8 ms·

Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being bac

by lima 7y ago

Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized services and if you also keep your passwords in there, you eliminate the whole point of two factor authentication. - One important risk with authentication apps is compromised updates, and Google Authenticator has a very low risk of this since it's backed by Google's strict security processes. What you should actually do is to move to U2F/WebAuthn and pester any of your service providers that do not offer it. Yes, if you need to replace a token, you'll have to go through all accounts and change it. There's is absolutely no way to prevent this without compromising on security.

ls612 7y ago
Here’s the thing. I consider myself fairly responsible but I’ll bet I’m far more likely to lose my phone than it is that my Authy and Dashlane credentials are both compromised, which are my pw manager and Authenticator app. You have to choose your risks and for a lot of people an authy like feature is much safer overall than GA.
- ocdtrekkie 7y ago
  All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.
  - tlb 7y ago
    Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.
    - julianlam 7y ago
      Are you referring to network-enabled printers phoning home? My 15 year old Brother doesn't have that capability... So on that front, a printout of QR codes is more likely to be compromised by the paper itself being left out somewhere.
    - snailmailman 7y ago
      I’m not the same person, but anecdotally I’ve been using an ancient printer for years. I’d like to think it’s quite secure. Only works via usb, no wifi or anything complex. The only way I could get it to work is in Linux where I assume the drivers or however it happens is open source. As far as I know the printer is as dumb as a rock. Worst case, i doubt it would be that difficult to hand draw the qr codes on graph paper. Would be quite tedious, but they should be error correcting to some extent.
    - alexhutcheson 7y ago
      What's your threat model? Security researchers or nation-state level adversaries might theoretically be able to tap your printer and parse it for things that look like codes, but if you're receiving that level of expert human attention then you're probably already compromised in one of 1000 other ways.
      - UncleMeat 7y ago
        The huge majority of people don’t have nation state threat models. If you are worried about that then using a desktop computer in the first place is a bad idea.
    - ocdtrekkie 7y ago
      I mean, I think it's a lot less likely that someone compromises my printer which is behind all of the same network protection measures as my PC, scours it for previous printouts of QR codes (if it does retain them), to identify what account they can potentially hack... than that they compromise a 2FA cloud service directly and log into all my accounts. What's the threat model here? If the CIA is in my home network, I'm sure they can get into my email account too.
  - seanwilson 7y ago
    What happens when you're traveling? What if some combination of your wallet, laptop, paper files or phone are stolen or destroyed by fire or water? Essentially, what's your backup plan so if the very worst happens when you're in the middle of nowhere you're not completely locked out?
    - kemitche 7y ago
      It's not hard to come up with scenarios that get you locked out for longer than expected regardless of your auth set-up. e.g. "What if I'm traveling, I lose my phone, and the country I'm in blocks internet access to my 2FA service?" "What if I'm traveling, I lose my phone and my wallet?" (In this case, even if you use a syncable 2FA service - how will you pay for a new device to access it without your wallet? You have a different problem here, that likely involves going to an embassy and/or relying on friends & family!) The question is, (a) how _likely_ are those scenarios? And (b) how much risk/damage/pain do they cause? If I'm traveling, I'm fine unless I lose my phone. If I lose my phone, then I guess I can't sign in to some/many things until I get back. If I lose my phone AND my wallet and I'm not at home, I'm probably more worried about getting my ID cards and bank cards replaced than accessing certain websites. If my house burns down with my phone, wallet, and backup cards inside, I'm probably just thankful to be alive.
    - ocdtrekkie 7y ago
      If I'm traveling, and I lose my laptop, phone, and wallet, I really hope I can't restore access to my 2FA codes! Because if I can get access to my 2FA codes somewhere else in the world without those things, so can an attacker!
  - orev 7y ago
    I see people say this a lot in the tech community, but it’s a preposterous expectation that regular users would be doing something like this. MFA needs to usable by everyone, not just the tech elite.
