3 ms·
To me, backups are something you don't want for 2FA. It just turns your second factor into an unergonomic first factor. What you want is the ability to enroll
by jrockway 6y ago
To me, backups are something you don't want for 2FA. It just turns your second factor into an unergonomic first factor. What you want is the ability to enroll multiple authenticators. Newer standards like WebAuthn make this trivial -- for accounts I have that support WebAuthn, I have a portable security key on my keychain, a "permanent" key on my workstation, Windows Hello, and FaceID that can all be used to log in. If I lose one of those devices, I just use another method to log in (and revoke that credential, of course!) and it's no problem at all.
I think what is killing adoption here is the reliance of so many third-parties on Google Authenticator style OTPs. OTPs are terrible -- you completely lose 2FA if you lose your phone, and OTPs are easily phished. I don't know why it's so popular, whether it's some regulation, or whether people just wrote their 2FA code a decade ago and haven't updated their flow to accommodate newer standards. Whatever the reason, it is just driving people to develop and use cloud-based password managers and OTP syncers like this, and those things aren't helping security. They're giving people a false sense of security; they feel like they are as protected as having a physical token required for all logins to important apps, but without any of the protection. It's less than ideal.
- PufPufPuf 6y agoMost services with OTP use "backup codes", which you are supposed to back up securely. Now, what's the difference to backing up the actual OTP "seed" or how is it called -- either by saving the original QR code, or a built-in backup functionality in the authenticator? Back-up codes give you the ability to log in and disable 2FA, which makes them as powerful as the actual authenticator. OTP is bad, as you pointed out, but backing up the seed does not make it worse. I admit I use Aegis because of the backup functionality. (Well, also for the support for Steam...) After using Google Authenticator, losing my phone and having to use backup codes and painfully re-enable 2FA on all my accounts, I realized that using an authenticator with backup is much simpler than the backup codes.
- jrockway 6y agoYeah, you're right. The backup codes are a big pain, and kill the security of the account. (Like many others, I don't print those out... they're just in my password manager.) OTP backup is no less secure than that, and is a strong usability improvement. Things would be way better if people just implemented WebAuthn, though. It's more secure than OTPs, and it's so transparent and easy to use that people think it's less secure. Passwords and OTPs should go away, and it's only a few lines of Javascript to make them go away. Sigh!
- PufPufPuf 6y agoI agree with you, but we live in a world where we need to be grateful for webpages that use standards-based OTP, and don't see 2FA as just another opportunity to make you install their mobile app. (Looking at Steam and many others...) WebAuthn is wayyy too much to ask nowadays.