4 ms·

The controversy of this tool vs Google Authenticator essentially boils down to how secure your laptop/workstation is vs how secure your phone is. Without being

The controversy of this tool vs Google Authenticator essentially boils down to how secure your laptop/workstation is vs how secure your phone is. Without being purely "conservative", i.e. it was first done on phones therefore it should stay on phones, what are the actual arguments for one vs the other? What do phones have that laptops don't, and vice versa?

deleted 8y ago
[deleted]
lukeschlather 8y ago
In theory, the phone stores the TOTP secret on a TPM that can't be backed up. So the TOTP secret is fundamentally tied to that specific phone. You can't back up the secret, and somebody with brief access to your phone cannot copy it. Even with unlimited access to your phone, it's unlikely anyone can copy the secret. This solution stores the secret in your home directory, which is easily readable by any process that has access to your hard drive. Anyone with brief access to your laptop/workstation can easily copy the secret. If you back up your home directory, anybody with access to your backups has access to the secret.
- YjSe2GMQ 8y ago
  What's a TPM? Is it this? https://en.m.wikipedia.org/wiki/Trusted_Platform_Module https://en.m.wikipedia.org/wiki/Trusted_Platform_Module Again, forgive my ignorance, but do smartphones routinely include TPM chips that Google Authenticator utilizes? Never heard of that before.
  - deleted 8y ago
    [deleted]
  - lukeschlather 8y ago
    Yes, a "Trusted Platform Module." Now that I'm looking around it doesn't look like Google Authenticator actually does this, but it does make it more difficult to copy the TOTP secrets than this 2FA on the command line thing. Though it could and probably should. (Really, this 2FA CLI app could probably do so as well, most modern laptops probably have a TPM.)
dragonwriter 8y ago
> Without being purely "conservative", i.e. it was first done on phones therefore it should stay on phones, what are the actual arguments for one vs the other? What do phones have that laptops don't, and vice versa? People are away from their laptops and exposed to risk of then being stolen without immediate knowledge of that fact more often than the same is true of smartphones, which makes laptops somewhat more of a security risk. Though, I thought that now TOTP in general, on any platform, is at best a second choice after U2F hardware tokens.

deleted 8y ago

[deleted]

lukeschlather 8y ago

In theory, the phone stores the TOTP secret on a TPM that can't be backed up. So the TOTP secret is fundamentally tied to that specific phone. You can't back up the secret, and somebody with brief access to your phone cannot copy it. Even with unlimited access to your phone, it's unlikely anyone can copy the secret. This solution stores the secret in your home directory, which is easily readable by any process that has access to your hard drive. Anyone with brief access to your laptop/workstation can easily copy the secret. If you back up your home directory, anybody with access to your backups has access to the secret.

YjSe2GMQ 8y ago
What's a TPM? Is it this? https://en.m.wikipedia.org/wiki/Trusted_Platform_Module https://en.m.wikipedia.org/wiki/Trusted_Platform_Module Again, forgive my ignorance, but do smartphones routinely include TPM chips that Google Authenticator utilizes? Never heard of that before.
- deleted 8y ago
  [deleted]
- lukeschlather 8y ago
  Yes, a "Trusted Platform Module." Now that I'm looking around it doesn't look like Google Authenticator actually does this, but it does make it more difficult to copy the TOTP secrets than this 2FA on the command line thing. Though it could and probably should. (Really, this 2FA CLI app could probably do so as well, most modern laptops probably have a TPM.)

dragonwriter 8y ago

> Without being purely "conservative", i.e. it was first done on phones therefore it should stay on phones, what are the actual arguments for one vs the other? What do phones have that laptops don't, and vice versa? People are away from their laptops and exposed to risk of then being stolen without immediate knowledge of that fact more often than the same is true of smartphones, which makes laptops somewhat more of a security risk. Though, I thought that now TOTP in general, on any platform, is at best a second choice after U2F hardware tokens.