    - lukeschlather 7y ago
      MFA is a power tool for extra security. It deliberately sacrifices usability and integrity for security. If you want something more usable, you don't want MFA. Really though, I think "one-time passcodes" is the wrong escape hatch because it is actually just password auth, not a second factor. The way it ought to be is that you hook up multiple devices. (e.g. like having both a phone Authenticator app and a USB key.)
      - brnt 7y ago
        Or, I keep using single factor because services MFA implementation sucks tremendously, and as per service agreements service is liable in any security compromise case. Frankly, most of MFA is security masturbation, is nowhere near to being a real solution, not even a real problem. Its just neat from a technical standpoint (if done well, which nearly never happens). A minimum of 2 registered u2f keyfobs, that's all you need to make it usable and safe. Nobody does it, and trusts people either backup their otp codes or never lose or break phones. Ridiculous.
        ocdtrekkie 7y ago
        MFA is always better than single factor. At the very least it makes drive by/automated attacks significantly harder. Everything you read about SIM jacking and the like is at bare minimum, much harder than hacking your password.
        brnt 7y ago
        From a users perspective, MFA is nearly never better than single factor. Attacks are services responsibility anyway.
    - 7y ago
  - Fire-Dragon-DoL 7y ago
    Paypal though has no backup codes...
- notlukesky 7y ago
  Take a look at SAASPASS Authenticator & Password Manager. You can use them separately or integrate them for extra convenience and autofilling options. The desktop browser extension can autofill both passwords and Authenticator codes and on mobile with iOS 12 onwards with autofill capabilities.
jki275 7y ago
As long as you use encrypted backups with iPhone, your GA keys are backed up and you can restore a new phone with them also.
- the_svd_doctor 7y ago
  GA keys are not in icloud backups. You mean local “usb” backups?
  - jki275 7y ago
    They are definitely in local backups (note that I didn't say iCloud), but I believe they're in encrypted iCloud backups as well, as I've done recovered phones with GA tokens from an iCloud backup before.
- tinus_hn 7y ago
  Only the keys that specify they may be backed up. The ones that don’t are not included, not even in the encrypted backup.
- 0x0 7y ago
  Last time I did a backup/restore between iphones using encrypted itunes usb, GA came up empty. Had to go through painful account recovery / lost 2fa procedures on a dozen accounts. Now I use "OTPAuth" instead. Even comes with an Apple Watch app!
  - retromario 7y ago
    I second every part of this comment. I ran into the same issue migrating GA to a new phone, none of my keys went with. Very frustrating experience. I also switched to OTPAuth, great app, provides encrypted backups and switching to a new phone was seamless. Would absolutely recommend over Google Authenticator.
the_snooze 7y ago
I feel you're letting perfect be the enemy of the good. The baseline isn't centralized 2FA. The baseline is not using 2FA at all. While you may be willing to accept usability trade-offs associated with the lack of synchronization, a lot of people aren't. We shouldn't let better security be accessible only to tech-savvy people.
- slg 7y ago
  This article isn't an advertisement for centralized 2FA. It is an argument that you should ditch Google Authenticator for a centralized 2FA app. Therefore the baseline is people who already have 2FA enabled.
mathijs 7y ago
I agree with this comment completely. Adding a biometric lock would turn it into 3FA. Not sure if HN allows to plug your own apps, so please forgive: I made an app a while ago that aims to replace Google Authenticator for some of the reasons mentioned: it allows to back-up and transfer tokens without creating a large attack factor. Not having sync is a feature in this case as well. In fact, the app does not even have the internet permission enabled, so it utterly unable to phone home. Transferring backups does require a biometric lock. It is also entirely free, so I'm only posting this out of pride of my own work: https://play.google.com/store/apps/details?id=com.pixplicity.auth&hl=en_US https://play.google.com/store/apps/details?id=com.pixplicity...
- celticninja 7y ago
  Thanks for sharing I will take her back although should I trust a random app from hacker news with my passwords?
- goalieca 7y ago
  Biometric data should be considered identity and not authentication data. They can never be revoked or rotated for one. And who knows how many people have it on file. Not every auth server gets their own « key »
  - mathijs 7y ago
    Makes sense. The principle of 2FA is to combine 'something you know' (a password) with 'something you own' (your phone). I guess the biometric lock is 'something you are' on top of that.
