3 ms·
That argument surely holds if you’ve got Google Authenticator and 1Password installed on the same device? If someone gets your vault password and can unlock yo
by tolien 7y ago
That argument surely holds if you’ve got Google Authenticator and 1Password installed on the same device?
If someone gets your vault password and can unlock your phone, you’re toast, but SMS as a second factor is then also compromised so what usable (since this thread started as trying to sell MFA to lay people) options do you have (other than maybe a Yubikey)?
- testvox 7y agoI thought Yubikeys and other hardware keys were best practice?
- tolien 7y agoThey might be a preference but I don’t see how they can be best practice when they’re barely supported on a lot of platforms - Firefox has some support (but doesn’t work with, for example, Github), no/limited support in Safari, no/limited support in mobile devices.
- Natanael_L 7y agoWebAuthn (previously U2F) is just now gaining that support and momentum, with support both in Firefox and Android
- tolien 7y agoOh for sure, and if Safari (including iOS) gets support we'll be golden across the board [1] whereas U2F was until recently pretty much Chrome-only [2]. It just can't happen soon enough! 1: https://caniuse.com/#feat=webauthn https://caniuse.com/#feat=webauthn 2: https://caniuse.com/#feat=u2f https://caniuse.com/#feat=u2f
- andrewaylett 7y agoU2F on Firefox works well GitHub in my experience; it's Google that's the problem. Mozilla have added a shim to enable login to Google using a key but (due to spec deviance) if you want to add a key you still need to use Chrome :(.