6 ms·

If you want me to swap from SMS two-factor you need to come up with something that’s as easy to use and restore when I drop my phone in the toilet, change my em

If you want me to swap from SMS two-factor you need to come up with something that’s as easy to use and restore when I drop my phone in the toilet, change my email and what other silly user mistakes I’ve lost my f2as to.

davchana 9y ago
I always save the key & qr code when setting up 2fa, in a seperate not-frequently-accessed keepass db. that way, when/if I change phone, I can re-set up the 2fa same as before,vfrom same qr codes and/or keys.
- raulpopa 9y ago
  You can use this app to both keep those keys safely and as a desktop alternative. Your OTP codes/&secret keys are protected with your typing pattern. https://chrome.google.com/webstore/detail/typingdna-authenticator/gmohoglkppnemohbcgjakmgengkeaphi https://chrome.google.com/webstore/detail/typingdna-authenti...
- QasimK 9y ago
  I’m a bit different in that I only save the backup code to the separate KeePass DB. I hadn’t even considered saving the key/QR code to it, which seems just as secure as what I do now.
  - davchana 9y ago
    Is it not that by each backup code, you can enter into account only once, whereas by key and/or qr code, you can essentially setup a new device to provide TOTP?
    - QasimK 9y ago
      Well the backup code is for emergency situations (ie. to set up your replacement device and get a new backup code)! Sometimes they give you more than 1, E.g. Google gives 10. I have had the worry though, imagine using it and your PC crashing immediately..
matt_wulfeck 9y ago
Phone I get but not email. I don’t think I can ever permanently close my email at this point. The problem is 2FA is used to protect my email!
- wil421 9y ago
  Well I have a few account myself and one with my wife. My wife also has two accounts and one of them she created after we got married with my last name. I can keep my 2fa straight but I know she can’t. I’d bet there are similar people out there. The solution needs to be elegant enough to support all degrees of tech knowledge and even people who are forgetful, accident prone, etc.
notheguyouthink 9y ago
I know it's not easy for grandmas/etc, but I personally love classic TOTP solution. It's stupidly simple to backup[1], works on all my devices - even my desktop if I want, and is completely secure[2]. It's a shame so many people have no clue you can (and should, imo!) backup your TOTP key. [1]: just copy the string and store it however you want. [2]: as far as I'm aware. I'm not a security professional, of course.
- faitswulff 9y ago
  For anyone else who was wondering: "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time." https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...
  - notheguyouthink 9y ago
    Yea sorry, I should have included a explanation - I used it instead of Google Auth to remove any implied involvement with Google. Appreciate your annotation!
- saganus 9y ago
  Whenever a 2FA or TOTP article comes out, I ask if anyone knows of a hardware dongle/token/card that can store several TOTP keys so that I can stop using my phone for 2FA (e.g. Google Authenticator). I've only found the Protectimus Slim NFC [0], which would be my ideal solution except it only holds 1 key. If it could save say, 100 keys (or even 50 maybe?), I would buy 3 or 4 in a heartbeat. It would be great to have stronger 2FA than SMS, but with the peace of mind of not having to worry about the phone. I'm definitely not a hardware guy, but I can't believe such a solution doesn't exist yet. It doesn't seem like it would be hard to build, right? I mean, you just need a very simple processor, a real-time clock, a display and an NFC module for reprogramming (or maybe micro-usb?). Does anyone know of any products like the Protectimus but supporting multiple keys? [0] https://www.protectimus.com/protectimus-slim-mini https://www.protectimus.com/protectimus-slim-mini
mtgx 9y ago
No to worry, the US carriers are here to save (or destroy) the day and replace SMS 2FA with another NSA and hacker-friendly solution that's even easier to use than SMS 2FA: http://about.att.com/story/att_sprint_tmobile_and_verizon_unveil_next_generation_mobile_authentication_platform_details.html http://about.att.com/story/att_sprint_tmobile_and_verizon_un... So if that's more your cup of tea for security, then you'll be well covered.
AdmiralAsshat 9y ago
I eventually switched away from Google Authenticator to Authy because I found it incredibly frustrating that Google wouldn't let you migrate 2FA codes between devices (then, to add insult to injury, they let you migrate your Google token, and only your Google token). Authy has worked well for me so far, having migrated phones twice since then. I've also got it on a backup tablet just to make sure I'm never completely locked out if something goes wrong. But for the security-paranoid, I understand that letting a cloud service store your 2FA tokens is suspect, even if it's password-protected. Steve Gibson suggests the alternative: when the site generates the QR code, take a picture of it, print the picture out, keep it in your safety deposit box. When you change phones, pull the QR codes out and re-scan them.
- raulpopa 9y ago
  Here is something you could try too, Chrome based Authenticator protected with your typing pattern as 2FA: https://chrome.google.com/webstore/detail/typingdna-authenticator/gmohoglkppnemohbcgjakmgengkeaphi https://chrome.google.com/webstore/detail/typingdna-authenti...
- gonvaled 9y ago
  Interesting. I have been researching how to dump the database of google authenticator (currently over 20 entries, some non recoverable), but the solution involves rooting my android phone and accessing a protected sqlite file, with a propietary (and version dependent) schema. I am not going to do that. Does authy have the same workflow a google authenticator? Can I add entries with QR code? With ID? Can I dump the database in plaintext? (the IDs) Can it generate QRs for scanning with other 2fa tools? Edit: ah, it's an online service. That kills it for me.
  - CodeWriter23 9y ago
    1Password captures and stores TOTPs, even copies the current OTP into your clipboard momentarily when you log in to a site. You don’t have to use their online service; you can keep the password vault in a file. You can sync your devices over LAN and WiFi.
cyphar 9y ago
KeePassXC supports TOTP, so you can store the seed with the rest of your password database (whether you think this is a good idea depends on what your threat model is for 2FA).
- notheguyouthink 9y ago
  As an aside, Keepass is what I use for TOTP backups. I keep them in an offline backup(s), since they have no real need to be kept online at all times (like normal passwords/etc).
  - cyphar 9y ago
    I don't have a smartphone (opting instead for a dumbphone), so my only option is to use KeePassXC.
djhworld 9y ago
This. Recently I had to send my phone away for repairs, and as instructed, they told me to reset the phone to factory defaults before mailing them the device. I forgot about Google Authenticator during this process so ended up having to reset everything/go through recovery procedures across all my accounts. With SMS it almost seems stateless, the only thing you need is access to a signal. That's the biggest advantage in my opinion, but given the risks I'd be open to ideas that are not just "download an app onto your phone"
- Piskvorrr 9y ago
  That's, counterintuitively, security working well and as designed. It's not as convenient, you mean? Indeed - and it would be far more inconvenient to an attacker, which is the entire point.

