7 ms·
Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. I think the bigger issue is that people's 2fa co
by nooyurrsdey 6y ago
Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring.
I think the bigger issue is that people's 2fa codes are still tied to their phone. You can lose your phone at any moment, which is why i've always disliked apps like Google Authenticator which don't let you export 2fa keys (for good reason).
I personally use 1password, but there's definitely room for a cloud storage solution that safely holds 2fa credentials
- manojlds 6y agoIsn't there Authy?
- vmception 6y agoAuthy's SMS convenience/reliance undermines the whole thing. Avoid.
- jackson1442 6y agoYou can turn off Multi-Device at any time, which just disables the ability to add new devices. I think that's protection enough.
- xvector 6y agoAuthy supports symmetrically encrypting your OTP codes with a password which is fine IMO: https://authy.com/blog/how-the-authy-two-factor-backups-work/ https://authy.com/blog/how-the-authy-two-factor-backups-work...
- lebaux 6y agoI recommend andOTP and Aegies if you are using android. The first one is more mature, second more actively developed. Both open source with ability to backup you database.
- triyambakam 6y agoThanks for sharing that! I've been looking for something besides Google Authenticator
- bickeringyokel 6y agoYou can export to multiple devices now on Google authenticator, other 2FA apps have also supported that for quite a while. As far as cloud storage goes, standard notes might be a good option, I don't use it for 2FA, but it's an extension they provide.
- hnick 6y agoYes, I can confirm I've had the same google auth token on multiple devices both concurrently and when setting up new phones for a SaaS login for years now.
- dukeofharen 6y agoI use FreeOTP+ for Android because it allows me to backup its data.
- tybulewicz 6y agoGoogle Authenticator now allows you to export your keys to another phone. I keep my keys in analog form - I print QR code for every service. We know how to handle valuables stored on paper.
- edoceo 6y agoI do this too. And each time I mention my hard copies I also have to explain there are actually 3 copies, physically isolated, etc. Hope you're doing the same.
- techntoke 6y agoI use Password Store for Android and also on Desktop, and they are backed up to my Google Drive
- gknoy 6y agoWould you be willing to describe the process you use to do this?
- klohto 6y agoScreenshot the QR Code and print it? Put it in a vault or store somewhere safe. It’s a standard practice for securing enterprise accounts (AWS root acc. for example)
- ffpip 6y agoYou can't screenshot it. The app puts a no screenshot request, so you have to scan the qr code from another phone.
- kenniskrag 6y agoAnd what is with DSGVO/GDPR to delete my data even without access?
- pilif 6y agoThe problem with storing the 2FA keys in 1Password is that you're practically downgrading your account to 1FA because once 1Password is compromised, the second factor lost all of its value, though that compromise is much harder to achieve than a compromised shared machine I'm typing my password in on (which you probably also should never do). I'm saying this as I'm looking at my 1Password database which also contains all my 2FA keys because, yes, all 2FA apps I tried so far treat these keys as way too valuable and the risk of losing them as I move from device to device is just too high. Do as I say, not as I do I guess :p I feel confident to rely on the security of my machine and 1Password specifically, though I am aware that I can't really claim my accounts to be secured by 2FA.
- modernerd 6y agoYes, in 1Password's 2FA announcement its head of security mentions that using 2FA in 1PW does not give you true 2FA: > If you would like to turn a site’s offering of TOTP into true two-factor security, you should not store your TOTP secret in 1Password (or in anything that will synchronize across systems). They mention multiple times that if you want true 2FA the second factor needs to be on a different device or a physical key like a YubiKey. Then they say that “two-step” security offered by 1PW + 2FA is probably enough for most use cases, and that 2FA in 1PW still has additional value because (a) some sites require 2FA and (b) one-time passwords offer protection against sniffing passwords over insecure networks. https://blog.1password.com/totp-for-1password-users/ https://blog.1password.com/totp-for-1password-users/ The fact that 1PW even auto-copies the code to your clipboard after auto-filling a password so that you can paste it in when prompted raised my eyebrows when I first used the feature, though. It's very convenient but it's obvious at that point that you're throwing away the protection that storing the key on a second device would offer, even if 1PW requires you to authenticate before the app will open.
- snorremd 6y agoI use Lastpass for passwords and Authy for 2FA for this exact reason. If my Lastpass is compromised they only get my passwords, not my 2FA tokens. If Authy is compromised and they manage to get my 2FA backup they still don't have my passwords.
- 6y ago
- INTPenis 6y agoI use AndOTP which allows you to encrypt, export and import the OTP database.
- undecisive 6y ago> Good - 2FA is the responsibility of the user and resetting it kind of invalidates the security it helps bring. Actually, no. This is a terrible idea. Think about the psychology of what you are telling people: "You have two choices - one is normal security, which you use on 80%+ of the rest of the internet, and one is 2fa which you only use on the annoying services that badger you into it. On the first one, if you lose your password you can do a password reset. On the second one, if your laptop and phone get fried in a rainstorm / car crash / act of children, you lose access to everything forever, no recourse and no recovery. And by the way, we totally encourage you to choose the second one... " Yes, online services that store credentials and backup passwords mitigate this somewhat, but they also add an attack vector via keyloggers, or make you dependent on the third party's security measures. And I probably don't need to point out to the HN crowd just how badly internet services are moving towards no-recourse solutions to petty problems to save money. Yet another one doing this is not a good thing.
- dependenttypes 6y ago> if you lose your password you can do a password reset I would argue that this is a negative thing. Sites should at least give the option to disable password reset.
- tclancy 6y agoWhat do you do if you find your password was compromised?
- dependenttypes 6y agoI use randomly generated passwords that are unique per site. It is more likely for someone to socially engineer the site support (or the registered mail account) than to guess it. Another annoying thing is that some sites do not consider your password enough even if you do not have 2fa enabled and they insist on sending you a mail (thanks github! - I can't connect to my account there because the registered mail was in my old domain) or an sms (thanks google/twitter! I had not even provided my phone number yet somehow giving it to you will verify that it's me)