BoppreH 7y ago
> You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. I find that a terrible design decision, because now every website has to implement their own backup code flow. PayPal, for example, is one of the most critical applications when talking about authentication, and while they support 2FA they don't give you any backup codes at all: https://www.paypal-community.com/t5/My-Account/Backup-codes/td-p/1812619 https://www.paypal-community.com/t5/My-Account/Backup-codes/... Now I cannot synchronize devices, I'm hosed if I ever lose my phone, and I'm still relying on PayPal customer support to do a proper out-of-band authentication. The worst of both worlds.
- jdeibele 7y ago
  At one point I was able to use two copies (phone and iPad) of Symantec VIP Access with Paypal. I changed phones and I wasn't able to use the new copy. However, I was able to set up Authy as a secondary authenticator. I don't have SMS as 2FA for PayPal.
- criddell 7y ago
  The offline backup can be a printout of the QR code.
- lima 7y ago
  The best available solution is to implement WebAuthn support and allow users to add multiple devices. No backup code, no phishing.
renton_tacos 7y ago
>- Passcode or biometric locks on an app are a gimmick and offer negligible value. Biometric locks are interfaces that the OS does not expose to users, and that are backed via an HSM. On the iPhone and modern Android, they allow you to envelope encrypt a message via biometrics in such a way that it can only be unlocked from within the app that locked it AND via enrolled biometric signatures. Passcodes are the same, but easier to phish. It is incorrect to say that they "are a gimmick and offer negligible value". In this document, they lay out these mechanisms in great detail. Anyone with an interest in security should read this, imo. It's a magnificent "blue team" effort https://www.apple.com/ca/business-docs/iOS_Security_Guide.pdf https://www.apple.com/ca/business-docs/iOS_Security_Guide.pd...
- trickstra 7y ago
  Your biometrics are already getting analyzed from all angles somewhere in China just from all the face apps that predict which Disney princess you are. And you cannot change it like a password. So that's why it's a gimmick.
  - aneutron 7y ago
    That is not very civil of you. OP is making a very solid point. Consider your threat model first. If you're a high value target, then yes it's probably a gimmick as you're more likely to have a gun to your head. But for other attack vectors that are more automatable and deployed at large (e.g. Trojan Apps), as OP suggests, it is a lot of things, but not a gimmick.
    - sV5OvuqTZXPSqw1 7y ago
      First, shoutout to HN for not blocking my Tor throwaway. I am someone who would be considered to be a "high value target" since I have had some of these things happen to me and I'm certain they will happen again in the future. I work in a politically sensitive industry where it turns out these things are commonplace. When I was younger I was always security conscious and took serious trade-offs to maintain my privacy. You could have called me paranoid, but I think I was more excited at the idea of being protected against all of these high-level threats, even if most of them were nonexistent at the time. While this discipline certainly benefited me later in life, I've realized that I will never again get the chance to reasonably evaluate my threats as "average" and enjoy some of the simpler conveniences of technology that come at the cost of compromising some high-severity threat models. Of course I still think there are a lot of precautions the average person can take to protect their privacy without major trade-offs, but those don't usually include state actor-level threats against your devices. I wouldn't change a thing now, but when I talk to people who see no reason to take anything more than the average precautions, I no longer think it's "cool" to do anything more than that because I know for a fact I would too if I was in their shoes.
Fire-Dragon-DoL 7y ago
Well, an option to export to an encrypted file so that is easy to move between phones is an acceptable tradeoff. Using 1 day pf my time to authorize again all the websites is much worse (and i have to disable authenticator during that period). Sorry, I disagree. For the same reasons passwords are not good, an uncomfortable solution is not ok
ender341341 7y ago
> In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized services and if you also keep your passwords in there, you eliminate the whole point of two factor authentication. 1pass user, while I know that it's not as secure as keeping them separated I view it as if someone has access to my 1password vault unencrypted I'm already screwed, but having 2FA coming from 1 tool still protects me from the case of my username/password pair getting leaked or MITMed.
