3 ms·

I'm happy with Authy and TOTP, for the moment. Getting a YubiKey has been on my to-do list for awhile, but I'm not sure that everything I currently have 2FA for

I'm happy with Authy and TOTP, for the moment. Getting a YubiKey has been on my to-do list for awhile, but I'm not sure that everything I currently have 2FA for will accept it. In which case, I don't like the idea of half-migrating to Yubikey while still having to keep Authenticator around.

tptacek 10y ago
Pretty much everyone I've talked to that uses a YK has the same configuration I do, by priority: 1. Security key 2. TOTP via phone authenticator app 3. Offsite saved backup keys (4.) Disable SMS This implies two things: first, that for pretty much every site you rely on, you're going to be both TOTP and U2F anyways, and second, that sites that don't support U2F yet will just start at step 2. U2F is more convenient than TOTP and, because you're virtually never going to actually use it on a site you U2F into, U2F is still mitigating the phishing risk. You're carrying your phone with you anyways. It's pretty much win-win.
nickik 10y ago
You can use your Yubikey + Yubico Authenticater to replace Authy. It does not add that much security, but you add device switch ability without Cloud Sync.
- edraferi 10y ago
  I had a lot of problems with Yubico Authenticator. Wound up switching back to a generic app.
  - nickik 10y ago
    What problems? I used to not have any, but since a short time it has issues with unlocking when I get NFC connection. I have to restart it sometimes.
    - edraferi 10y ago
      Yeah the NFC on my Yubico has burnt out. Or something. Regardless, Yubico Authenticator just flat-out didn't work for me. I got it running, loaded some codes, and then the codes didn't work again. It was like it lost synchronization with the server clock or something. I had the same issues on Android and MacOS. Maybe I could have sorted it, but I lost interest before finding a definitive fix.

3 ms·

I'm happy with Authy and TOTP, for the moment. Getting a YubiKey has been on my to-do list for awhile, but I'm not sure that everything I currently have 2FA for

by AdmiralAsshat 10y ago

tptacek 10y ago
Pretty much everyone I've talked to that uses a YK has the same configuration I do, by priority: 1. Security key 2. TOTP via phone authenticator app 3. Offsite saved backup keys (4.) Disable SMS This implies two things: first, that for pretty much every site you rely on, you're going to be both TOTP and U2F anyways, and second, that sites that don't support U2F yet will just start at step 2. U2F is more convenient than TOTP and, because you're virtually never going to actually use it on a site you U2F into, U2F is still mitigating the phishing risk. You're carrying your phone with you anyways. It's pretty much win-win.
nickik 10y ago
You can use your Yubikey + Yubico Authenticater to replace Authy. It does not add that much security, but you add device switch ability without Cloud Sync.
- edraferi 10y ago
  I had a lot of problems with Yubico Authenticator. Wound up switching back to a generic app.
  - nickik 10y ago
    What problems? I used to not have any, but since a short time it has issues with unlocking when I get NFC connection. I have to restart it sometimes.
    - edraferi 10y ago
      Yeah the NFC on my Yubico has burnt out. Or something. Regardless, Yubico Authenticator just flat-out didn't work for me. I got it running, loaded some codes, and then the codes didn't work again. It was like it lost synchronization with the server clock or something. I had the same issues on Android and MacOS. Maybe I could have sorted it, but I lost interest before finding a definitive fix.