Physically secured versus low security [LWN.net]

Physically secured versus low security

Posted Aug 12, 2026 11:09 UTC (Wed) by farnz (subscriber, #17727)
In reply to: Why not let the administrator decide? by rgmoore
Parent article: Changes in shadow-utils password-expiration features

Note that to make this a workable position, you need to account for physical security as part of "authentication"; while I authenticate to a server console with just a password, that's OK because physical access to that server is secured, and no-one can get physical access to the server. From one perspective, this is password-only authentication (since all the digital side can see is a password), but from a wider perspective, it's password + physical access.

Otherwise, you end up risking a silly loop - my Yubikey (for example) only authenticates me by a password, which can imply that use of the Yubikey for U2F is a "low security application" since it's password-only authentication to the Yubikey.

to post comments

Physically secured versus low security

Posted Aug 12, 2026 17:11 UTC (Wed) by rgmoore (✭ supporter ✭, #75) [Link] (1 responses)

Note that to make this a workable position, you need to account for physical security as part of "authentication"

Absolutely. If you have good physical security and can distinguish someone logging in locally from someone coming in over a network, it completely makes sense to treat being physically present as a form of authentication. My employer does something like that. We nominally require 2FA for everything, but if you're detected to be on-site, the step where you have to produce a time-based authentication code is skipped.

Otherwise, you end up risking a silly loop - my Yubikey (for example) only authenticates me by a password, which can imply that use of the Yubikey for U2F is a "low security application" since it's password-only authentication to the Yubikey.

Possessing a physical device and knowing a password is a classic example of 2FA. Forms of authentication that people usually talk about are something you have (like a physical token), something you know (like a password), and something you are (i.e. a biometric). The idea with 2FA is that you require two different categories so someone who wants to compromise your security needs to overcome two different kinds of obstacle. For example, your Yubikey still counts because someone who wants to bypass your security needs to learn your password and get physical access to your key.

Physically secured versus low security

Posted Aug 13, 2026 9:03 UTC (Thu) by farnz (subscriber, #17727) [Link]

Possessing a physical device and knowing a password is a classic example of 2FA. Forms of authentication that people usually talk about are something you have (like a physical token), something you know (like a password), and something you are (i.e. a biometric). The idea with 2FA is that you require two different categories so someone who wants to compromise your security needs to overcome two different kinds of obstacle. For example, your Yubikey still counts because someone who wants to bypass your security needs to learn your password and get physical access to your key.

Indeed; but if you ignore the physical security aspect, my Yubikey protected by a password and my actual password boils down to just two passwords, and if we're saying that passwords are only for low security applications, that's just two methods only suitable for low security applications.

The thing that makes my Yubikey a useful second factor is that the physical security of my Yubikey is good enough for the applications I have for it (it lives with my keys, and I cannot go 24 hours without noticing if it's gone missing as a result); in practice, therefore, the Yubikey is a second factor because of the physical security.

Similar thoughts apply to a strong password written down on a note in my wallet - yes, that's "less secure" than the same password memorized, but it's a heck of a lot more secure than a Google employee using "Google1600 AmphitheatreParkwayMountainViewCA94043" as a "memorable" password (company name and HQ location).