3 ms·
Let's say a service you still use loses a database backup from 2 years ago, and they don't realize it was lost. Scenario 1: The service stored passwords in som
by jjnoakes 8y ago
Let's say a service you still use loses a database backup from 2 years ago, and they don't realize it was lost.
Scenario 1: The service stored passwords in some way and TOTP seeds in the database and uses TOTP to authenticate users.
Scenario 2: The service stored passwords in some way and uses some other 2FA mechanism (like unique codes over some secure channel)
You seem to be claiming there is no different between the two, where as I think I'd prefer scenario 2, because in scenario 1, if my password is obtained somehow (the password was not stored securely, I used a weak password, credential stuffing matched my password from other site leaks against the email in this database leak, or any other way) then the attacker can log in to my account on the service right now and bypass TOTP 2FA. In scenario 2, 2FA is still protecting my account.
- tptacek 8y agoI'm saying there is no practical difference between the two, because there isn't. You can keep layering feature after feature on any part of your security model, but time and energy is finite, and complexity adds risk, and burning time, energy, and complexity on this is bad engineering.
- jjnoakes 8y agoI disagree with "no practical difference" (since I demonstrated one), and layered approaches to security are usually encouraged, not dismissed as "bad engineering". Regardless, I will keep this 2FA difference in mind going forward, since it is interesting to me; of course, you (and others) are free to ignore my thoughts if you so choose.