3 ms·

It's not as good as having a hardware key, but they still need your username and password and pwn your phone. That's a lot of trouble. So for most people, TOTP

It's not as good as having a hardware key, but they still need your username and password and pwn your phone. That's a lot of trouble. So for most people, TOTP software is good enough security.

lrvick 10y ago
I agree mobile app 2FA it is probably good enough for most people. This article however is about using a hardware token for login. If you have a need for hardware tokens, use them end to end. Using a hardware token and having a less secure backup method means you are only as secure as that less secure backup method.
- tptacek 10y ago
  That simply isn't true, because the hardware token defends against phishing attacks --- in fact, that is the entire reason why U2F tokens exist in the first place. It's literally the motivating use case for the standard: experts with code generators were still getting phished. So, when you have the token handy, you use it, and you're not exposed to phishing. When you don't, you use the mobile app, and you're exposed to phishing (but not to weak passwords and breaches in sites). It's not complicated, unless you think the token does more than it really does for your overall security.
  - lrvick 10y ago
    I will grant you the phishing use case, and that one is relevant to average users. I admit I mostly work with infra folks that would not easily be phished, but might have one of their devices compromised unknowingly rendering phishing moot. TOTP is a mess in regard to phishing but if we have tools to avoid some of the problems while we are stuck with it, I feel they are worth mentioning. Particularly for people savvy enough to purchase hardware tokens for personal use.
    - tptacek 10y ago
      U2F happened because Google developers were being phished. We are all phishable, probably especially those among us who believe we're not.

3 ms·

It's not as good as having a hardware key, but they still need your username and password and pwn your phone. That's a lot of trouble. So for most people, TOTP

by sametmax 10y ago

It's not as good as having a hardware key, but they still need your username and password and pwn your phone. That's a lot of trouble. So for most people, TOTP software is good enough security.

lrvick 10y ago
I agree mobile app 2FA it is probably good enough for most people. This article however is about using a hardware token for login. If you have a need for hardware tokens, use them end to end. Using a hardware token and having a less secure backup method means you are only as secure as that less secure backup method.
- tptacek 10y ago
  That simply isn't true, because the hardware token defends against phishing attacks --- in fact, that is the entire reason why U2F tokens exist in the first place. It's literally the motivating use case for the standard: experts with code generators were still getting phished. So, when you have the token handy, you use it, and you're not exposed to phishing. When you don't, you use the mobile app, and you're exposed to phishing (but not to weak passwords and breaches in sites). It's not complicated, unless you think the token does more than it really does for your overall security.
  - lrvick 10y ago
    I will grant you the phishing use case, and that one is relevant to average users. I admit I mostly work with infra folks that would not easily be phished, but might have one of their devices compromised unknowingly rendering phishing moot. TOTP is a mess in regard to phishing but if we have tools to avoid some of the problems while we are stuck with it, I feel they are worth mentioning. Particularly for people savvy enough to purchase hardware tokens for personal use.
    - tptacek 10y ago
      U2F happened because Google developers were being phished. We are all phishable, probably especially those among us who believe we're not.