- J5892 7y ago
  As a LastPass user, my main defense against the possibility of someone accessing my LastPass account is the fact that all of my important accounts have 2FA completely separate from LastPass. So if someone got a hold of my LastPass master password, they can't access my google account, banking, etc.
  - dillondoyle 7y ago
    I'm curious about LastPass - it's what I use and work in politics.. Their security page says encrypted on device [1] before sending to them? is that not trustworthy or I'm not understanding? or maybe worried about compromised devices (where it's over anyways)? 1: https://www.lastpass.com/enterprise/security https://www.lastpass.com/enterprise/security
    - J5892 7y ago
      I trust LastPass's security as much as I trust any company's security. I'm not worried about MITM attacks, but there are many other ways that someone could get access to an account. The biggest security issue is that they hold the keys to my entire kingdom. So if someone somehow gains access to that account, I need another layer of protection, no matter how small the chances are.
    - camgunz 7y ago
      I'd recommend 1password over LastPass. LastPass has had some real facepalm security issues, and 1Password has a reputation for passing some pretty strenuous audits. We used LastPass on the tech team at HFA and... I think everyone I know has switched to 1Password or something else. I do 1Password and Yubikeys.
dnr 7y ago
I've used Google Authenticator for a long time, but the lack of backups is a really serious downside. What I would really like is encrypted backups using a strong passphrase that I can write down on paper (like Authy), but from a trusted source like Google, and with no other features to widen the attack surface (no internet access, no SMS). Without backups, having a phone die or get lost is a very frustrating experience. If you use backup codes, you have to go re-register 2FA on every account with backup codes. And of course some don't offer backup codes. You could screenshot and print out the QR code at registration time (I've done this for a few accounts), but shared printers apparently retain history of everything they've printed, so you'd need to own a personal printer, which seems absurd. You could write down the TOTP secret on paper instead. Ideally with multiple copies and then move them to different physical locations. That's a big hassle to do for each new account registration, which seems to happen every few months. Encrypted backups solve this easily: you get one key, which you write down once and distribute to different locations if you want. After that there's nothing new to do for new accounts at registration time. And restoring onto a new phone after one dies is also easy.
- ryall 7y ago
  Totally agree, I had my phone stolen a few years back. Had to buy a new one. What a surprise when I restored Google Authenticator and all my sites were gone. However I do have an issue with 1password's feature of auto-filling those codes, seems like it's just invalidated the whole "something you have" party of MFA. For me Authy is a happy medium
  - ThePowerOfFuet 7y ago
    Google Authenticator is backed up on iOS if you use an encrypted local backup via iTunes (or macOS Catalina) or iMazing.
    - pmoleri 7y ago
      Mmm, does that mean that now your iCloud password unlocks all your 2FAs? It isn't that bad, it still a 2nd factor, but it's worth considering it.
ak217 7y ago
I agree with you on the advantages of U2F/WebAuthn, but the rest of your comment seems pretty oblivious to the usability challenges of TOTP MFA. The security risks that you cite are remote and orthogonal to the security risks of not having MFA in the first place. Trying to shame users into obeying the finer details of the TOTP RFC won't work. Let's just nudge people over to U2F instead.
d1zzy 7y ago
> - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. And it's easy enough to synchronize multiple devices to the same qrcode when setting up 2FA so that you can generate codes from a backup device if one goes missing.
- mmis1000 7y ago
  If your account get hacked, then the one includes hacker's phone. The whole point of totp is gone. Hackers no longer need to stole your phone physically. Hack your account is enough.
TheSpiceIsLife 7y ago
Security is a set of compromises.
carterehsmith 7y ago
>> In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. Source? I've seen some vulnerabilities over time, but the "giant attack surface"?
diebeforei485 7y ago
This sort of user-hostile approach is not a net positive for security, because most people don't want to have a bunch of offline backup codes for each one of the hundreds of websites they have signed up with.
- lima 7y ago
  Yes, but that is because TOTP is user-hostile. The solution is to migrate to a more secure and less hostile mechanism, not to compromise on security.

