3 ms·

I'm not sure what contrived scenarios you're envisioning, but if the threat model is, once again, 'person in proximity', they don't have to "steal" anything, th

I'm not sure what contrived scenarios you're envisioning, but if the threat model is, once again, 'person in proximity', they don't have to "steal" anything, they can simply use it, e.g. authenticate with the key while you're in the shower. And if in your model they presumably already know your password, it stands to reason they also know your PIN.

Spooky23 5y ago
Proximity of what? With a hardware token, it’s very clear that the token is in the physical possession of the user or not. It can only be in one place at a time. With a challenge/response or PIN, you mitigate the risk of the user losing possession. With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation, he has also provided the kid or other household member/visitor with access to the token. The token is wherever Authy is. The point is TOTP shares all of the risks associated with things like SSH private keys. It has value, but is inferior to many other types of token.
- Ansil849 5y ago
  > With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation My little one plays with my keychain, which has my U2F keys on it, all the time. She likes the light the BLE U2F fob has. I don't see the distinction you're making between TOTP and U2F if your threat model is 'someone in your house', the two are virtually indistinguishable in such a scenario - in fact, the U2F is less secure. Your "soon to be ex-spouse" can easily use your hardware token while you're in the shower, as I said above.
  - Spooky23 5y ago
    I guess we need to agree to disagree. In my opinion, having one physical key is better than a private key synced via cloud service to a half dozen devices. ”Something you have” implies in your custody.
    - Ansil849 5y ago
      It's against best practice to have just one U2F key, in case you lose one. Best practice is to have at least two, and to not keep the two together.

Spooky23 5y ago

Proximity of what? With a hardware token, it’s very clear that the token is in the physical possession of the user or not. It can only be in one place at a time. With a challenge/response or PIN, you mitigate the risk of the user losing possession. With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation, he has also provided the kid or other household member/visitor with access to the token. The token is wherever Authy is. The point is TOTP shares all of the risks associated with things like SSH private keys. It has value, but is inferior to many other types of token.

Ansil849 5y ago
> With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation My little one plays with my keychain, which has my U2F keys on it, all the time. She likes the light the BLE U2F fob has. I don't see the distinction you're making between TOTP and U2F if your threat model is 'someone in your house', the two are virtually indistinguishable in such a scenario - in fact, the U2F is less secure. Your "soon to be ex-spouse" can easily use your hardware token while you're in the shower, as I said above.
- Spooky23 5y ago
  I guess we need to agree to disagree. In my opinion, having one physical key is better than a private key synced via cloud service to a half dozen devices. ”Something you have” implies in your custody.
  - Ansil849 5y ago
    It's against best practice to have just one U2F key, in case you lose one. Best practice is to have at least two, and to not keep the two together.