3 ms·

> TOTP is too easy to share or steal, especially for targeted or familiar person attacks. I’ve encountered fraud scenarios where soon to be ex-spouses accessed

> TOTP is too easy to share or steal, especially for targeted or familiar person attacks. I’ve encountered fraud scenarios where soon to be ex-spouses accessed an account via a iPad with authy to get at someone. If your threat model is 'person in proximity of other person being able to access the second factor' then no method of 2FA is safe. Even if you use U2F, the "soon to be ex-spouses" can easily take the dongle from their spouse's keychain, in fact even easier than they could get their OTP codes.

tialaramex 5y ago
> Even if you use U2F, the "soon to be ex-spouses" can easily take the dongle from their spouse's keychain Stealing the physical object is quite a step up from merely using something you have access to that was never de-authorised. And if you steal say, my Security Key 2 from Yubico, it still needs its PIN. Worse the phone I use to authenticate on mobile sites requires my fingerprint, which while far from impossible to fake is definitely another step beyond "I just assumed I was allowed" and now you've also stolen my phone, how long do you think you have before I notice?
- Ansil849 5y ago
  I'm not sure what contrived scenarios you're envisioning, but if the threat model is, once again, 'person in proximity', they don't have to "steal" anything, they can simply use it, e.g. authenticate with the key while you're in the shower. And if in your model they presumably already know your password, it stands to reason they also know your PIN.
  - Spooky23 5y ago
    Proximity of what? With a hardware token, it’s very clear that the token is in the physical possession of the user or not. It can only be in one place at a time. With a challenge/response or PIN, you mitigate the risk of the user losing possession. With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation, he has also provided the kid or other household member/visitor with access to the token. The token is wherever Authy is. The point is TOTP shares all of the risks associated with things like SSH private keys. It has value, but is inferior to many other types of token.
    - Ansil849 5y ago
      > With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation My little one plays with my keychain, which has my U2F keys on it, all the time. She likes the light the BLE U2F fob has. I don't see the distinction you're making between TOTP and U2F if your threat model is 'someone in your house', the two are virtually indistinguishable in such a scenario - in fact, the U2F is less secure. Your "soon to be ex-spouse" can easily use your hardware token while you're in the shower, as I said above.
      - Spooky23 5y ago
        I guess we need to agree to disagree. In my opinion, having one physical key is better than a private key synced via cloud service to a half dozen devices. ”Something you have” implies in your custody.
        Ansil849 5y ago
        It's against best practice to have just one U2F key, in case you lose one. Best practice is to have at least two, and to not keep the two together.
- deleted 5y ago
  [deleted]

tialaramex 5y ago

> Even if you use U2F, the "soon to be ex-spouses" can easily take the dongle from their spouse's keychain Stealing the physical object is quite a step up from merely using something you have access to that was never de-authorised. And if you steal say, my Security Key 2 from Yubico, it still needs its PIN. Worse the phone I use to authenticate on mobile sites requires my fingerprint, which while far from impossible to fake is definitely another step beyond "I just assumed I was allowed" and now you've also stolen my phone, how long do you think you have before I notice?

Ansil849 5y ago
I'm not sure what contrived scenarios you're envisioning, but if the threat model is, once again, 'person in proximity', they don't have to "steal" anything, they can simply use it, e.g. authenticate with the key while you're in the shower. And if in your model they presumably already know your password, it stands to reason they also know your PIN.
- Spooky23 5y ago
  Proximity of what? With a hardware token, it’s very clear that the token is in the physical possession of the user or not. It can only be in one place at a time. With a challenge/response or PIN, you mitigate the risk of the user losing possession. With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation, he has also provided the kid or other household member/visitor with access to the token. The token is wherever Authy is. The point is TOTP shares all of the risks associated with things like SSH private keys. It has value, but is inferior to many other types of token.
  - Ansil849 5y ago
    > With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation My little one plays with my keychain, which has my U2F keys on it, all the time. She likes the light the BLE U2F fob has. I don't see the distinction you're making between TOTP and U2F if your threat model is 'someone in your house', the two are virtually indistinguishable in such a scenario - in fact, the U2F is less secure. Your "soon to be ex-spouse" can easily use your hardware token while you're in the shower, as I said above.
    - Spooky23 5y ago
      I guess we need to agree to disagree. In my opinion, having one physical key is better than a private key synced via cloud service to a half dozen devices. ”Something you have” implies in your custody.
      - Ansil849 5y ago
        It's against best practice to have just one U2F key, in case you lose one. Best practice is to have at least two, and to not keep the two together.
deleted 5y ago
[deleted]