6 ms·
Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA
by donw 10y ago
Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well.
I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices.
For your critical services, keeping encrypted copies of your backup codes is a must.
- epimenov 10y ago1Password can do 2FA, also syncs between all your devices. And no trusted 3rd party cloud service.
- jonathanoliver 10y agoKeeping all the keys (password and 2FA tokens) in 1Password means it isn't true 2FA anymore: https://blog.agilebits.com/2011/09/23/two-factor-or-not-two-factor/ https://blog.agilebits.com/2011/09/23/two-factor-or-not-two-...
- epimenov 10y agoThey're actually talking about 2FA for 1password itself. Not supporting TOTP via 1password for other services.
- TTPrograms 10y agoNote the hack was in 2012. Hopefully most people have rotated passwords by now.
- ashitlerferad 10y agoAnyone know of automated ways to rotate all the passwords on all of our accounts across the web?
- emillon 10y agoIt's a common feature of password managers.
- whyagaindavid 10y agoHonest question: Why does any none need password managers? Does not chrome password sync or firefox sync do the job? Thanks
- gtufano 10y agoSome of us still use native applications that don't use Chrome or Firefox.
- guitarbill 10y agoTo generate random, strong passwords. Also not to be locked into a browser. Better actual password management (e.g. last changed). Tags. A canary of chrome did have the ability to generate random passwords, but password management in chrome is still a pain IMO. Not sure about FF, but a quick google suggests it doesn't generate random passwords automatically.
- icebraining 10y agoFF doesn't, but as usual, there are addons for that :)
- icebraining 10y agoChrome and Firefox are password managers :) People use other managers for many reasons: storing passwords (and other secrets) which aren't used on a site, using them on different browsers (say, Safari on the desktop and Chrome on mobile) and lack of trust on the browser's password manager. Also, for a long time, browsers didn't save passwords with forms marked with autocomplete=off.
- ashitlerferad 10y agoCan any open source password managers do this?
- diroussel 10y agoNormal people don't rotate passwords unless they are forced to.
- voltagex_ 10y agoI still feel squeamish about Authy having all the tokens - what happens when they get breached?
- donw 10y ago2FA is an extra layer of protection, not a panacea. A successful attack would require both an Authy breach and that the attacker have passwords for the services that they want to compromise. This should buy you enough time to regenerate your 2FA tokens to mitigate the threat.
- danieldk 10y agothis is probably a good time to set up Two-Factor Authentication (2FA) as well. Note: Dropbox also supports U2F for 2FA, which provides much better protection agains phishing. https://blogs.dropbox.com/dropbox/2015/08/u2f-security-keys/ https://blogs.dropbox.com/dropbox/2015/08/u2f-security-keys/
- ascorbic 10y agoIf you use a YubiKey then you can move tokens between devices without needing to trust a third party, nor worry about them somehow being exfiltrated from your phone. https://www.yubico.com/ https://www.yubico.com/
- bluejekyll 10y agoHas anyone had yubikey fail? I have one on my keychain, never an issue in years, but I can't help but be concerned, one day, I will be locked out...
- jethro_tell 10y agoI just have two, if you're doing strictly u2f they are less than $20. I have a nano4 and a neo that I use for u2f, oath tokens, and rsa keys for sign/encrypt/auth. It's not the cheapest setup but it's highly functional and about the best account security I could put together. I lost a gmail account for 45 minutes once and decided that would be much worse then the cost of the keys.
- wrboyce 10y agoI've dropped my YubiKey quite far onto hard ground, dropped it in water, and various other abuses. It seems quite hardwearing.
- jsmthrowaway 10y agoWhen I ran a CA, half of my root key to unlock the more sensitive keys was stored on an older Yubikey on a necklace and it never left my neck. That includes the shower and rolling over on it in bed. I couldn't make that thing fail, and arguably I wanted to based on how I treated it. (Back it up, though.)
