4 ms·
That still doesn't answer my question. If you read the guide that I am asking about, it advocates using security keys and also setting up phone TOTP as a backup
by city41 10y ago
That still doesn't answer my question. If you read the guide that I am asking about, it advocates using security keys and also setting up phone TOTP as a backup.
But I also don't need to know too badly, so I think I'll just move on.
- tptacek 10y agoThe subtlety is in how phishing attacks work. If you initiate a login yourself, unbidden by any outside request, the likelihood of you being phished in that scenario is epsilon. In that situation, the TOTP authenticator on your phone is fine. However, if you're logging in as a middle step in a series of steps to get something done (say, answering a request you received via Slack or an email), the likelihood that you could be being phished grows. In those scenarios, the mutual authentication done by the security key helps protect you. The security key is slightly easier to use than the TOTP authenticator and it's what you'll tend to use most of the time. But if you happen to forget it at home or you're logging in to check your mail and your security key is halfway across the house but you have your phone handy or something like that, the TOTP backup option is convenient. You also need some kind of backup in case you lose the security key.
- idlewords 10y agoIf you don't need to know so badly, don't spew misinformation in a public thread.
- city41 10y agoExcuse me? What misinformation did I spew? As far as I know, it's impossible to "spew misinformation" by asking questions.
- tptacek 10y agoDo you understand now why the recommendations are written they way they are? Maybe we can be done discussing now.
- city41 10y agoYes, I am done with this thread. There is no respect here. And just for the record I have no beef with you tptacek. But idlewords stepped out of line.
- tptacek 10y agoI agree with Maciej here: the stock message board "I'm too smart to leave any advice unchallenged" attitudes on these threads are doing a lot of people who face serious risks a lot of harm. If you know what you're talking about and have a serious concern about this kind of advice, by all means present your argument. But if you don't, find another way to learn.