3 ms·
> With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation My little one plays with my keycha
by Ansil849 5y ago
> With a TOTP token, if a user puts Authy or 1Password on the family iPad so their kid has access to MFA for the PlayStation
My little one plays with my keychain, which has my U2F keys on it, all the time. She likes the light the BLE U2F fob has.
I don't see the distinction you're making between TOTP and U2F if your threat model is 'someone in your house', the two are virtually indistinguishable in such a scenario - in fact, the U2F is less secure. Your "soon to be ex-spouse" can easily use your hardware token while you're in the shower, as I said above.
- Spooky23 5y agoI guess we need to agree to disagree. In my opinion, having one physical key is better than a private key synced via cloud service to a half dozen devices. ”Something you have” implies in your custody.
- Ansil849 5y agoIt's against best practice to have just one U2F key, in case you lose one. Best practice is to have at least two, and to not keep the two together.