by lima 7y ago

ls612 7y ago

Here’s the thing. I consider myself fairly responsible but I’ll bet I’m far more likely to lose my phone than it is that my Authy and Dashlane credentials are both compromised, which are my pw manager and Authenticator app. You have to choose your risks and for a lot of people an authy like feature is much safer overall than GA.

ocdtrekkie 7y ago
All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.
- tlb 7y ago
  Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.
  - julianlam 7y ago
    Are you referring to network-enabled printers phoning home? My 15 year old Brother doesn't have that capability... So on that front, a printout of QR codes is more likely to be compromised by the paper itself being left out somewhere.
  - snailmailman 7y ago
    I’m not the same person, but anecdotally I’ve been using an ancient printer for years. I’d like to think it’s quite secure. Only works via usb, no wifi or anything complex. The only way I could get it to work is in Linux where I assume the drivers or however it happens is open source. As far as I know the printer is as dumb as a rock. Worst case, i doubt it would be that difficult to hand draw the qr codes on graph paper. Would be quite tedious, but they should be error correcting to some extent.
  - alexhutcheson 7y ago
    What's your threat model? Security researchers or nation-state level adversaries might theoretically be able to tap your printer and parse it for things that look like codes, but if you're receiving that level of expert human attention then you're probably already compromised in one of 1000 other ways.
    - UncleMeat 7y ago
      The huge majority of people don’t have nation state threat models. If you are worried about that then using a desktop computer in the first place is a bad idea.
  - ocdtrekkie 7y ago
    I mean, I think it's a lot less likely that someone compromises my printer which is behind all of the same network protection measures as my PC, scours it for previous printouts of QR codes (if it does retain them), to identify what account they can potentially hack... than that they compromise a 2FA cloud service directly and log into all my accounts. What's the threat model here? If the CIA is in my home network, I'm sure they can get into my email account too.
- seanwilson 7y ago
  What happens when you're traveling? What if some combination of your wallet, laptop, paper files or phone are stolen or destroyed by fire or water? Essentially, what's your backup plan so if the very worst happens when you're in the middle of nowhere you're not completely locked out?
  - kemitche 7y ago
    It's not hard to come up with scenarios that get you locked out for longer than expected regardless of your auth set-up. e.g. "What if I'm traveling, I lose my phone, and the country I'm in blocks internet access to my 2FA service?" "What if I'm traveling, I lose my phone and my wallet?" (In this case, even if you use a syncable 2FA service - how will you pay for a new device to access it without your wallet? You have a different problem here, that likely involves going to an embassy and/or relying on friends & family!) The question is, (a) how _likely_ are those scenarios? And (b) how much risk/damage/pain do they cause? If I'm traveling, I'm fine unless I lose my phone. If I lose my phone, then I guess I can't sign in to some/many things until I get back. If I lose my phone AND my wallet and I'm not at home, I'm probably more worried about getting my ID cards and bank cards replaced than accessing certain websites. If my house burns down with my phone, wallet, and backup cards inside, I'm probably just thankful to be alive.
  - ocdtrekkie 7y ago
    If I'm traveling, and I lose my laptop, phone, and wallet, I really hope I can't restore access to my 2FA codes! Because if I can get access to my 2FA codes somewhere else in the world without those things, so can an attacker!
- orev 7y ago
  I see people say this a lot in the tech community, but it’s a preposterous expectation that regular users would be doing something like this. MFA needs to usable by everyone, not just the tech elite.
  - lukeschlather 7y ago
    MFA is a power tool for extra security. It deliberately sacrifices usability and integrity for security. If you want something more usable, you don't want MFA. Really though, I think "one-time passcodes" is the wrong escape hatch because it is actually just password auth, not a second factor. The way it ought to be is that you hook up multiple devices. (e.g. like having both a phone Authenticator app and a USB key.)
    - brnt 7y ago
      Or, I keep using single factor because services MFA implementation sucks tremendously, and as per service agreements service is liable in any security compromise case. Frankly, most of MFA is security masturbation, is nowhere near to being a real solution, not even a real problem. Its just neat from a technical standpoint (if done well, which nearly never happens). A minimum of 2 registered u2f keyfobs, that's all you need to make it usable and safe. Nobody does it, and trusts people either backup their otp codes or never lose or break phones. Ridiculous.
      - ocdtrekkie 7y ago
        MFA is always better than single factor. At the very least it makes drive by/automated attacks significantly harder. Everything you read about SIM jacking and the like is at bare minimum, much harder than hacking your password.
        brnt 7y ago
        From a users perspective, MFA is nearly never better than single factor. Attacks are services responsibility anyway.
  - 7y ago
- Fire-Dragon-DoL 7y ago
  Paypal though has no backup codes...
notlukesky 7y ago
Take a look at SAASPASS Authenticator & Password Manager. You can use them separately or integrate them for extra convenience and autofilling options. The desktop browser extension can autofill both passwords and Authenticator codes and on mobile with iOS 12 onwards with autofill capabilities.

