5 ms·

2FA protects against "password spraying" but that is not really the scariest threat model. The scariest threat model is phishing, and the disadvantage of a TOT

2FA protects against "password spraying" but that is not really the scariest threat model. The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished. The advantage of a token for 2FA is that you don't type it in. It takes human judgment out of the equation. Using NFC to supply the one-time code on an iPhone preserves that advantage. Now, you might not think a phishing threat model is relevant to you, and that's fine. My point is simply that there is a difference between a 2FA code you type in, and a 2FA code that is supplied directly from hardware.

watersb 8y ago
> The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished. I can be fooled into reading a 6-digit PIN to Evil Mallory, a MITM attack. I can be fooled into tapping my NFC auth token on Mallory's Evil Website, and the auth handshake would fail. Or not. It depends on the protocol, I suppose. Is that what you mean?
zaroth 8y ago
I would posit that set of people able to be phished and the set of people willing & able to use a Yubikey are disjoint, or nearly indistinguishably so.
Fnoord 8y ago
I'm not sure which of these is more scariest. It also depends on the user, or their past choices. E.g. I reused passwords before I had a password manager else I couldn't remember all of them. > the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand The main disadvantage is the cost of time. Another disadvantage is that the code can be read by anyone around you. With something physical you got more control over where you keep it, though that also has its disadvantages.

watersb 8y ago

> The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished. I can be fooled into reading a 6-digit PIN to Evil Mallory, a MITM attack. I can be fooled into tapping my NFC auth token on Mallory's Evil Website, and the auth handshake would fail. Or not. It depends on the protocol, I suppose. Is that what you mean?

zaroth 8y ago

I would posit that set of people able to be phished and the set of people willing & able to use a Yubikey are disjoint, or nearly indistinguishably so.

Fnoord 8y ago

I'm not sure which of these is more scariest. It also depends on the user, or their past choices. E.g. I reused passwords before I had a password manager else I couldn't remember all of them. > the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand The main disadvantage is the cost of time. Another disadvantage is that the code can be read by anyone around you. With something physical you got more control over where you keep it, though that also has its disadvantages.