4 ms·
>I don't want to trust my phone! That's an interesting threat model that I don't hear very often. Can you expand on what threats you're trying to protect again
by Thorrez 7y ago
>I don't want to trust my phone!
That's an interesting threat model that I don't hear very often. Can you expand on what threats you're trying to protect against? If you ever sign in to Twitter on your phone, you're trusting your phone with your Twitter account at least to some degree.
The main thing security keys protect against that TOTP doesn't is phishing.
- oxplot 7y agoYou don't necessarily login to Twitter on the phone (I don't for instance). Even if you did, your login credentials are considered more sensitive data than the session cookie you get after you're signed in. As with the Twitter app, the window of time in which your login creds are in memory is short. With a TOTP app holding your private key around, you basically have half the credential available at all times (unless of course the TOTP app makes use of the mobile platform's hardware chip to encrypt the private key when app is not in use).
- Thorrez 7y agoYes, but assuming your phone is compromised, it can intercept the password and security key as you sign in, and take over your Twitter account. In fact if you use your security key to sign in to anything on your phone, the phone malware can use it to access any account linked to the security key (assuming the malware has your password). So even if you don't sign in to Twitter on your phone you're still vulnerable. And even if you are already signed in to everything and think you won't ever need to sign in on your phone again, the malware can force a logout of something, and you won't be able to know if it was just some software update or expiration that signed you out. So you'll sign in again, and the malware will intercept your security key.
- roca 7y agoI have never used my Yubikey with my phone for any application, I don't even know if it works, and I see no reason why I would start. I almost never use Twitter on my phone and if I switched Twitter to my Yubikey, I would never use it on my phone.
- calhoun137 7y agoI thought the implication was he didnt want to use sms for 2fa because of sim hijacking attacks
- Thorrez 7y agoroca also said TOTP is bad, but TOTP isn't vulnerable to that.
- roca 7y agoNumber porting attacks, remote phone compromise, phone theft ... probably in that order. I almost never use Twitter on my phone, and if I switched Twitter to depend on my Yubikey, I would stop using Twitter on my phone completely.
- Thorrez 7y agoTOTP isn't vulnerable to porting numbers, so you're safe from that threat. Is remote desktop compromise less likely than remote phone compromise? Phones tend to sandbox each app, so a single malicious or compromised app cannot take over your phone. Desktops on the other hand allow any app to do essentially anything on your computer. Accidentally open a malicious email attachment and you're done for. Generally I consider machine/phone compromise outside of my threat model. Is security key theft less likely than phone theft? Also, phones generally require a password or fingerprint or face to unlock, while security keys generally do not (Yubico announced a fingerprint-protected one 18 days ago, but it's not available yet).
- roca 7y agoGiven that I run a Linux desktop, and not Ubuntu, I think I'm less likely to be swept up in a mass hack on my desktop than on my phone. I bring my phone with me in lots of circumstances where I don't bring my security key, so yeah I think it's more likely to be lost/stolen. Also, TOTP has a MITM problem that U2F/Webauthn doesn't have.