3 ms·

No offense, but uh... please read the article? You quoted: including One Time Passwords (OTP)via SMS phone messages The sentence that phrase is lifted from: U

No offense, but uh... please read the article? You quoted: including One Time Passwords (OTP)via SMS phone messages The sentence that phrase is lifted from: U2F is an alternative to other forms of two factor authentication (2FA) including One Time Passwords (OTP)via SMS phone messages. So you either deliberately or carelessly misquoted. What's more, I quote: > Additionally, Google's research found that with OTP based authentication there was an average failure rate of three percent. In contrast, with the U2F Security Key approach, Google experienced zero authentication failures. The improved efficiency of using Security Keys instead of OTP is estimated by Google's support organization to have saved the company thousands of hours per year. And further: > "While any 2-SV mechanism is better than having only a password on your account, FIDO U2F provides strong authentication that's resistant to many forms of advanced phishing attacks that traditional 2-SV doesn't protect against," Brand said. "It also provides for a much better user experience." So no. The headline is not misleading and in fact your hot take and comparison to 1Pass is a misunderstanding. For people curious what these keys look like in the wild, by far the most famous brand name most people in our space would see is Yubico, which you can see here: https://www.yubico.com/products/yubikey-hardware/fido-u2f-security-key/ https://www.yubico.com/products/yubikey-hardware/fido-u2f-se... You _can_ integrate this approach into your product, into your AWS environment, into your Azure environment, or into your linux servers. And it works, and it can be self-hosted if that is a priority for you. Oh, and if you'd like to try the best of ALL THREE WORLDs, LastPass directly supports Yubikey FIDO keys. And also lacks 30s of impromptu vault animations and supports touchid. They're working on facial recognition for Windows as a 3rd factor as well, I'm told. That'll be great.

eridius 10y ago
I did read the article, and if you have to say "no offense", then it's because you're giving offense. The bit you quoted is literally what I quoted, just with more (irrelevant) words quoted at the beginning, so I don't know why you're even accusing me of misquoting anything. The real problem here is the fact that the title of this post was edited multiple times, and now bears very little resemblance to what my comment was responding to. The original title alleged that Google said FIDO U2F Security Keys were better than OTP, without any mention of the fact that the article was only comparing it to SMS-based OTP and therefore the headline was inaccurate because OTP does not mean SMS-based OTP, and I expect (well, I hope) that most commenters here don't even use SMS OTP but instead use TOTP with an app. In any case, I did edit my comment to mention that the title has changed, so the fact that you're saying I'm wrong immediately after accusing me of not reading something is pretty hypocritical.
- KirinDave 10y ago
  Partial quoting an article to the go on to disagree with the core premise and good security will net you no sympathy from me. But the burden is on you to update it make it clear what you're referring to. If you think that this is truly unfair then I apologize for only reading your post and the linked article and not the entire historical context. But I think even without that, you went on to make a point counter the article using article text as if it was a valid counterpoint is wrong.
  - eridius 10y ago
    Partial quoting? I quoted the relevant bit. I may as well accuse you of partial quoting too since you "only" quoted one sentence and not the surrounding sentences. > But the burden is on you to update it make it clear what you're referring to. Not when I can't edit the comment anymore. When I edited my comment to say the title has been changed, the title had just been changed to say "SMS OTP" instead of "OTP", so it was still (I thought) clear what my comment was about. By the time I saw the post had had its more dramatic title change, my comment was past the edit period. And yes, I do think it's unfair that you're accusing me of misquoting and writing an incorrect comment, when my comment was perfectly correct when written, and when it's impossible for me to "fix" it later (not to mention I didn't even know the title had been edited again until I saw your comment). > But I think even without that, you went on to make a point counter the article using article text as if it was a valid counterpoint is wrong. I did not use the article text as if it was a counterpoint. I used the article text to illustrate that the article was talking specifically about SMS OTP, and that the article did not even attempt to address non-SMS-based TOTP. And then gave my own opinion, which is that non-SMS-based TOTP is much better than SMS OTP and has some benefits as compared to a physical U2F device. Since the article didn't even address non-SMS-based TOTP, it can't be a point either for or against that opinion, but what it could be was context.
    - KirinDave 10y ago
      The primary problems with OTPs include input error and expiration windows. These are not fixed by making them push notifications. Further, there are many platforms where push is not an option or were SMS vs Push would not make a difference. So no. Absolutely not. SMS is an additional problem, but OTPs in general suffer from logistic issues separate from their medium.

eridius 10y ago

I did read the article, and if you have to say "no offense", then it's because you're giving offense. The bit you quoted is literally what I quoted, just with more (irrelevant) words quoted at the beginning, so I don't know why you're even accusing me of misquoting anything. The real problem here is the fact that the title of this post was edited multiple times, and now bears very little resemblance to what my comment was responding to. The original title alleged that Google said FIDO U2F Security Keys were better than OTP, without any mention of the fact that the article was only comparing it to SMS-based OTP and therefore the headline was inaccurate because OTP does not mean SMS-based OTP, and I expect (well, I hope) that most commenters here don't even use SMS OTP but instead use TOTP with an app. In any case, I did edit my comment to mention that the title has changed, so the fact that you're saying I'm wrong immediately after accusing me of not reading something is pretty hypocritical.

KirinDave 10y ago
Partial quoting an article to the go on to disagree with the core premise and good security will net you no sympathy from me. But the burden is on you to update it make it clear what you're referring to. If you think that this is truly unfair then I apologize for only reading your post and the linked article and not the entire historical context. But I think even without that, you went on to make a point counter the article using article text as if it was a valid counterpoint is wrong.
- eridius 10y ago
  Partial quoting? I quoted the relevant bit. I may as well accuse you of partial quoting too since you "only" quoted one sentence and not the surrounding sentences. > But the burden is on you to update it make it clear what you're referring to. Not when I can't edit the comment anymore. When I edited my comment to say the title has been changed, the title had just been changed to say "SMS OTP" instead of "OTP", so it was still (I thought) clear what my comment was about. By the time I saw the post had had its more dramatic title change, my comment was past the edit period. And yes, I do think it's unfair that you're accusing me of misquoting and writing an incorrect comment, when my comment was perfectly correct when written, and when it's impossible for me to "fix" it later (not to mention I didn't even know the title had been edited again until I saw your comment). > But I think even without that, you went on to make a point counter the article using article text as if it was a valid counterpoint is wrong. I did not use the article text as if it was a counterpoint. I used the article text to illustrate that the article was talking specifically about SMS OTP, and that the article did not even attempt to address non-SMS-based TOTP. And then gave my own opinion, which is that non-SMS-based TOTP is much better than SMS OTP and has some benefits as compared to a physical U2F device. Since the article didn't even address non-SMS-based TOTP, it can't be a point either for or against that opinion, but what it could be was context.
  - KirinDave 10y ago
    The primary problems with OTPs include input error and expiration windows. These are not fixed by making them push notifications. Further, there are many platforms where push is not an option or were SMS vs Push would not make a difference. So no. Absolutely not. SMS is an additional problem, but OTPs in general suffer from logistic issues separate from their medium.