3 ms·

>However, doing so defeats the purpose of two-factor authentication (2FA). There are still some 2FA benefits from this. The biggest one is for people who reuse

>However, doing so defeats the purpose of two-factor authentication (2FA). There are still some 2FA benefits from this. The biggest one is for people who reuse passwords. Some websites might put you into a higher security tier if you have 2FA. Also if you have to choose between SMS vs this, this has some benefits, for example it can't be hijacked by social engineering your phone provider. Also it says regular TOTP protects you from keyloggers. That's not fully true, because the keylogger could steal your TOTP code as you enter it into the website. If the keylogger is realtime, it could log into your account before you're able to. Or if you assume there's malware on your computer, it could steal your cookies, or perform whatever account actions it wants directly on your computer.

susam 7y ago
The README does not say that TOTP protects us from keyloggers. I was either not clear in writing that paragraph or you may have misundertood that paragraph. Here's what the README says, > If your desktop/laptop device is compromised, then both authentication factors would be compromised. The attacker can steal the first authentication factor that only you should know (e.g., password) by running a key logger on the compromised device. The attacker can also steal the second authentication factor that only you should have ... What I mean here is that generating the TOTP on the same system that we would use to log into a website with 2FA defeats the purpose of 2FA because the attacker can steal the TOTP secret key in addition to stealing the password (keylogger being one way to steal the password).
- eikenberry 7y ago
  I think the grandparent is just trying to say that while it defeats one of the purposes behind 2fa, it doesn't defeat all of them. Security is all about trade-offs and defense in depth and 2fa is still valuable in this sense even with the 2fa secret stored on your laptop. That is, it trades off some security for convenience but is still more secure than not having 2fa.
  - susam 7y ago
    I agree. I think it is acceptable to trade some security for convenience and in this case the convenient solution is still more secure than not having 2FA at all. However, the fact that some security is being traded for convenience should be documented in the README, otherwise one can criticize that the README is promoting a less secure usage of TOTP.
- Thorrez 7y ago
  >because the attacker can steal the TOTP secret key My question is why are we worrying so much about theft of the secret key? There are easier things to steal and abuse (cookies, TOTP codes, website data). Those can be stolen even if the TOTP generator is a different device than the logging in device.
  - susam 7y ago
    I agree that there are easier things to steal. However, that should not allow us to be lax with the security of the TOTP secret key. I think it still makes sense to worry about the theft of the TOTP secret itself. It's just an additional thing to protect along with cookies, TOTP codes, website data, etc.

susam 7y ago

The README does not say that TOTP protects us from keyloggers. I was either not clear in writing that paragraph or you may have misundertood that paragraph. Here's what the README says, > If your desktop/laptop device is compromised, then both authentication factors would be compromised. The attacker can steal the first authentication factor that only you should know (e.g., password) by running a key logger on the compromised device. The attacker can also steal the second authentication factor that only you should have ... What I mean here is that generating the TOTP on the same system that we would use to log into a website with 2FA defeats the purpose of 2FA because the attacker can steal the TOTP secret key in addition to stealing the password (keylogger being one way to steal the password).

eikenberry 7y ago
I think the grandparent is just trying to say that while it defeats one of the purposes behind 2fa, it doesn't defeat all of them. Security is all about trade-offs and defense in depth and 2fa is still valuable in this sense even with the 2fa secret stored on your laptop. That is, it trades off some security for convenience but is still more secure than not having 2fa.
- susam 7y ago
  I agree. I think it is acceptable to trade some security for convenience and in this case the convenient solution is still more secure than not having 2FA at all. However, the fact that some security is being traded for convenience should be documented in the README, otherwise one can criticize that the README is promoting a less secure usage of TOTP.
Thorrez 7y ago
>because the attacker can steal the TOTP secret key My question is why are we worrying so much about theft of the secret key? There are easier things to steal and abuse (cookies, TOTP codes, website data). Those can be stolen even if the TOTP generator is a different device than the logging in device.
- susam 7y ago
  I agree that there are easier things to steal. However, that should not allow us to be lax with the security of the TOTP secret key. I think it still makes sense to worry about the theft of the TOTP secret itself. It's just an additional thing to protect along with cookies, TOTP codes, website data, etc.