5 ms·

From a cryptographic perspective, when dealing with authentication the different methods fall in one of the different categories: 1) Something you know (e.g. a

by GTP 6y ago

From a cryptographic perspective, when dealing with authentication the different methods fall in one of the different categories: 1) Something you know (e.g. a password) 2) Something you have (e.g. a token) 3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...) Real OTPs fall in the second category, because you have some device/application that is able to generate the same OTP code as the server handling authentication without communicating with the server. Now there are some popular solutions that are still being called OTPs that instead of something you have is something that is sent to you, like SMS OTP. This isn't just quibbling, because sending something each time authentication is needed, opens up the possibility for some attacks that wouldn't be possible with proper OTPs, e.g. SIM swapping. So to answer you question: - Just having to click on a link sent via email has the problems outlined in other comments - having to both enter a password and having a link sent to your email address is safer than just enter a password, but - having a true OTP, like the TOTP standard, is what provides the best security (in the category of OTPs, I'm not talking about protocols like FIDO2 and similar, because I don't know them). EDIT: formatting

squiggleblaz 6y ago
Every system that relies on passwords also provides a password reset facility. The facility typically sends a token to your email address and allows you to set your password that way. Doesn't this mean that a system which relies on an token sent to you is no worse that a system with a password? With a password, you can guess that GTP used the same password on Hacker News and BigBank, and if that fails, you can try and have their token redirected to you. Without a password, you have to rely on getting that token. So if your argument is that email and SMS are insecure channels, I mean yeah okay; but it doesn't make a system more secure if you can get in with a password _or_ an email/SMS vs the only option is an email/SMS. I hate passwords; my password manager (the one built into Firefox) will generate passwords on my desktop, but most of the time I need to generate a password it's on my phone (where, oddly, they have not included the capacity to generate a password). So my password is crap, perhaps not stored, and I forget it. I rely entirely on the password reset facility. But most of the time if you tell me "please just sign up, think of a unique username and a secure password" I'm just not going to bother.
- hnlmorg 6y ago
  I'm not going to defend passwords, they are a usability nightmare. But I'm yet to see a solution that consistently works better. Regarding your problems, it sounds like you're in need of a better password manager. I personally use LastPass. I'm not saying it's the best out there but I've been using it for a few years and haven't felt the need to jump ship yet. The advantage of having a 3rd party password manage is that it can run on your phone, tablet, laptop and any browsers you want.
  - squiggleblaz 6y ago
    I can run the builtin Firefox password manager on my phone, tablet, laptop and any browsers I want :p It would just be nice if it supported password generation where I need it most.
    - hnlmorg 6y ago
      Which just emphasises my point that you need a better password manager which does support password generation on every device. LastPass being one such example.
      - squiggleblaz 6y ago
        I meant my first comment in jest. I will consider your advice, but I imagine switching from one password manager to another will only certify me as a genuine and eternal password hater. (Also, a password stored in a password manager is something you have, not something you know, so it's completely inconsistent with the principle of MFA. I mean, the reasons to hate passwords just increase as long as I think about it. That probably only hurts the theory of passwords though, not the practice of them.)
        hnlmorg 6y ago
        There is another option if you wish to adhere to the principle of "something I know" and that's to generate a base64 key. eg SITE="www.example.com" SALT="passphrase" printf "${SALT}${SITE}" | shasum -a 512 | base64 | cut -c -25 (Though you're better off using some online tool that converts SHA 512 to base64 directly since the example above converts the ASCII string of a hex representation of the SHA 512 hash into base 64. So use that example above more as a visual representation) This will generate a non-reversible password with an entropy of 25^64 but it is re-creatable on any system that can display a web page and the password is not stored anywhere (so it's firmly "something you know"). If the password becomes compromised then you change your salt and a new unique password will be generated. Thus you only need to memorise a small subset of salts rather than a password per site. This was how I used to do passwords several years ago before I gave into the convenience of password managers.
hnlmorg 6y ago
> 3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...) I've always considered them to be more like user names, albeit with a larger entropy than your average user string. Completely agree with your points though. Particularly with regards to OTP. I'd further expand on that and say hosting your TOTP codes in the same password management tool as your passwords themselves (as some tools are now offering) is also really bad idea.
UncleMeat 6y ago
People love to complain about sim swapping but in reality phishing is far more common. TOTP that you type in loses to phishing. Having a complex and unique password for each service largely defeats sim swapping.

