5 ms·

Here’s the thing. I consider myself fairly responsible but I’ll bet I’m far more likely to lose my phone than it is that my Authy and Dashlane credentials are b

by ls612 7y ago

Here’s the thing. I consider myself fairly responsible but I’ll bet I’m far more likely to lose my phone than it is that my Authy and Dashlane credentials are both compromised, which are my pw manager and Authenticator app. You have to choose your risks and for a lot of people an authy like feature is much safer overall than GA.

ocdtrekkie 7y ago
All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.
- tlb 7y ago
  Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.
  - julianlam 7y ago
    Are you referring to network-enabled printers phoning home? My 15 year old Brother doesn't have that capability... So on that front, a printout of QR codes is more likely to be compromised by the paper itself being left out somewhere.
  - snailmailman 7y ago
    I’m not the same person, but anecdotally I’ve been using an ancient printer for years. I’d like to think it’s quite secure. Only works via usb, no wifi or anything complex. The only way I could get it to work is in Linux where I assume the drivers or however it happens is open source. As far as I know the printer is as dumb as a rock. Worst case, i doubt it would be that difficult to hand draw the qr codes on graph paper. Would be quite tedious, but they should be error correcting to some extent.
  - alexhutcheson 7y ago
    What's your threat model? Security researchers or nation-state level adversaries might theoretically be able to tap your printer and parse it for things that look like codes, but if you're receiving that level of expert human attention then you're probably already compromised in one of 1000 other ways.
    - UncleMeat 7y ago
      The huge majority of people don’t have nation state threat models. If you are worried about that then using a desktop computer in the first place is a bad idea.
  - ocdtrekkie 7y ago
    I mean, I think it's a lot less likely that someone compromises my printer which is behind all of the same network protection measures as my PC, scours it for previous printouts of QR codes (if it does retain them), to identify what account they can potentially hack... than that they compromise a 2FA cloud service directly and log into all my accounts. What's the threat model here? If the CIA is in my home network, I'm sure they can get into my email account too.
- seanwilson 7y ago
  What happens when you're traveling? What if some combination of your wallet, laptop, paper files or phone are stolen or destroyed by fire or water? Essentially, what's your backup plan so if the very worst happens when you're in the middle of nowhere you're not completely locked out?
  - kemitche 7y ago
    It's not hard to come up with scenarios that get you locked out for longer than expected regardless of your auth set-up. e.g. "What if I'm traveling, I lose my phone, and the country I'm in blocks internet access to my 2FA service?" "What if I'm traveling, I lose my phone and my wallet?" (In this case, even if you use a syncable 2FA service - how will you pay for a new device to access it without your wallet? You have a different problem here, that likely involves going to an embassy and/or relying on friends & family!) The question is, (a) how _likely_ are those scenarios? And (b) how much risk/damage/pain do they cause? If I'm traveling, I'm fine unless I lose my phone. If I lose my phone, then I guess I can't sign in to some/many things until I get back. If I lose my phone AND my wallet and I'm not at home, I'm probably more worried about getting my ID cards and bank cards replaced than accessing certain websites. If my house burns down with my phone, wallet, and backup cards inside, I'm probably just thankful to be alive.
  - ocdtrekkie 7y ago
    If I'm traveling, and I lose my laptop, phone, and wallet, I really hope I can't restore access to my 2FA codes! Because if I can get access to my 2FA codes somewhere else in the world without those things, so can an attacker!
- orev 7y ago
  I see people say this a lot in the tech community, but it’s a preposterous expectation that regular users would be doing something like this. MFA needs to usable by everyone, not just the tech elite.
  - lukeschlather 7y ago
    MFA is a power tool for extra security. It deliberately sacrifices usability and integrity for security. If you want something more usable, you don't want MFA. Really though, I think "one-time passcodes" is the wrong escape hatch because it is actually just password auth, not a second factor. The way it ought to be is that you hook up multiple devices. (e.g. like having both a phone Authenticator app and a USB key.)
    - brnt 7y ago
      Or, I keep using single factor because services MFA implementation sucks tremendously, and as per service agreements service is liable in any security compromise case. Frankly, most of MFA is security masturbation, is nowhere near to being a real solution, not even a real problem. Its just neat from a technical standpoint (if done well, which nearly never happens). A minimum of 2 registered u2f keyfobs, that's all you need to make it usable and safe. Nobody does it, and trusts people either backup their otp codes or never lose or break phones. Ridiculous.
      - ocdtrekkie 7y ago
        MFA is always better than single factor. At the very least it makes drive by/automated attacks significantly harder. Everything you read about SIM jacking and the like is at bare minimum, much harder than hacking your password.
        brnt 7y ago
        From a users perspective, MFA is nearly never better than single factor. Attacks are services responsibility anyway.
  - 7y ago
- Fire-Dragon-DoL 7y ago
  Paypal though has no backup codes...
notlukesky 7y ago
Take a look at SAASPASS Authenticator & Password Manager. You can use them separately or integrate them for extra convenience and autofilling options. The desktop browser extension can autofill both passwords and Authenticator codes and on mobile with iOS 12 onwards with autofill capabilities.

