7 ms·

I get a lot of eye rolling when I go around pointing out that one-time codes are not, by definition, multi-factor auth. Google and some other services properly

• glenstein 5y ago
  I've always had trouble conceptually with two factor authentication conceived of in this way. If a phone is something you have, then it gives you a code, and you put in that code, so it's really just a code. If it's something you have, well, probably a key right? A usb key? But it's a code on the USB key. If it's something about you (voice, fingerprint, etc), or a location, it's ultimately something represented as information. That's not to say it's a bad philosophy or less secure. It's better, not worse. But it seems to be conceived of and framed in a way as though it's appealing to something other than stuff that gets turned into computer-accessible information. The one "hard" category that seems to make sense to me has to do with hard-wired networks, and having to be in a physical place to access a system that is not online. That creates a real distinction that doesn't boil down to some form of computer-comprehensible information.
  • loteck 5y ago
    But you yourself don't know the code on the hardware token, nor do you yourself know the information gathering, encoding or decoding for biometric information. Those are still pieces of information, but they aren't "something you know." To your later point, some later versions of these original authentication factors have added "somewhere you are" to the list.
    • e12e 5y ago
      There's no reason a totp/otp needs to be read/typed in the clear - that's merely a convenient way to bridge trust from a phone to a desktop etc. The otp is proof that you "possess" the otp secret. Then again, it's a shared secret - so if the server side is compromised - all bets are off. Here client certificates/public key crypto does better.
      • loteck 5y ago
        Right, the new factor is working fine, but instead of providing authentication, it's being used to merely attest to the validity of an additionally provided randomized knowledge factor, which is what gets actually for used for authentication.
        • e12e 5y ago
          So a hash of an image of a fingerprint isn't "something you have"? Leaves few things in that category then?
• bawolff 5y ago
  I'd still call it something you have. If someone kidnapped you, you wouldn't be able to reveal your TOTP password without your device. The problem is the communication channel isn't bound to the authentication context the way it would be with a fido key. But that could be a flaw with any type of authenticator (albeit its much easier to seamlessly fix with other types) - its not about what type of factor it is.
  • loteck 5y ago
    It is something you have, until it is automatically downgraded to something you know. I could create all manner of elaborate schemes that involve tokens and biometrics and geolocation, but if that scheme simply produces a one-time code for you to put in your brain and produce at will, I'm still using a knowledge factor at the point of authentication.
• e12e 5y ago
  > Known passwords of any type are all in the first category, Not really. People don't "know" their totp secret or their RSA secret key. But yes, when these key-style secrets can be transfered - they behave more like "know of" than "in possession of". The simple mitigation is probably fido2 auth tokens.
  • pas 5y ago
    Signed auth requests. Using enrolled phones works well.