3 ms·
Most services with OTP use "backup codes", which you are supposed to back up securely. Now, what's the difference to backing up the actual OTP "seed" or how is
by PufPufPuf 6y ago
Most services with OTP use "backup codes", which you are supposed to back up securely. Now, what's the difference to backing up the actual OTP "seed" or how is it called -- either by saving the original QR code, or a built-in backup functionality in the authenticator? Back-up codes give you the ability to log in and disable 2FA, which makes them as powerful as the actual authenticator.
OTP is bad, as you pointed out, but backing up the seed does not make it worse.
I admit I use Aegis because of the backup functionality. (Well, also for the support for Steam...) After using Google Authenticator, losing my phone and having to use backup codes and painfully re-enable 2FA on all my accounts, I realized that using an authenticator with backup is much simpler than the backup codes.
- jrockway 6y agoYeah, you're right. The backup codes are a big pain, and kill the security of the account. (Like many others, I don't print those out... they're just in my password manager.) OTP backup is no less secure than that, and is a strong usability improvement. Things would be way better if people just implemented WebAuthn, though. It's more secure than OTPs, and it's so transparent and easy to use that people think it's less secure. Passwords and OTPs should go away, and it's only a few lines of Javascript to make them go away. Sigh!
- PufPufPuf 6y agoI agree with you, but we live in a world where we need to be grateful for webpages that use standards-based OTP, and don't see 2FA as just another opportunity to make you install their mobile app. (Looking at Steam and many others...) WebAuthn is wayyy too much to ask nowadays.