4 ms·
It completely blows my mind that blizzard got it right over a decade ago with a dedicated physical device that would generate a one-time, time sensitive key for
by schaefer 8y ago
It completely blows my mind that blizzard got it right over a decade ago with a dedicated physical device that would generate a one-time, time sensitive key for second factor authentication (to protect my video game account).
Where as I feel I'm still waiting for my bank (actual money) to catch up. they took the easy way out by sms-ing me a second factor authentication key. Even though phone number theft is a known attack vector.
- untog 8y agoMy bank did that, maybe a decade ago. It was pretty inconvenient any time I wanted to access my bank account away from home. SMS is a godsend by comparison.
- village-idiot 8y agoU2F keys are ideal in this regard. You typically have your keys with you. The only weakness is that not enough apps incorporate u2f over nfc.
- spydum 8y agoThe thing that is nutty is.. they PAY MONEY for the SMS method! I do not understand why more sites don't support TOTP like Google Authenticator.
- spiritcat 8y agoGoogle authentication is great, until it's time to get a new phone.
- XorNot 8y agoI store my totp secrets in keepass with everything else and synchronise it to my other devices. This probably undermines the idea - but phones get lost/destroyed/wiped regularly.
- sethhochberg 8y agoCheck out Authenticator Plus - its another TOTP app that lets you backup your (encypted) 2FA secrets and optionally syncs them across devices. Thankfully Google Authenticator is just TOTP, so you can use whatever client you want.
- jammygit 8y agoThanks for the tip, I only knew about authy before
- witten 8y agoAlso, check out andOTP on F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ https://f-droid.org/en/packages/org.shadowice.flocke.andotp/ Open source and supports backups.
- StavrosK 8y agoandOTP is amazing, I thoroughly recommend it.
- otachack 8y agoHad no idea about this. I liked Google's Auth since it was simple but it missed the crucial backup feature. Authy is nice but you're putting trust in a 3rd party that doesn't have a channel for donations, though it seems they're making money through SMS (Twilio). andOTP is just what I was looking for since it's FOSS and had backup! This would have been a lifesaver when I lost my phone but glad to have run into it now.
- peterwwillis 8y agoTOTP is old and busted, U2F is the new hotness. https://en.m.wikipedia.org/wiki/Universal_2nd_Factor https://en.m.wikipedia.org/wiki/Universal_2nd_Factor
- slezyr 8y ago> The device key is secured against duplication by a degree of social trust in the commercial manufacturer TOTP sounds much better. Also doesn't requires "trusted magic hardware"
- Godel_unicode 8y agoPrint out the QR code and store it in a safe.
- lcabral 8y agoA while back because of shifting mobiles a lot ( due to repairing my mobile and also having a temporary replacement) I ended up making a rudimentary program to store shows codes and even qrcodes for reading from the mobile working in my Linux terminal. https://github.com/lcabral37/terminalOathApp https://github.com/lcabral37/terminalOathApp It did the work and even today I use it every now and then, instead of pulling out the mobile.
- JofArnold 8y agoIf you have 1Password it supports OTP and thus can be used across devices.
- jackweirdy 8y agoWhenever discussing this with colleagues there’s always been a bit of debate about whether OTP inside 1password constitutes 2FA or not. On the one hand a password could be popped from the target site or phishing, and you’d still need the 2nd factor from 1password to get in. But on the other hand, if you leave your phone lying around unlocked with a poor master password, both get popped together.
- IMcPwn 8y agoIf you leave your phone unlocked with Google Authenticator / SMS 2fa and a weak master password, you still get popped. The only difference to me in convenience of 2fa code auto fill.
- GoMonad 8y agoLastPass has this too I think. But something seems off to me storing my 2FA with the service that manages my first factor. YubiKeys can store and access OTP secrets. I put the secret in both Google Authenticator and my YubiKeys as backup.
- SomeHacker44 8y agoLastpass categorically does not have this. We could find no way to use it to share TOTP among administrators for a root account for example. They refused a refund as well. Horrifically bad company customer service, UX, UI. Save yourself the trouble and skip them, call 1Password.
- Daniel_sk 8y ago1Password can store 2FA and will auto-fill them on desktop and mobile.
- zrail 8y agoI do this too. I guess it sort of undermines the idea of a second factor but the only way someone could get at it would be to break into my 1Password account, which seems unlikely.
- jjeaff 8y agoGoogle authenticator allows you to transfer all your codes to a new phone and that includes if you lost your old phone. So they must be backing up to your Google account.
- bubblethink 8y agoDo you have a source on this ? I don't think google authenticator backs up by design, and that's good.
- antihero 8y agoThis is why it's best to use something like Authy
- everybodyknows 8y agoSome financial providers offer a 2FA choice at login that includes email. The 2FA email can be directed to an account protected by a hardware key.
- iheartpotatoes 8y agoagreed: my investment bank (real "real" money) finally started offering an authenticator (that adds random numbers to your password every login) two years ago. i worked at a major semiconductor company in the late 1990's and to use their VPN from home you needed an authenticator fob. eventually this was replaced with a password, but hardware fobs (& parellel port dongles) have been around since at least the 80's. astonishing this has taken so long. although i still have trouble understanding how to best protect myself against MYSELF. I'm just now getting my head around multiple yubikeys and subkeys in case i get locked out.
- JulianMorrison 8y agoBarclays has the slot-your-card in pin sentry gadgets. Those are quite nifty. They don't need to be personal, because they take their pin from the bank card. So they can just hand them out.
- rando444 8y agoMy bank used to do the tokens until some mathematician reverse engineered the algorithm proving it insecure. They've now moved on to certificates on your phone. You go to the bank, prove your identity, they sms you a certificate. When you choose electronic authentication on the website you get a popup on your phone to accept. You put in a password and it validates the cert on your phone and sends the response to the website. All without having to install anything.
- parliament32 8y agoMy first experience with 2FA was the Paypal Security Key[1]. Unfortunately it's proprietary, and to this day, they only support it or SMS for 2FA. It would be great if everyone adopted TOTP, I'm up to a dozen sites in Authy and it's fantastic. Still waiting for my actual banks to support it though. [1] https://i.imgur.com/ABcZXrP.jpg https://i.imgur.com/ABcZXrP.jpg
- segmondy 8y agoIt's nothing new, I was using and also admin for RSA token 20 years ago.