Physically secured versus low security

Physically secured versus low security

Note that to make this a workable position, you need to account for physical security as part of "authentication"

Absolutely. If you have good physical security and can distinguish someone logging in locally from someone coming in over a network, it completely makes sense to treat being physically present as a form of authentication. My employer does something like that. We nominally require 2FA for everything, but if you're detected to be on-site, the step where you have to produce a time-based authentication code is skipped.

Otherwise, you end up risking a silly loop - my Yubikey (for example) only authenticates me by a password, which can imply that use of the Yubikey for U2F is a "low security application" since it's password-only authentication to the Yubikey.

Possessing a physical device and knowing a password is a classic example of 2FA. Forms of authentication that people usually talk about are something you have (like a physical token), something you know (like a password), and something you are (i.e. a biometric). The idea with 2FA is that you require two different categories so someone who wants to compromise your security needs to overcome two different kinds of obstacle. For example, your Yubikey still counts because someone who wants to bypass your security needs to learn your password and get physical access to your key.

Note: you can avoid this step in the future by logging into your LWN account.