jki275 7y ago

As long as you use encrypted backups with iPhone, your GA keys are backed up and you can restore a new phone with them also.

the_svd_doctor 7y ago
GA keys are not in icloud backups. You mean local “usb” backups?
- jki275 7y ago
  They are definitely in local backups (note that I didn't say iCloud), but I believe they're in encrypted iCloud backups as well, as I've done recovered phones with GA tokens from an iCloud backup before.
tinus_hn 7y ago
Only the keys that specify they may be backed up. The ones that don’t are not included, not even in the encrypted backup.
0x0 7y ago
Last time I did a backup/restore between iphones using encrypted itunes usb, GA came up empty. Had to go through painful account recovery / lost 2fa procedures on a dozen accounts. Now I use "OTPAuth" instead. Even comes with an Apple Watch app!
- retromario 7y ago
  I second every part of this comment. I ran into the same issue migrating GA to a new phone, none of my keys went with. Very frustrating experience. I also switched to OTPAuth, great app, provides encrypted backups and switching to a new phone was seamless. Would absolutely recommend over Google Authenticator.

the_snooze 7y ago

I feel you're letting perfect be the enemy of the good. The baseline isn't centralized 2FA. The baseline is not using 2FA at all. While you may be willing to accept usability trade-offs associated with the lack of synchronization, a lot of people aren't. We shouldn't let better security be accessible only to tech-savvy people.

slg 7y ago
This article isn't an advertisement for centralized 2FA. It is an argument that you should ditch Google Authenticator for a centralized 2FA app. Therefore the baseline is people who already have 2FA enabled.

mathijs 7y ago

I agree with this comment completely. Adding a biometric lock would turn it into 3FA. Not sure if HN allows to plug your own apps, so please forgive: I made an app a while ago that aims to replace Google Authenticator for some of the reasons mentioned: it allows to back-up and transfer tokens without creating a large attack factor. Not having sync is a feature in this case as well. In fact, the app does not even have the internet permission enabled, so it utterly unable to phone home. Transferring backups does require a biometric lock. It is also entirely free, so I'm only posting this out of pride of my own work: https://play.google.com/store/apps/details?id=com.pixplicity.auth&hl=en_US https://play.google.com/store/apps/details?id=com.pixplicity...

celticninja 7y ago
Thanks for sharing I will take her back although should I trust a random app from hacker news with my passwords?
goalieca 7y ago
Biometric data should be considered identity and not authentication data. They can never be revoked or rotated for one. And who knows how many people have it on file. Not every auth server gets their own « key »
- mathijs 7y ago
  Makes sense. The principle of 2FA is to combine 'something you know' (a password) with 'something you own' (your phone). I guess the biometric lock is 'something you are' on top of that.

