4 ms·
How did you change the two factor authorization codes from Google Authenucator? I think they are needed for crypto sites like Kracken.
by tfmatt 8y ago
How did you change the two factor authorization codes from Google Authenucator? I think they are needed for crypto sites like Kracken.
- Bogdanp 8y agoI never used Google Authenticator. Instead, I use 1Password's 2FA functionality.
- bubblethink 8y agoNot a great idea to combine your first factor and second factor in the same place.
- ggm 8y agoBackup codes and then the protection is against illegal SMS porting which is a social engineering attack hard to otherwise defeat. Your phone is fulfilling a different function and yes it does collapse both factors onto one device but the primary risk wasn't loss of phone, it was weak password and no variant second factor and then porting attacks on SMS.
- bubblethink 8y agoI didn't understand the point your are making. I'm referring to the overall attack surface area of apps like 1password (which I think also have browser extensions ?). TOTP is better than sms, but why put it in the same app as your password ?
- ggm 8y agoYou have to ask yourself what's the primary threat. Yes,the point in strong sense of a second factor is a fully independent test. But the actual threat it mostly protects against is credentials threats. Not loss of devices or compromise of a keystore. SMS as second factor is way way worse because of the porting problem. Otp inside 1password is a compromise but it protects against the primary threat. If you crypt your disk and use a good passphrase or a long pin and passphrase on a phone you are not that badly exposed.
- tonyedgecombe 8y agoDon't you loose the benefit of 2FA then, an adversary only needs to obtain your 1Password password.
- howdy-yall 8y agoI too replaced Google Authenticator with 1Password, for much the same reasons. The Google Analytics tracker in 1Password is concerning though.
- aurbano 8y agoIt's an open standard and many other apps support it. You just need to go to each service where you've set it up and redo it with your new app. I'm now using OTP Auth in iOS, which allows backing up the codes. For me the risks in that are worth being able to easily restore my codes.
- icebraining 8y agoAlternatively, if you use GAuth on Android and you have root, you can backup them up and migrate them yourself (it's just an SQLite file).