davchana 9y ago

I always save the key & qr code when setting up 2fa, in a seperate not-frequently-accessed keepass db. that way, when/if I change phone, I can re-set up the 2fa same as before,vfrom same qr codes and/or keys.

raulpopa 9y ago
You can use this app to both keep those keys safely and as a desktop alternative. Your OTP codes/&secret keys are protected with your typing pattern. https://chrome.google.com/webstore/detail/typingdna-authenticator/gmohoglkppnemohbcgjakmgengkeaphi https://chrome.google.com/webstore/detail/typingdna-authenti...
QasimK 9y ago
I’m a bit different in that I only save the backup code to the separate KeePass DB. I hadn’t even considered saving the key/QR code to it, which seems just as secure as what I do now.
- davchana 9y ago
  Is it not that by each backup code, you can enter into account only once, whereas by key and/or qr code, you can essentially setup a new device to provide TOTP?
  - QasimK 9y ago
    Well the backup code is for emergency situations (ie. to set up your replacement device and get a new backup code)! Sometimes they give you more than 1, E.g. Google gives 10. I have had the worry though, imagine using it and your PC crashing immediately..

matt_wulfeck 9y ago

Phone I get but not email. I don’t think I can ever permanently close my email at this point. The problem is 2FA is used to protect my email!

wil421 9y ago
Well I have a few account myself and one with my wife. My wife also has two accounts and one of them she created after we got married with my last name. I can keep my 2fa straight but I know she can’t. I’d bet there are similar people out there. The solution needs to be elegant enough to support all degrees of tech knowledge and even people who are forgetful, accident prone, etc.

notheguyouthink 9y ago

I know it's not easy for grandmas/etc, but I personally love classic TOTP solution. It's stupidly simple to backup[1], works on all my devices - even my desktop if I want, and is completely secure[2]. It's a shame so many people have no clue you can (and should, imo!) backup your TOTP key. [1]: just copy the string and store it however you want. [2]: as far as I'm aware. I'm not a security professional, of course.