BoppreH 7y ago

> You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. I find that a terrible design decision, because now every website has to implement their own backup code flow. PayPal, for example, is one of the most critical applications when talking about authentication, and while they support 2FA they don't give you any backup codes at all: https://www.paypal-community.com/t5/My-Account/Backup-codes/td-p/1812619 https://www.paypal-community.com/t5/My-Account/Backup-codes/... Now I cannot synchronize devices, I'm hosed if I ever lose my phone, and I'm still relying on PayPal customer support to do a proper out-of-band authentication. The worst of both worlds.

jdeibele 7y ago
At one point I was able to use two copies (phone and iPad) of Symantec VIP Access with Paypal. I changed phones and I wasn't able to use the new copy. However, I was able to set up Authy as a secondary authenticator. I don't have SMS as 2FA for PayPal.
criddell 7y ago
The offline backup can be a printout of the QR code.
lima 7y ago
The best available solution is to implement WebAuthn support and allow users to add multiple devices. No backup code, no phishing.

renton_tacos 7y ago

>- Passcode or biometric locks on an app are a gimmick and offer negligible value. Biometric locks are interfaces that the OS does not expose to users, and that are backed via an HSM. On the iPhone and modern Android, they allow you to envelope encrypt a message via biometrics in such a way that it can only be unlocked from within the app that locked it AND via enrolled biometric signatures. Passcodes are the same, but easier to phish. It is incorrect to say that they "are a gimmick and offer negligible value". In this document, they lay out these mechanisms in great detail. Anyone with an interest in security should read this, imo. It's a magnificent "blue team" effort https://www.apple.com/ca/business-docs/iOS_Security_Guide.pdf https://www.apple.com/ca/business-docs/iOS_Security_Guide.pd...

trickstra 7y ago
Your biometrics are already getting analyzed from all angles somewhere in China just from all the face apps that predict which Disney princess you are. And you cannot change it like a password. So that's why it's a gimmick.
- aneutron 7y ago
  That is not very civil of you. OP is making a very solid point. Consider your threat model first. If you're a high value target, then yes it's probably a gimmick as you're more likely to have a gun to your head. But for other attack vectors that are more automatable and deployed at large (e.g. Trojan Apps), as OP suggests, it is a lot of things, but not a gimmick.
  - sV5OvuqTZXPSqw1 7y ago
    First, shoutout to HN for not blocking my Tor throwaway. I am someone who would be considered to be a "high value target" since I have had some of these things happen to me and I'm certain they will happen again in the future. I work in a politically sensitive industry where it turns out these things are commonplace. When I was younger I was always security conscious and took serious trade-offs to maintain my privacy. You could have called me paranoid, but I think I was more excited at the idea of being protected against all of these high-level threats, even if most of them were nonexistent at the time. While this discipline certainly benefited me later in life, I've realized that I will never again get the chance to reasonably evaluate my threats as "average" and enjoy some of the simpler conveniences of technology that come at the cost of compromising some high-severity threat models. Of course I still think there are a lot of precautions the average person can take to protect their privacy without major trade-offs, but those don't usually include state actor-level threats against your devices. I wouldn't change a thing now, but when I talk to people who see no reason to take anything more than the average precautions, I no longer think it's "cool" to do anything more than that because I know for a fact I would too if I was in their shoes.

Fire-Dragon-DoL 7y ago

Well, an option to export to an encrypted file so that is easy to move between phones is an acceptable tradeoff. Using 1 day pf my time to authorize again all the websites is much worse (and i have to disable authenticator during that period). Sorry, I disagree. For the same reasons passwords are not good, an uncomfortable solution is not ok

ender341341 7y ago

> In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized services and if you also keep your passwords in there, you eliminate the whole point of two factor authentication. 1pass user, while I know that it's not as secure as keeping them separated I view it as if someone has access to my 1password vault unencrypted I'm already screwed, but having 2FA coming from 1 tool still protects me from the case of my username/password pair getting leaked or MITMed.

