> you can generate and input the key yourself, so that Google never sees it.... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

dsl on June 7, 2011 | parent | context | favorite | on: RSA finally comes clean: SecurID is compromised

> you can generate and input the key yourself, so that Google never sees it.

Google still needs to know the secret. All authenticators are based on a shared secret model, so the same possible attack vector that bit RSA.

devicenull on June 8, 2011 [–]

Right, but a compromise of your token for Google's services would not mean your token for your job was compromised as well. You could even generate a new key for each machine you connect to, if you were paranoid enough.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact