3 ms·
I did read the article, and if you have to say "no offense", then it's because you're giving offense. The bit you quoted is literally what I quoted, just with m
by eridius 10y ago
I did read the article, and if you have to say "no offense", then it's because you're giving offense. The bit you quoted is literally what I quoted, just with more (irrelevant) words quoted at the beginning, so I don't know why you're even accusing me of misquoting anything.
The real problem here is the fact that the title of this post was edited multiple times, and now bears very little resemblance to what my comment was responding to. The original title alleged that Google said FIDO U2F Security Keys were better than OTP, without any mention of the fact that the article was only comparing it to SMS-based OTP and therefore the headline was inaccurate because OTP does not mean SMS-based OTP, and I expect (well, I hope) that most commenters here don't even use SMS OTP but instead use TOTP with an app.
In any case, I did edit my comment to mention that the title has changed, so the fact that you're saying I'm wrong immediately after accusing me of not reading something is pretty hypocritical.
- KirinDave 10y agoPartial quoting an article to the go on to disagree with the core premise and good security will net you no sympathy from me. But the burden is on you to update it make it clear what you're referring to. If you think that this is truly unfair then I apologize for only reading your post and the linked article and not the entire historical context. But I think even without that, you went on to make a point counter the article using article text as if it was a valid counterpoint is wrong.
- eridius 10y agoPartial quoting? I quoted the relevant bit. I may as well accuse you of partial quoting too since you "only" quoted one sentence and not the surrounding sentences. > But the burden is on you to update it make it clear what you're referring to. Not when I can't edit the comment anymore. When I edited my comment to say the title has been changed, the title had just been changed to say "SMS OTP" instead of "OTP", so it was still (I thought) clear what my comment was about. By the time I saw the post had had its more dramatic title change, my comment was past the edit period. And yes, I do think it's unfair that you're accusing me of misquoting and writing an incorrect comment, when my comment was perfectly correct when written, and when it's impossible for me to "fix" it later (not to mention I didn't even know the title had been edited again until I saw your comment). > But I think even without that, you went on to make a point counter the article using article text as if it was a valid counterpoint is wrong. I did not use the article text as if it was a counterpoint. I used the article text to illustrate that the article was talking specifically about SMS OTP, and that the article did not even attempt to address non-SMS-based TOTP. And then gave my own opinion, which is that non-SMS-based TOTP is much better than SMS OTP and has some benefits as compared to a physical U2F device. Since the article didn't even address non-SMS-based TOTP, it can't be a point either for or against that opinion, but what it could be was context.
- KirinDave 10y agoThe primary problems with OTPs include input error and expiration windows. These are not fixed by making them push notifications. Further, there are many platforms where push is not an option or were SMS vs Push would not make a difference. So no. Absolutely not. SMS is an additional problem, but OTPs in general suffer from logistic issues separate from their medium.