4 ms·

MFA doesn't necessarily mean "1 person = 1 account". TOTP codes can be shared, there can always be copies of the certificates, multiple security devices added t

by Jnr 7y ago

MFA doesn't necessarily mean "1 person = 1 account". TOTP codes can be shared, there can always be copies of the certificates, multiple security devices added to the same profile, etc. It differs from case to case.

Jaruzel 7y ago
Which as I say, all depends on the provider implementing these extra options, in a way that the layperson can use. To me, TOTP means 'Top Of The Pops', I had to Google your acronym! How is Grandma Alice going to be able to manage these extra steps? - It's already taken over 20 years to convince people that 'Password1' is not a good password.
- tolien 7y ago
  Do laypeople know or care about the details of password hashing too, and if not does it matter if they know what TOTP stands for? “Scan this barcode then enter the six digit number from the app; we’ll sometimes ask for the number when you log in” isn’t particularly onerous - 1Password for example will insert your one time pass along with your password so in some cases there isn’t even an extra step to log in. I’d be more worried about people losing/wiping phones and getting locked out of their logins - who needs those backup codes, right?
  - andrewaylett 7y ago
    If your TOTP key is stored in the same place as your password, is it still in any sense a second factor?
    - thameera 7y ago
      As long as it is in a place that you 'have', I believe we can technically count it as MFA. After 1Password introduced MFA (TOTP) support, it has been used widely in organizations in shared vaults so multiple people can share critical logins that use MFA. This of course means that if your 1Password account is compromised it's game over.
    - tolien 7y ago
      That argument surely holds if you’ve got Google Authenticator and 1Password installed on the same device? If someone gets your vault password and can unlock your phone, you’re toast, but SMS as a second factor is then also compromised so what usable (since this thread started as trying to sell MFA to lay people) options do you have (other than maybe a Yubikey)?
      - testvox 7y ago
        I thought Yubikeys and other hardware keys were best practice?
        tolien 7y ago
        They might be a preference but I don’t see how they can be best practice when they’re barely supported on a lot of platforms - Firefox has some support (but doesn’t work with, for example, Github), no/limited support in Safari, no/limited support in mobile devices.
        Natanael_L 7y ago
        WebAuthn (previously U2F) is just now gaining that support and momentum, with support both in Firefox and Android
        tolien 7y ago
        Oh for sure, and if Safari (including iOS) gets support we'll be golden across the board [1] whereas U2F was until recently pretty much Chrome-only [2]. It just can't happen soon enough! 1: https://caniuse.com/#feat=webauthn https://caniuse.com/#feat=webauthn 2: https://caniuse.com/#feat=u2f https://caniuse.com/#feat=u2f
        andrewaylett 7y ago
        U2F on Firefox works well GitHub in my experience; it's Google that's the problem. Mozilla have added a shim to enable login to Google using a key but (due to spec deviance) if you want to add a key you still need to use Chrome :(.
chmars 7y ago
Most users with TOTP assume that TOTP is bound to their app (often Google Authenticator without a backup option / migration path AFAIK). Technically, you are of course fully correct.

by Jnr 7y ago

Jaruzel 7y ago

Which as I say, all depends on the provider implementing these extra options, in a way that the layperson can use. To me, TOTP means 'Top Of The Pops', I had to Google your acronym! How is Grandma Alice going to be able to manage these extra steps? - It's already taken over 20 years to convince people that 'Password1' is not a good password.

tolien 7y ago
Do laypeople know or care about the details of password hashing too, and if not does it matter if they know what TOTP stands for? “Scan this barcode then enter the six digit number from the app; we’ll sometimes ask for the number when you log in” isn’t particularly onerous - 1Password for example will insert your one time pass along with your password so in some cases there isn’t even an extra step to log in. I’d be more worried about people losing/wiping phones and getting locked out of their logins - who needs those backup codes, right?
- andrewaylett 7y ago
  If your TOTP key is stored in the same place as your password, is it still in any sense a second factor?
  - thameera 7y ago
    As long as it is in a place that you 'have', I believe we can technically count it as MFA. After 1Password introduced MFA (TOTP) support, it has been used widely in organizations in shared vaults so multiple people can share critical logins that use MFA. This of course means that if your 1Password account is compromised it's game over.
  - tolien 7y ago
    That argument surely holds if you’ve got Google Authenticator and 1Password installed on the same device? If someone gets your vault password and can unlock your phone, you’re toast, but SMS as a second factor is then also compromised so what usable (since this thread started as trying to sell MFA to lay people) options do you have (other than maybe a Yubikey)?
    - testvox 7y ago
      I thought Yubikeys and other hardware keys were best practice?
      - tolien 7y ago
        They might be a preference but I don’t see how they can be best practice when they’re barely supported on a lot of platforms - Firefox has some support (but doesn’t work with, for example, Github), no/limited support in Safari, no/limited support in mobile devices.
        Natanael_L 7y ago
        WebAuthn (previously U2F) is just now gaining that support and momentum, with support both in Firefox and Android
        tolien 7y ago
        Oh for sure, and if Safari (including iOS) gets support we'll be golden across the board [1] whereas U2F was until recently pretty much Chrome-only [2]. It just can't happen soon enough! 1: https://caniuse.com/#feat=webauthn https://caniuse.com/#feat=webauthn 2: https://caniuse.com/#feat=u2f https://caniuse.com/#feat=u2f
        andrewaylett 7y ago
        U2F on Firefox works well GitHub in my experience; it's Google that's the problem. Mozilla have added a shim to enable login to Google using a key but (due to spec deviance) if you want to add a key you still need to use Chrome :(.

chmars 7y ago

Most users with TOTP assume that TOTP is bound to their app (often Google Authenticator without a backup option / migration path AFAIK). Technically, you are of course fully correct.