faitswulff 9y ago
For anyone else who was wondering: "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time." https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...
- notheguyouthink 9y ago
  Yea sorry, I should have included a explanation - I used it instead of Google Auth to remove any implied involvement with Google. Appreciate your annotation!
saganus 9y ago
Whenever a 2FA or TOTP article comes out, I ask if anyone knows of a hardware dongle/token/card that can store several TOTP keys so that I can stop using my phone for 2FA (e.g. Google Authenticator). I've only found the Protectimus Slim NFC [0], which would be my ideal solution except it only holds 1 key. If it could save say, 100 keys (or even 50 maybe?), I would buy 3 or 4 in a heartbeat. It would be great to have stronger 2FA than SMS, but with the peace of mind of not having to worry about the phone. I'm definitely not a hardware guy, but I can't believe such a solution doesn't exist yet. It doesn't seem like it would be hard to build, right? I mean, you just need a very simple processor, a real-time clock, a display and an NFC module for reprogramming (or maybe micro-usb?). Does anyone know of any products like the Protectimus but supporting multiple keys? [0] https://www.protectimus.com/protectimus-slim-mini https://www.protectimus.com/protectimus-slim-mini

mtgx 9y ago

No to worry, the US carriers are here to save (or destroy) the day and replace SMS 2FA with another NSA and hacker-friendly solution that's even easier to use than SMS 2FA: http://about.att.com/story/att_sprint_tmobile_and_verizon_unveil_next_generation_mobile_authentication_platform_details.html http://about.att.com/story/att_sprint_tmobile_and_verizon_un... So if that's more your cup of tea for security, then you'll be well covered.

AdmiralAsshat 9y ago

I eventually switched away from Google Authenticator to Authy because I found it incredibly frustrating that Google wouldn't let you migrate 2FA codes between devices (then, to add insult to injury, they let you migrate your Google token, and only your Google token). Authy has worked well for me so far, having migrated phones twice since then. I've also got it on a backup tablet just to make sure I'm never completely locked out if something goes wrong. But for the security-paranoid, I understand that letting a cloud service store your 2FA tokens is suspect, even if it's password-protected. Steve Gibson suggests the alternative: when the site generates the QR code, take a picture of it, print the picture out, keep it in your safety deposit box. When you change phones, pull the QR codes out and re-scan them.

raulpopa 9y ago
Here is something you could try too, Chrome based Authenticator protected with your typing pattern as 2FA: https://chrome.google.com/webstore/detail/typingdna-authenticator/gmohoglkppnemohbcgjakmgengkeaphi https://chrome.google.com/webstore/detail/typingdna-authenti...
gonvaled 9y ago
Interesting. I have been researching how to dump the database of google authenticator (currently over 20 entries, some non recoverable), but the solution involves rooting my android phone and accessing a protected sqlite file, with a propietary (and version dependent) schema. I am not going to do that. Does authy have the same workflow a google authenticator? Can I add entries with QR code? With ID? Can I dump the database in plaintext? (the IDs) Can it generate QRs for scanning with other 2fa tools? Edit: ah, it's an online service. That kills it for me.
- CodeWriter23 9y ago
  1Password captures and stores TOTPs, even copies the current OTP into your clipboard momentarily when you log in to a site. You don’t have to use their online service; you can keep the password vault in a file. You can sync your devices over LAN and WiFi.

cyphar 9y ago

KeePassXC supports TOTP, so you can store the seed with the rest of your password database (whether you think this is a good idea depends on what your threat model is for 2FA).

notheguyouthink 9y ago
As an aside, Keepass is what I use for TOTP backups. I keep them in an offline backup(s), since they have no real need to be kept online at all times (like normal passwords/etc).
- cyphar 9y ago
  I don't have a smartphone (opting instead for a dumbphone), so my only option is to use KeePassXC.

djhworld 9y ago

This. Recently I had to send my phone away for repairs, and as instructed, they told me to reset the phone to factory defaults before mailing them the device. I forgot about Google Authenticator during this process so ended up having to reset everything/go through recovery procedures across all my accounts. With SMS it almost seems stateless, the only thing you need is access to a signal. That's the biggest advantage in my opinion, but given the risks I'd be open to ideas that are not just "download an app onto your phone"

Piskvorrr 9y ago
That's, counterintuitively, security working well and as designed. It's not as convenient, you mean? Indeed - and it would be far more inconvenient to an attacker, which is the entire point.