Popular posts

It really isn't good advice though. Having offline generators and rings is a good idea. I suggested using 2FA and a Yubikey for exactly the same reason. Simply adding a bit of complexity to the "what you know" factor doesn't add much security because the means of compromise of one mean the other is also likely compromised, as well as some other problems I mentioned in my own main post.

AJ Henderson As you correctly point out, just having a scheme to create randomness, plus a mentally-remembered 'horcrux' isn't 2FA. It serves only to keep full passwords from residing in one place.

My widgets were specifically created for people who are techno-phobic, who in my experience were resistant to using any sort of software wallet solution -- at least it gets them to stop using the same password or a trivial variant thereof, across all their accounts...

As always, defense-in-depth is important; each measure can serve to incrementally improve security.

R. M. yeah, to be clear, I think your devices are a good idea. My point was mostly that this original post isn't really that useful of an idea. Much better to harden the password storage instead, which is exactly what an offline device does for you.