6 ms·
How annoying, in particular that service providers expect me to have a mobile phone and that the phone represents me (can not be lost, etc)
by avodonosov 5y ago
How annoying, in particular that service providers expect me to have a mobile phone and that the phone represents me (can not be lost, etc)
- derekp7 5y agoYou don't need a mobile phone for TOTP -- you can do it from a shell script and openssl. Many security keys support storing TOTP built in, and Google also supports the various security key protocols (FIDO2 I think is the current version?)
- deleted 5y ago[deleted]
- dane-pgp 5y agoI should point out that FIDO2 allows sites to require that visitors use a device from a specific whitelist of devices.[0] Google has already tightened the requirements by mandating 2FA, so don't be surprised when they start blocking "insecure" factors like shell scripts. It probably wouldn't go down well if Google required an Android device to provide the second factor, but I could definitely see them requiring a device which does biometric verification of the user. That's a pretty good way of connecting online activity to a specific human (assuming the attacker can gain physical access to your authentication device, and has a model of your fingerprint/face, which governments increasingly do have). [0] https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Attestation.html https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu...
- scrollaway 5y agoGoogle doesn't, they still allow you to use TOTP 2FA.
- Someone1234 5y agoYou don't have to use a mobile phone/SMS for Google 2FA. You can use: - Hardware key (fido u2f). - TOTP or HOTP generator (on any platform, PC, Mac, iOS, Android, whatever). - Trusted Device.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- avodonosov 5y agoIn all those cases the user needs a device for auth
- Someone1234 5y agoYou also need a device for logging into a Google Account at all. These can be the same device.
- avodonosov 5y agoWith password I can login from any device (guest session on a friend's laptop, etc). So I am independent of a specific device. The second factor ties me to a specific device.
- Someone1234 5y agoTOTP does not. Plus Google supports multiple concurrent 2FA tokens anyway.
- avodonosov 5y agoMultiple still tie user to specific devices. It will not work on a friends machine (unless user memorises the shared secret used for hashes). TOTP is essentially a glorified password (which is the shared secret), only so long that the user presumably does not remember it, so it is taken as a representation of a trusted device access. TOTP / HOTP are close to manual CHAP. I don't feel two passwords (the real password and TOTP shared secret) are better than one.
- 5y ago
- q1w2 5y agoWhile I agree with your general point about the pressure to link accounts to phone numbers... The post specifically states that there are other forms of 2FA, including token based.
- ziml77 5y agoThey don't think the phone represents you. But the combination of proving you know the password and that you have physical access to a trusted device increases the confidence that it's you by a lot. Depending on the form of second factor you use, it can stop phishing attacks (and don't say you'll never fall for one, anyone can make a mistake). The "send a notification" option for 2FA gives you information about where the login request is coming from, which is a chance to check that someone isn't sitting in the middle of login process. And something like WebAuthn makes phishing impossible outside of a browser exploit since the domains won't match.
- andrewzah 5y agoYou can lose the phone, just use your backup codes. Bitwarden supports otp and you can use that from any browser.
- browningstreet 5y agoI'm a technical person and I have no idea what your post means... and I also need to figure this out and explain it to the rest of my (extended) family. Google Accounts are the new printers, familial-y speaking.
- andrewzah 5y agoOne common 2FA method is TOTP (time-based, one time password). Bitwarden [0] is a password/secrets manager that you can host yourself. It supports TOTP so you can just use that instead of a separate app like Google Authenticator or Authy. I would not recommend this personally as if you expose your master password for bitwarden, you've also made it possible for the attacker to sign in via 2FA... which normally would require access to your phone or backup keys. But it is more convenient. Basically, people should be using password managers by this point. I recommend bitwarden because you can host it yourself, it's good for storing other secrets, and it has browser plugins/apps. [0]: https://bitwarden.com/ https://bitwarden.com/
- browningstreet 5y agoThanks for the explanation. Follow-up question: I downloaded Authy on my phone and my desktop, and the first thing it wants is a phone number. I'm trying to solve for not having a phone -- can Bitwarden's TOTP be used without a phone number being provided? Thanks in advance.
- PufPufPuf 5y agoBitwarden does not require a phone, but it sadly TOTP support is only in the paid version. What I do is keep TOTP in an app called Aegis, which supports backing up the seeds. This way, I can always use the seed file to setup Aegis on a new device.
- UncleMeat 5y agoThis is only rolling out to people who already have devices attached to Google services.