6 ms·

I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still

I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.

spydum 7y ago
What absolutely confuses me is.. aren't TOTP authenticators like the cheapest 2FA option to begin with?? No need to have some fancy SMS Enterprise account with a Telecom or pay okta or duo or entrust a bunch of money. It's FREE, all you have to do is implement the server side which is very straightforward.
- ridaj 7y ago
  A cost of implementing TOTP is ID verification at the time the user needs replacement credentials, eg when they lose the phone that had their TOTP secret. With SMS, this cost is offset to the mobile carrier, though as discussed here, carriers have their own vulnerabilities. A further cost is that they usually require the user to install and set up an app, contrary to SMS.
  - ahaseeb 7y ago
    OTP using an app has a very low adoption rate. You'll be surprised that even on crypto exchange 90% of the users don't have access to any kind of 2FA let alone Apps. Only less than .1% of the users have an app installed. It's not convenient
    - madeofpalk 7y ago
      I wonder how that looks like for bank apps? Banks could (and I’m sure they have) offer their own TOTP client, perhaps a bit more integrated. I’m sure that would be easier and offer a better experience than downing some random. "Google Authenticator" app.
      - vanviegen 7y ago
        Yes, that works well. My bank has integrated this functionality this functionality into their mobile app, allowing one to use it to login on a computer. When large amounts are to be transferred, the bank-supplied 2FA device is still needed though (which can be annoying, but seems sensible). This scheme also works really well with payments from your computer. Just use the bank app to scan a qr-code on checkout, verify the payment details on your phone, touch a button, and you're done. I'd guess that a majority of the bank's clients are using this method. This is in the Netherlands, by the way.
    - namirez 7y ago
      I use Authy for all my accounts and it’s way more convenient than SMS.
- thaumasiotes 7y ago
  > aren't TOTP authenticators like the cheapest 2FA option to begin with?? They are precisely equivalent to asking for two passwords on login instead of one password. "Something you know" and "something else you know". So pretty much, yeah. SMS may not be especially secure, but it is at least an actual second factor.
jv22222 7y ago
My brain isn't working right now... Can you tell me why something like google authenticator could not be executed as a website? Does it have to be an app? Just wondering if there could be an easier non installed version that was always available. Apologies if it's a really silly question!
- Maxious 7y ago
  You can run TOTP in javascript sure http://blog.tinisles.com/2011/10/google-authenticator-one-time-password-algorithm-in-javascript/ http://blog.tinisles.com/2011/10/google-authenticator-one-ti... But how do you protect access to the website - with a username and password? Or do people now need to remember another code like "JBSWY3DPEHPK3PXP" to set up the authenticator everytime they visit? Mobile apps were one way to solve this although the hardware U2F tokens like Yubikey provide another authentication factor in a usable way (and more secure than TOTP because you can't be phished to enter them on the wrong site).
  - ridaj 7y ago
    That's right, in fact if people remember that secret then it's not a "second factor" it's just another part of their password. A "factor" in the context of authentication means one of the various ways that can be used to verify someone's identity: "something you know" (password), "something you have" (non-duplicatable object, eg a SIM card or OTP token containing a secret that cannot be easily guessed or extracted), or "something you are" (biometrics).
    - thaumasiotes 7y ago
      > in fact if people remember that secret then it's not a "second factor" it's just another part of their password. This is more generous than it should be. Your TOTP secret is just another part of your password regardless of whether you personally remember it or not; what matters is that, if I would like to be you, I only need to know the secret.
- tfigment 7y ago
  TOTP has a secret which is basically the seed of the calculation. The security basically comes from that secret being only on the phone you have and not being copyable. Moving it to the server removes that proximity. At least thats how i see it, but you could do it very easily server side if you wanted with equivalent security loss.
kccqzy 7y ago
After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start using Yubikeys. WebAuthn is now widely supported by browsers.
- jkepler 7y ago
  Why not use an open TOTP app like AndOTP. I use it all the time for sites that claim to require Google Authenticator, it works, and its easy to backup the secrets as plain text or encrypted with a password. I keep it current on my primary phone and a cheap offline backup, in addition to backing up the encrypted secrets file.
  - balladeer 7y ago
    I use Authy on iPhone and Mac. I am looking for an OSS replacement but would not want to setup everything from scratch after I change device reinstall the app like Google Authenticator.
    - sneak 7y ago
      Bitwarden does a decent job of storing and syncing TOTP codes. Make sure you always use a long password with Bitwarden though, to avoid a known and unpatched issue with their password-based key derivation.
      - balladeer 7y ago
        Oh, didn’t know BitWarden did it. That’s my password manager :)
      - AaronFriel 7y ago
        What issue is that?
scambier 7y ago
My banking app requires a pin (or fingerprint) to read data, and a password to make transactions. The website requires a temporary code, generated by a card reader and my card. It works like a 2FA code, as I need to _have_ my card and to _know_ its pin.
egwor 7y ago
My bank does. The iPhone app can generate tokens. I get the feeling that US retail banking is way behind Europe.
eitland 7y ago
In Norway most banks have been using 2FA for 15 years or more I think. Recently however it has become somewhat less strict it feels[0] and I can now log in to my bank app using FaceID or a pin code. Normal bank websites still demand a code from a hardware token (think RSA key, but with a pincode and sequence-based instead of time based.) [0]: I realize it might be that they are just as strict only doing more work in background to verify me instead of bugging me.