- cm2187 10y ago2FA is a major inconvenience. The login process goes from 1-2 sec to 30sec. Sometimes a lot longer (some 2FA do not seem to think it is critical to send the email or txt msg right away, and even when they do, email servers do not really work real time, and then you have the time it takes to find your phone, unlock, decline twice the iOS update prompt, go to the right app, find the right msg, copy the code, check it is correct, etc etc). Yeah if it is really a critical service and rarely used, we should. But if I have to wait 30sec in front of a login box every time I go on netfix or on amazon, you can bet their sales will go down the drain.
- jsmthrowaway 10y agoI have my 2FA in Notification Center and consider this fine given that it's second factor. With that, it's about eight seconds for me involving one slide of my finger. I'm also mystified that you think support for 2FA and mandatory 2FA are the same thing, particularly for something like Netflix.
- cm2187 10y agoI am not arguing about support vs mandatory. Just that I am not convinced 2FA is a compeling alternative. At least the way I see it implemented. I like the idea behind SQRL, which still requires another device, so still inconvenient, but at least it does not rely on the server sending a message through a slow protocol. The website displays a QR code, you launch an app, scan the QR code, this app connects to the server and authenticate you through cryptography. No login or password to type, no message to wait for or to copy manually. No privacy concern since it does not rely on a third party. I could live with that.
- jsmthrowaway 10y agoIf you're discussing sales, you are arguing mandatory. Duo is the counterpoint to 2FA being cumbersome.
- nicky0 10y ago2FA doesn't have to be done over email/SMS. Nearly all websites these days support Google Authenticator protocol enabling use of a wide race of app/devices (for example my Garmin watch) to produce the code. No need to wait for an email/SMS.
- wrboyce 10y agoI have to disagree with the Authy recommendation. I switched to Authy a few years ago, but it was nothing but painful and I have recently migrated away from it. For a long time the "TouchID Prompt" was slow and buggy, but that does appear to be fixed now. The real pain point is that it managed to corrupt one of my keys (how??) and the app tries to get me to backup my keys to their servers with multiple popups (which I cannot disable) prompting me to backup every time I use the app. I don't know why they are so determined to get hold of my OTP keys, but it isn't happening. I'm currently using an app called "OTP Auth" and it seems quite nice, and is quick to use.
- rtpg 10y agoa major advantage is if I throw my phone into the ocean(not a theoretical attack!) I can still recover my OTP on another machine. Authy offers this pretty nicely I would recommend testing theories of : - losing phone - losing computer - losing both and have reasonable backup strategies for these scenarios.
- teach 10y agoI use Google's authenticator on my phone and a 50-line python script on my desktop PC. I store the OTPs in a JSON file and the python script runs them through the TOTP algorithm and spits out my 6-digit code on the console. I'm less worried about losing my "computer" since I don't own a laptop, plus the secrets are backed up using my normal backup process.
- dublinben 10y agoA good 2FA system involves backup keys which can be stored in a safe or safety deposit box, not handing your private key over to a third party.
- gengkev 10y agoIsn't that the point of having backup codes for Google, etc.? I can use those to restore my account, and secure them however I like. Backing up the secrets to a third party makes them vulnerable to anyone who can hack your Authy account. I'm not sure what that requires, possibly hacking a phone number. Of course, there's also a backup password, but then you're just replacing the "physical" factor in 2FA with another password. Without Authy, to compromise my account, you need physical access to my phone, my backup codes, or another backup mechanism I've specified. Authy just provides an additional way to compromise my account, and I don't think it provides any real benefit in exchange for that risk.
- raverbashing 10y agoAnd what happens if 2FA seeds are stolen from the site?
- angry-hacker 10y agoI also recommend authy. Makes 2fa slightly less painful. Not a fault of authy, but namecheap and paypal both don't offer support. I'm especially angry at namecheap because their homegrown 2fa solution is unreliable. Especially when travelling. I'm considering leaving them agter 4 years of promises to support authy but nothing!
- et-al 10y agoUgh, tell me about it. I check this page every now and then and just notice new comments and a response from Evgenia S. that the team is working on it: https://www.namecheap.com/support/knowledgebase/article.aspx/9253/45/how-can-i-enabledisable-twofactor-authentication https://www.namecheap.com/support/knowledgebase/article.aspx... FWIW, Gandi.net supports TOTP, but their prices are a bit higher. However if you only own a handful of domains, the $20/year difference won't really matter.