J5892 7y ago
As a LastPass user, my main defense against the possibility of someone accessing my LastPass account is the fact that all of my important accounts have 2FA completely separate from LastPass. So if someone got a hold of my LastPass master password, they can't access my google account, banking, etc.
- dillondoyle 7y ago
  I'm curious about LastPass - it's what I use and work in politics.. Their security page says encrypted on device [1] before sending to them? is that not trustworthy or I'm not understanding? or maybe worried about compromised devices (where it's over anyways)? 1: https://www.lastpass.com/enterprise/security https://www.lastpass.com/enterprise/security
  - J5892 7y ago
    I trust LastPass's security as much as I trust any company's security. I'm not worried about MITM attacks, but there are many other ways that someone could get access to an account. The biggest security issue is that they hold the keys to my entire kingdom. So if someone somehow gains access to that account, I need another layer of protection, no matter how small the chances are.
  - camgunz 7y ago
    I'd recommend 1password over LastPass. LastPass has had some real facepalm security issues, and 1Password has a reputation for passing some pretty strenuous audits. We used LastPass on the tech team at HFA and... I think everyone I know has switched to 1Password or something else. I do 1Password and Yubikeys.

dnr 7y ago

I've used Google Authenticator for a long time, but the lack of backups is a really serious downside. What I would really like is encrypted backups using a strong passphrase that I can write down on paper (like Authy), but from a trusted source like Google, and with no other features to widen the attack surface (no internet access, no SMS). Without backups, having a phone die or get lost is a very frustrating experience. If you use backup codes, you have to go re-register 2FA on every account with backup codes. And of course some don't offer backup codes. You could screenshot and print out the QR code at registration time (I've done this for a few accounts), but shared printers apparently retain history of everything they've printed, so you'd need to own a personal printer, which seems absurd. You could write down the TOTP secret on paper instead. Ideally with multiple copies and then move them to different physical locations. That's a big hassle to do for each new account registration, which seems to happen every few months. Encrypted backups solve this easily: you get one key, which you write down once and distribute to different locations if you want. After that there's nothing new to do for new accounts at registration time. And restoring onto a new phone after one dies is also easy.

ryall 7y ago
Totally agree, I had my phone stolen a few years back. Had to buy a new one. What a surprise when I restored Google Authenticator and all my sites were gone. However I do have an issue with 1password's feature of auto-filling those codes, seems like it's just invalidated the whole "something you have" party of MFA. For me Authy is a happy medium
- ThePowerOfFuet 7y ago
  Google Authenticator is backed up on iOS if you use an encrypted local backup via iTunes (or macOS Catalina) or iMazing.
  - pmoleri 7y ago
    Mmm, does that mean that now your iCloud password unlocks all your 2FAs? It isn't that bad, it still a 2nd factor, but it's worth considering it.

ak217 7y ago

I agree with you on the advantages of U2F/WebAuthn, but the rest of your comment seems pretty oblivious to the usability challenges of TOTP MFA. The security risks that you cite are remote and orthogonal to the security risks of not having MFA in the first place. Trying to shame users into obeying the finer details of the TOTP RFC won't work. Let's just nudge people over to U2F instead.

d1zzy 7y ago

> - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. And it's easy enough to synchronize multiple devices to the same qrcode when setting up 2FA so that you can generate codes from a backup device if one goes missing.

mmis1000 7y ago
If your account get hacked, then the one includes hacker's phone. The whole point of totp is gone. Hackers no longer need to stole your phone physically. Hack your account is enough.

TheSpiceIsLife 7y ago

Security is a set of compromises.

carterehsmith 7y ago

>> In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. Source? I've seen some vulnerabilities over time, but the "giant attack surface"?

diebeforei485 7y ago

This sort of user-hostile approach is not a net positive for security, because most people don't want to have a bunch of offline backup codes for each one of the hundreds of websites they have signed up with.

lima 7y ago
Yes, but that is because TOTP is user-hostile. The solution is to migrate to a more secure and less hostile mechanism, not to compromise on security.