I wish banks and suchlike would get with the program and use Google Authenticator or equivalent. Even if iMessage could be a more secure 1.5FA, it would still be 1.5FA and not true 2FA.

spydum 7y ago

What absolutely confuses me is.. aren't TOTP authenticators like the cheapest 2FA option to begin with?? No need to have some fancy SMS Enterprise account with a Telecom or pay okta or duo or entrust a bunch of money. It's FREE, all you have to do is implement the server side which is very straightforward.

ridaj 7y ago
A cost of implementing TOTP is ID verification at the time the user needs replacement credentials, eg when they lose the phone that had their TOTP secret. With SMS, this cost is offset to the mobile carrier, though as discussed here, carriers have their own vulnerabilities. A further cost is that they usually require the user to install and set up an app, contrary to SMS.
- ahaseeb 7y ago
  OTP using an app has a very low adoption rate. You'll be surprised that even on crypto exchange 90% of the users don't have access to any kind of 2FA let alone Apps. Only less than .1% of the users have an app installed. It's not convenient
  - madeofpalk 7y ago
    I wonder how that looks like for bank apps? Banks could (and I’m sure they have) offer their own TOTP client, perhaps a bit more integrated. I’m sure that would be easier and offer a better experience than downing some random. "Google Authenticator" app.
    - vanviegen 7y ago
      Yes, that works well. My bank has integrated this functionality this functionality into their mobile app, allowing one to use it to login on a computer. When large amounts are to be transferred, the bank-supplied 2FA device is still needed though (which can be annoying, but seems sensible). This scheme also works really well with payments from your computer. Just use the bank app to scan a qr-code on checkout, verify the payment details on your phone, touch a button, and you're done. I'd guess that a majority of the bank's clients are using this method. This is in the Netherlands, by the way.
  - namirez 7y ago
    I use Authy for all my accounts and it’s way more convenient than SMS.
thaumasiotes 7y ago
> aren't TOTP authenticators like the cheapest 2FA option to begin with?? They are precisely equivalent to asking for two passwords on login instead of one password. "Something you know" and "something else you know". So pretty much, yeah. SMS may not be especially secure, but it is at least an actual second factor.

jv22222 7y ago

My brain isn't working right now... Can you tell me why something like google authenticator could not be executed as a website? Does it have to be an app? Just wondering if there could be an easier non installed version that was always available. Apologies if it's a really silly question!

Maxious 7y ago
You can run TOTP in javascript sure http://blog.tinisles.com/2011/10/google-authenticator-one-time-password-algorithm-in-javascript/ http://blog.tinisles.com/2011/10/google-authenticator-one-ti... But how do you protect access to the website - with a username and password? Or do people now need to remember another code like "JBSWY3DPEHPK3PXP" to set up the authenticator everytime they visit? Mobile apps were one way to solve this although the hardware U2F tokens like Yubikey provide another authentication factor in a usable way (and more secure than TOTP because you can't be phished to enter them on the wrong site).
- ridaj 7y ago
  That's right, in fact if people remember that secret then it's not a "second factor" it's just another part of their password. A "factor" in the context of authentication means one of the various ways that can be used to verify someone's identity: "something you know" (password), "something you have" (non-duplicatable object, eg a SIM card or OTP token containing a secret that cannot be easily guessed or extracted), or "something you are" (biometrics).
  - thaumasiotes 7y ago
    > in fact if people remember that secret then it's not a "second factor" it's just another part of their password. This is more generous than it should be. Your TOTP secret is just another part of your password regardless of whether you personally remember it or not; what matters is that, if I would like to be you, I only need to know the secret.
tfigment 7y ago
TOTP has a secret which is basically the seed of the calculation. The security basically comes from that secret being only on the phone you have and not being copyable. Moving it to the server removes that proximity. At least thats how i see it, but you could do it very easily server side if you wanted with equivalent security loss.

kccqzy 7y ago

After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start using Yubikeys. WebAuthn is now widely supported by browsers.

jkepler 7y ago
Why not use an open TOTP app like AndOTP. I use it all the time for sites that claim to require Google Authenticator, it works, and its easy to backup the secrets as plain text or encrypted with a password. I keep it current on my primary phone and a cheap offline backup, in addition to backing up the encrypted secrets file.
- balladeer 7y ago
  I use Authy on iPhone and Mac. I am looking for an OSS replacement but would not want to setup everything from scratch after I change device reinstall the app like Google Authenticator.
  - sneak 7y ago
    Bitwarden does a decent job of storing and syncing TOTP codes. Make sure you always use a long password with Bitwarden though, to avoid a known and unpatched issue with their password-based key derivation.
    - balladeer 7y ago
      Oh, didn’t know BitWarden did it. That’s my password manager :)
    - AaronFriel 7y ago
      What issue is that?

scambier 7y ago

My banking app requires a pin (or fingerprint) to read data, and a password to make transactions. The website requires a temporary code, generated by a card reader and my card. It works like a 2FA code, as I need to _have_ my card and to _know_ its pin.

egwor 7y ago

My bank does. The iPhone app can generate tokens. I get the feeling that US retail banking is way behind Europe.

eitland 7y ago

In Norway most banks have been using 2FA for 15 years or more I think. Recently however it has become somewhat less strict it feels[0] and I can now log in to my bank app using FaceID or a pin code. Normal bank websites still demand a code from a hardware token (think RSA key, but with a pincode and sequence-based instead of time based.) [0]: I realize it might be that they are just as strict only doing more work in background to verify me instead of bugging me.