by ls612 7y ago

ocdtrekkie 7y ago

All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.

tlb 7y ago
Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.
- julianlam 7y ago
  Are you referring to network-enabled printers phoning home? My 15 year old Brother doesn't have that capability... So on that front, a printout of QR codes is more likely to be compromised by the paper itself being left out somewhere.
- snailmailman 7y ago
  I’m not the same person, but anecdotally I’ve been using an ancient printer for years. I’d like to think it’s quite secure. Only works via usb, no wifi or anything complex. The only way I could get it to work is in Linux where I assume the drivers or however it happens is open source. As far as I know the printer is as dumb as a rock. Worst case, i doubt it would be that difficult to hand draw the qr codes on graph paper. Would be quite tedious, but they should be error correcting to some extent.
- alexhutcheson 7y ago
  What's your threat model? Security researchers or nation-state level adversaries might theoretically be able to tap your printer and parse it for things that look like codes, but if you're receiving that level of expert human attention then you're probably already compromised in one of 1000 other ways.
  - UncleMeat 7y ago
    The huge majority of people don’t have nation state threat models. If you are worried about that then using a desktop computer in the first place is a bad idea.
- ocdtrekkie 7y ago
  I mean, I think it's a lot less likely that someone compromises my printer which is behind all of the same network protection measures as my PC, scours it for previous printouts of QR codes (if it does retain them), to identify what account they can potentially hack... than that they compromise a 2FA cloud service directly and log into all my accounts. What's the threat model here? If the CIA is in my home network, I'm sure they can get into my email account too.
seanwilson 7y ago
What happens when you're traveling? What if some combination of your wallet, laptop, paper files or phone are stolen or destroyed by fire or water? Essentially, what's your backup plan so if the very worst happens when you're in the middle of nowhere you're not completely locked out?
- kemitche 7y ago
  It's not hard to come up with scenarios that get you locked out for longer than expected regardless of your auth set-up. e.g. "What if I'm traveling, I lose my phone, and the country I'm in blocks internet access to my 2FA service?" "What if I'm traveling, I lose my phone and my wallet?" (In this case, even if you use a syncable 2FA service - how will you pay for a new device to access it without your wallet? You have a different problem here, that likely involves going to an embassy and/or relying on friends & family!) The question is, (a) how _likely_ are those scenarios? And (b) how much risk/damage/pain do they cause? If I'm traveling, I'm fine unless I lose my phone. If I lose my phone, then I guess I can't sign in to some/many things until I get back. If I lose my phone AND my wallet and I'm not at home, I'm probably more worried about getting my ID cards and bank cards replaced than accessing certain websites. If my house burns down with my phone, wallet, and backup cards inside, I'm probably just thankful to be alive.
- ocdtrekkie 7y ago
  If I'm traveling, and I lose my laptop, phone, and wallet, I really hope I can't restore access to my 2FA codes! Because if I can get access to my 2FA codes somewhere else in the world without those things, so can an attacker!
orev 7y ago
I see people say this a lot in the tech community, but it’s a preposterous expectation that regular users would be doing something like this. MFA needs to usable by everyone, not just the tech elite.
- lukeschlather 7y ago
  MFA is a power tool for extra security. It deliberately sacrifices usability and integrity for security. If you want something more usable, you don't want MFA. Really though, I think "one-time passcodes" is the wrong escape hatch because it is actually just password auth, not a second factor. The way it ought to be is that you hook up multiple devices. (e.g. like having both a phone Authenticator app and a USB key.)
  - brnt 7y ago
    Or, I keep using single factor because services MFA implementation sucks tremendously, and as per service agreements service is liable in any security compromise case. Frankly, most of MFA is security masturbation, is nowhere near to being a real solution, not even a real problem. Its just neat from a technical standpoint (if done well, which nearly never happens). A minimum of 2 registered u2f keyfobs, that's all you need to make it usable and safe. Nobody does it, and trusts people either backup their otp codes or never lose or break phones. Ridiculous.
    - ocdtrekkie 7y ago
      MFA is always better than single factor. At the very least it makes drive by/automated attacks significantly harder. Everything you read about SIM jacking and the like is at bare minimum, much harder than hacking your password.
      - brnt 7y ago
        From a users perspective, MFA is nearly never better than single factor. Attacks are services responsibility anyway.
- 7y ago
Fire-Dragon-DoL 7y ago
Paypal though has no backup codes...

notlukesky 7y ago

Take a look at SAASPASS Authenticator & Password Manager. You can use them separately or integrate them for extra convenience and autofilling options. The desktop browser extension can autofill both passwords and Authenticator codes and on mobile with iOS 12 onwards with autofill capabilities.