by GTP 6y ago

squiggleblaz 6y ago

Every system that relies on passwords also provides a password reset facility. The facility typically sends a token to your email address and allows you to set your password that way. Doesn't this mean that a system which relies on an token sent to you is no worse that a system with a password? With a password, you can guess that GTP used the same password on Hacker News and BigBank, and if that fails, you can try and have their token redirected to you. Without a password, you have to rely on getting that token. So if your argument is that email and SMS are insecure channels, I mean yeah okay; but it doesn't make a system more secure if you can get in with a password _or_ an email/SMS vs the only option is an email/SMS. I hate passwords; my password manager (the one built into Firefox) will generate passwords on my desktop, but most of the time I need to generate a password it's on my phone (where, oddly, they have not included the capacity to generate a password). So my password is crap, perhaps not stored, and I forget it. I rely entirely on the password reset facility. But most of the time if you tell me "please just sign up, think of a unique username and a secure password" I'm just not going to bother.

hnlmorg 6y ago
I'm not going to defend passwords, they are a usability nightmare. But I'm yet to see a solution that consistently works better. Regarding your problems, it sounds like you're in need of a better password manager. I personally use LastPass. I'm not saying it's the best out there but I've been using it for a few years and haven't felt the need to jump ship yet. The advantage of having a 3rd party password manage is that it can run on your phone, tablet, laptop and any browsers you want.
- squiggleblaz 6y ago
  I can run the builtin Firefox password manager on my phone, tablet, laptop and any browsers I want :p It would just be nice if it supported password generation where I need it most.
  - hnlmorg 6y ago
    Which just emphasises my point that you need a better password manager which does support password generation on every device. LastPass being one such example.
    - squiggleblaz 6y ago
      I meant my first comment in jest. I will consider your advice, but I imagine switching from one password manager to another will only certify me as a genuine and eternal password hater. (Also, a password stored in a password manager is something you have, not something you know, so it's completely inconsistent with the principle of MFA. I mean, the reasons to hate passwords just increase as long as I think about it. That probably only hurts the theory of passwords though, not the practice of them.)
      - hnlmorg 6y ago
        There is another option if you wish to adhere to the principle of "something I know" and that's to generate a base64 key. eg SITE="www.example.com" SALT="passphrase" printf "${SALT}${SITE}" | shasum -a 512 | base64 | cut -c -25 (Though you're better off using some online tool that converts SHA 512 to base64 directly since the example above converts the ASCII string of a hex representation of the SHA 512 hash into base 64. So use that example above more as a visual representation) This will generate a non-reversible password with an entropy of 25^64 but it is re-creatable on any system that can display a web page and the password is not stored anywhere (so it's firmly "something you know"). If the password becomes compromised then you change your salt and a new unique password will be generated. Thus you only need to memorise a small subset of salts rather than a password per site. This was how I used to do passwords several years ago before I gave into the convenience of password managers.

hnlmorg 6y ago

> 3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...) I've always considered them to be more like user names, albeit with a larger entropy than your average user string. Completely agree with your points though. Particularly with regards to OTP. I'd further expand on that and say hosting your TOTP codes in the same password management tool as your passwords themselves (as some tools are now offering) is also really bad idea.

UncleMeat 6y ago

People love to complain about sim swapping but in reality phishing is far more common. TOTP that you type in loses to phishing. Having a complex and unique password for each service largely defeats sim swapping.