3 ms·

This is really good stuff. I think the only thing I'd add is that, if you're building a login system anew, you should do 2-factor, and you should not use SMS co

This is really good stuff. I think the only thing I'd add is that, if you're building a login system anew, you should do 2-factor, and you should not use SMS codes. Use phone authenticator apps (time-based OTP's), FIDO U2F, heck, even Smartcards if you're paranoid. The best implementations I see are the ones that allow both phone authenticator apps for the people who don't want to carry a keyfob around or need to log in via their phones, and U2F for people who want their physical factor separate from their phone.

tialaramex 8y ago
OTPs are phishable. If you worry about SMS codes, you shouldn't accept OTP either, bad guys are just going to socially engineer your user into giving them a valid code. FIDO is the way forward, but having run into Microsoft's hapless first attempt (since they managed to get it to not work in anything except Edge on specific builds of Windows they also made it optional, so it actually can't make your security better. Brilliant) I have less confidence it'll ever be useful to the ordinary person... Still, it does protect my Google account.
- munchbunny 8y ago
  Phone based TOTP's are vulnerable to real-time phishing, but they still require you to sit there and enter the number on your phone. It still has to be your phone. That's not ideal, but that's substantially better than SMS where someone can take your phone number and your second factor is gone. No real-time requirement. That makes phone based TOTP the most secure second factor that is pretty much universally accessible to lay users (i.e. not buying a dedicated second factor device, and most people have smartphones). FIDO U2F isn't quite there yet in terms of universal support, but its design is definitely promising from a usability perspective. It's one technology I'm willing to hold my breath for.

3 ms·

This is really good stuff. I think the only thing I'd add is that, if you're building a login system anew, you should do 2-factor, and you should not use SMS co

by munchbunny 8y ago

tialaramex 8y ago
OTPs are phishable. If you worry about SMS codes, you shouldn't accept OTP either, bad guys are just going to socially engineer your user into giving them a valid code. FIDO is the way forward, but having run into Microsoft's hapless first attempt (since they managed to get it to not work in anything except Edge on specific builds of Windows they also made it optional, so it actually can't make your security better. Brilliant) I have less confidence it'll ever be useful to the ordinary person... Still, it does protect my Google account.
- munchbunny 8y ago
  Phone based TOTP's are vulnerable to real-time phishing, but they still require you to sit there and enter the number on your phone. It still has to be your phone. That's not ideal, but that's substantially better than SMS where someone can take your phone number and your second factor is gone. No real-time requirement. That makes phone based TOTP the most secure second factor that is pretty much universally accessible to lay users (i.e. not buying a dedicated second factor device, and most people have smartphones). FIDO U2F isn't quite there yet in terms of universal support, but its design is definitely promising from a usability perspective. It's one technology I'm willing to hold my breath for.