the key onto the keychain, and he probably hasn't actually set it up for any of his accounts, leaving them just as insecure as they were.
@@ Line 17: / Line 17: @@
 Additionally a third meaning could be that while he spent a lot of time setting up 2FA he totally overlooked the possibility of him losing his whole keychain thus locking him out of all the services that requires 2FA if he didn't set up yet another layer of backup.
 ==Transcript==

← Older revision		Revision as of 16:35, 10 April 2025
Line 19:		Line 19:

	Another possibility is that the key is a physical authentication key, for example a {{w\|YubiKey}}. These are very commonly used as a second authentication method.		Another possibility is that the key is a physical authentication key, for example a {{w\|YubiKey}}. These are very commonly used as a second authentication method.
−	h	+

	==Transcript==		==Transcript==

@@ Line 18: / Line 18: @@
 Additionally a third meaning could be that while he spent a lot of time setting up 2FA he totally overlooked the possibility of him losing his whole keychain thus locking him out of all the services that requires 2FA if he didn't set up yet another layer of backup.
-Another possibility is that the key is a  physical authentication key, for example a yubikey. These are very commonly used as a second authentication method.
+Another possibility is that the key is a physical authentication key, for example a {{w|YubiKey}}. These are very commonly used as a second authentication method.
 ==Transcript==

← Older revision		Revision as of 18:39, 28 September 2024
Line 17:		Line 17:

	Additionally a third meaning could be that while he spent a lot of time setting up 2FA he totally overlooked the possibility of him losing his whole keychain thus locking him out of all the services that requires 2FA if he didn't set up yet another layer of backup.		Additionally a third meaning could be that while he spent a lot of time setting up 2FA he totally overlooked the possibility of him losing his whole keychain thus locking him out of all the services that requires 2FA if he didn't set up yet another layer of backup.
		+
		+	Another possibility is that the key is a physical authentication key, for example a yubikey. These are very commonly used as a second authentication method.

	==Transcript==		==Transcript==

@@ Line 16: / Line 16: @@
 The title text has a similar double meaning.  Cueball would of course use it to the "proof" of his efforts installing the key--though difficult, metal keyrings can be forced apart physically by human hands, at least if the human in question has fingernails sturdy enough to slip between the rings, at which point the insertion of a finger would be enough to keep it apart until the key is inserted. However, keeping the rings apart can be strenuous on the fingers, and can result in bruising, which Cueball is all too familiar with. {{w|Proof of work}} alludes to the cryptographic concept, which ties (sideways, as proof of work is a security term for a concept intended to deter denial of service and similar volume-based attacks but not directly related) back into the two-factor authentication.
-Additionally a third meaning could be that while he spend a lot of time setting up 2FA he totally overlooked the possibility of him losing his whole keychain thus locking him out of all the services that requires 2FA if he didn't set up yet another layer of backup.
+Additionally a third meaning could be that while he spent a lot of time setting up 2FA he totally overlooked the possibility of him losing his whole keychain thus locking him out of all the services that requires 2FA if he didn't set up yet another layer of backup.
 ==Transcript==

@@ Line 46: / Line 46: @@
 ** Prior to ubiquitous use of the internet (or other dial-in networks), software companies might protect their products with a {{w|software protection dongle}} to replace or augment the more easily-sharable licence keys(/passwords) and enforce the use of no more copies than had been paid for. - With the advent of the connectivity needed, a "phone home" technique has largely replaced the necessity of this, a central server vetting the use (and/or transfer) of sofware between machines. But {{w|Universal 2nd Factor|related technology}} is a modern implementation that is ''probably'' what Cueball's keyringing efforts involve.
 ** A device similar to the fob/dongle could also use short-range wireless communications (Bluetooth, RFID, Near-Field Communication or some proprietry method) to indicate the proximity (and identity) of the token to a receptive system. Some high-end car models offer such a system in place of an ignition key for... some absolutely valid reason.{{citation needed}}
-** With "Remember my password" options in browsers and {{w|password managers}}, ostensibly to prevent over-the-shoulder attacks and/or the prevalence of weak passwords, increasingly the 'known' password has become more of a possession tied to a particular device (and any other device that has been linked by the synchronisation of such internal information).
+** With "Remember my password" options in browsers and {{w|password manager}}s, ostensibly to prevent over-the-shoulder attacks and/or the prevalence of weak passwords, increasingly the 'known' password has become more of a possession tied to a particular device (and any other device that has been linked by the synchronisation of such internal information).
 ** A code sent to a further service, such as emails to a (different) email account, or SMS message to a phone, or push notification sent to a smartphone. Retaining the possession of (and access to) these systems is often left more up to the end-user than with vendor-controlled systems, which can be an issue when used as a fall-back reauthentication method (see below).
 ** A non-computing example is the {{w|Token (railway signalling)|Railway Token}}, sometimes combined with quite ingenius {{w|Annett's key|key-and-lock}} systems, to enforce safe line-use.
-* '''What you are''' - Some quality that relates to your {{biometrics|physical person}}. It may very hard (but not {{w|amputation|impossible}}) to lose this, or to have someone else use it. Physical coercion may be the greatest threat to this attempt to maintain security, much as it could be used for the others as well. Until recently, the hardware needed made this more of a cinematic 'solution' (to be foiled by resourceful antagonists/progatonists) or in a limited number of high-security situations, but it has also started to make inroads into consumer use. They are rarely used directly for online verification (though they can be), but more often are used to authorise the device to communicate it's intrinsically possessed verification key (or just to generally use that device).
+* '''What you are''' - Some quality that relates to your {{w|biometrics|physical person}}. It may very hard (but not {{w|amputation|impossible}}) to lose this, or to have someone else use it. Physical coercion may be the greatest threat to this attempt to maintain security, much as it could be used for the others as well. Until recently, the hardware needed made this more of a cinematic 'solution' (to be foiled by resourceful antagonists/progatonists) or in a limited number of high-security situations, but it has also started to make inroads into consumer use. They are rarely used directly for online verification (though they can be), but more often are used to authorise the device to communicate it's intrinsically possessed verification key (or just to generally use that device).
 ** Fingerprint scanners are an old standard, and may even now be able to protect against the [https://whatis.techtarget.com/definition/gummy-bear-hack Gummy Bear trick].
 ** Eye-scanning (using iris, retina or scleral vein patterns) is a favourite movie version, and perhaps possible with sufficiently high-resolution macro-lensed cameras.