5 ms·

SMS is better than nothing, but you have a bunch of other better fallback alternatives before you should rely on it. You can support the enrollment of multiple

SMS is better than nothing, but you have a bunch of other better fallback alternatives before you should rely on it. You can support the enrollment of multiple hardware tokens (i.e., you keep one at home, and one on your person). You can have online push login approvals. You can have a TOTP code generator.

paulryanrogers 5y ago
> You can support the enrollment of multiple hardware tokens (i.e., you keep one at home, and one on your person). How many services do that today? And since so few people have fallbacks what is their recovery process like? Because the hackers will find the weaknesses.
- tialaramex 5y ago
  WebAuthn explicitly tells Relying Parties (ie web sites) to all do this. All the services I use which offer WebAuthn or its predecessor U2F support multiple named hardware tokens and I enroll at least my Yubico branded device and one more at such sites. For those I use from a phone, the phone itself is enrolled. AWS is the counter-example which will be (indeed already has been in this HN comment tree) cited as proof sites don't all do this, I've tried asking if there are literally any others, and never received any ideas. I don't currently have an employer and I don't use AWS for personal projects. It's pretty common for sites that actually care about authenticating you (so, Google but not your Bank, GitHub but not your mortgage lender) to provide you with single use bypass codes which they tell you to write down and keep somewhere safe.
UncleMeat 5y ago
TOTP is the one that makes the least sense to me. It is also weak to phishing (extremely common) but adds protection against SIM-swapping (comparatively very rare). It also has almost all of the downsides of U2F (a pain in the ass if you lose your device).
- nucleardog 5y ago
  TOTP has the downsides of U2F, but those downsides are comparatively easier to mitigate. Put a plan together for the "house burns down" scenario. With U2F I need to enroll multiple tokens and keep some off-site. So what does this entail? I keep maybe 3 tokens, two on-site that I add the new account to, then on a regular schedule I rotate one off-site and bring the third one on-site and go back through and add it to any accounts I've created in the meantime? The whole process is a pain in the ass, and not all sites allow multiple devices to be registered (e.g., AWS). And new accounts are still vulnerable during the time between registering and rotating the third key on-site. With TOTP you can... just sync your TOTP database. Some apps such as Microsoft Authenticator do this on their own. Personally, I put all my TOTP secrets into a Keepass database and sync it off-site with Nextcloud. There is no way for the site to limit how many devices I enroll so it's easy enough to create as many backup devices as you need. If you're really old school, you can print the secrets and put them in a fire safe. FWIW, I have several yubikeys. I primarily use them as a secure store for TOTP secrets and to store a SSH key (generated off-device and backed up), not for webauthn. It's just too annoying to deal with in a way that ensures I don't lock myself out of an account.
- derefr 5y ago
  > a pain in the ass if you lose your device Every modern TOTP app is cloud-synced, so I'm not sure why people are saying it's "a pain in the ass if you lose your device." Heck, most modern password managers (e.g. 1Password, LastPass, etc.) are also TOTP, and help you fill the TOTP token (usually by putting in on your clipboard) at the same time they autofill the password. > It is also weak to phishing (extremely common) but adds protection against SIM-swapping (comparatively very rare). Sufficient paranoia / user training is enough to protect against phishing. (Especially for services where the only "users" are the extremely-paranoid IT admins themselves.) But nothing can really protect you from SIM-swapping, save for not allowing services that use single-factor SMS recovery to ever know your phone number in the first place.
  - UncleMeat 5y ago
    > Every modern TOTP app is cloud-synced I've got a few services that only support Symantec VIP, which does not allow you to extract secrets. > Sufficient paranoia / user training is enough to protect against phishing. Considering how easily actual factual professional security engineers fall for phishing, I don't believe you.

paulryanrogers 5y ago

> You can support the enrollment of multiple hardware tokens (i.e., you keep one at home, and one on your person). How many services do that today? And since so few people have fallbacks what is their recovery process like? Because the hackers will find the weaknesses.

tialaramex 5y ago
WebAuthn explicitly tells Relying Parties (ie web sites) to all do this. All the services I use which offer WebAuthn or its predecessor U2F support multiple named hardware tokens and I enroll at least my Yubico branded device and one more at such sites. For those I use from a phone, the phone itself is enrolled. AWS is the counter-example which will be (indeed already has been in this HN comment tree) cited as proof sites don't all do this, I've tried asking if there are literally any others, and never received any ideas. I don't currently have an employer and I don't use AWS for personal projects. It's pretty common for sites that actually care about authenticating you (so, Google but not your Bank, GitHub but not your mortgage lender) to provide you with single use bypass codes which they tell you to write down and keep somewhere safe.

UncleMeat 5y ago

TOTP is the one that makes the least sense to me. It is also weak to phishing (extremely common) but adds protection against SIM-swapping (comparatively very rare). It also has almost all of the downsides of U2F (a pain in the ass if you lose your device).

nucleardog 5y ago
TOTP has the downsides of U2F, but those downsides are comparatively easier to mitigate. Put a plan together for the "house burns down" scenario. With U2F I need to enroll multiple tokens and keep some off-site. So what does this entail? I keep maybe 3 tokens, two on-site that I add the new account to, then on a regular schedule I rotate one off-site and bring the third one on-site and go back through and add it to any accounts I've created in the meantime? The whole process is a pain in the ass, and not all sites allow multiple devices to be registered (e.g., AWS). And new accounts are still vulnerable during the time between registering and rotating the third key on-site. With TOTP you can... just sync your TOTP database. Some apps such as Microsoft Authenticator do this on their own. Personally, I put all my TOTP secrets into a Keepass database and sync it off-site with Nextcloud. There is no way for the site to limit how many devices I enroll so it's easy enough to create as many backup devices as you need. If you're really old school, you can print the secrets and put them in a fire safe. FWIW, I have several yubikeys. I primarily use them as a secure store for TOTP secrets and to store a SSH key (generated off-device and backed up), not for webauthn. It's just too annoying to deal with in a way that ensures I don't lock myself out of an account.
derefr 5y ago
> a pain in the ass if you lose your device Every modern TOTP app is cloud-synced, so I'm not sure why people are saying it's "a pain in the ass if you lose your device." Heck, most modern password managers (e.g. 1Password, LastPass, etc.) are also TOTP, and help you fill the TOTP token (usually by putting in on your clipboard) at the same time they autofill the password. > It is also weak to phishing (extremely common) but adds protection against SIM-swapping (comparatively very rare). Sufficient paranoia / user training is enough to protect against phishing. (Especially for services where the only "users" are the extremely-paranoid IT admins themselves.) But nothing can really protect you from SIM-swapping, save for not allowing services that use single-factor SMS recovery to ever know your phone number in the first place.
- UncleMeat 5y ago
  > Every modern TOTP app is cloud-synced I've got a few services that only support Symantec VIP, which does not allow you to extract secrets. > Sufficient paranoia / user training is enough to protect against phishing. Considering how easily actual factual professional security engineers fall for phishing, I don't believe you.