5 ms·

If I wipe my phone, or get a new phone, I still have my phone number and can receive SMS. If I wipe my phone, I have permanently lost all of my TOTP codes if I

by Alupis 4y ago

If I wipe my phone, or get a new phone, I still have my phone number and can receive SMS. If I wipe my phone, I have permanently lost all of my TOTP codes if I wasn't careful and backed them up manually before wiping... TOTP is great for security conscious and technologically fluent folks... awful for your grandma.

danmur 4y ago
Bitwarden (and probably others) store the TOTP secrets and are persistent. This isn't a recommendation per se, I'm not sure how I feel about it being stored in the cloud, but it is a bit friendlier.
- Alupis 4y ago
  Sure, but this still requires a certain level of "awareness" for this technology. It's sort of the same problem PGP suffered from. It's technically great, but cumbersome for non-technical people to use (particularly in a safe way), so people will avoid it. 2FA needs to be simple and easy to achieve mass adoption. Making people install special apps for just one service, or find out one day they're permanently locked out of their facebook account (or far worse) is simply going to hurt adoption. If your grandmother can't make it work on her own, then it's not good enough. I'm not advocating SMS is the best option for 2FA, I'm just pointing out the alternatives are currently not up to snuff.
ByteJockey 4y ago
TOTP isn't inherently tied to phones.
- Alupis 4y ago
  No, it's tied to the app because the initial secret is destroyed after you set it up. Every single Authenticator App I've used (which is not all of them admittedly), requires manual backups - typically in some printed form. All of my other apps automatically back themselves up, or Apple/Google backs things up for me. When I get a new phone or wipe my phone... after logging into all my account I fully expect my Authenticator app to show up on my home screen and have all my codes in there exactly as I left it before. This is a huge pitfall for the unaware... you will lose all of your codes, and potentially access to whatever services or things they were protecting.
  - howinteresting 4y ago
    Use 1password or Bitwarden. They correctly back up TOTP secrets to the cloud. I consider Google Authenticator to be unacceptably bad.
    - Alupis 4y ago
      This is good advice, and I will look into Bitwarden for myself personally, but this isn't a great solution for non-techies... which is the problem with anything that is not SMS 2FA. We all agree SMS 2FA is not as secure as we'd like it to be... but no alternative exists. It's the classic sliding scale between usability and security. The most secure system is one you cannot use... and the most usable system is one with no security. We need something that is very usable, and still secure... perhaps a tall ask but that is indeed what we're after. Until then... regular people will continue to use SMS for 2FA. We should be happy people are at least comfortable with SMS 2FA instead of not using 2FA at all.
  - sigstoat 4y ago
    i agree that the authenticator app stuff is fraught for the average user. > No, it's tied to the app because the initial secret is destroyed after you set it up. Every single Authenticator App I've used (which is not all of them admittedly), requires manual backups - typically in some printed form. i scan the QR codes with a normal code reader, and then put the information into keepassxc. i can view the secret, generate codes, do whatever, and it's all with decent open source stuff and stored in a file i can back up.
  - happyopossum 4y ago
    Authy, 1password, bitwarden, and others back themselves up. If not having a cloud backup is a negative for you, pick a TOTP app that does have it - it’s not a failure of TOTP that the few apps you’ve used don’t back up (or you aren’t aware they do).
  - joshuaavalon 4y ago
    Most of the services provide backup codes when you enable 2FA. I don't think that's a huge problem.
300bps 4y ago
Do you have Android? iPhones are set to backup automatically to iCloud by default. I don’t even think about backups at all. I upgraded to an iPhone 13 about 6 months ago and it was almost completely seamless to restore everything to it.
- Alupis 4y ago
  Your authenticator apps won't be backed up. They require you to export them to a QR code or some other printed format... then "restored" once you setup your new phone. Probably a security policy thing more than a technology thing... but the result is the same. TOTP is dangerous for the wrong user.
  - happyopossum 4y ago
    That’s up to the developer, it’s not a requirement of TOTP apps.
  - jonhohle 4y ago
    For the past several years both macOS and iOS have TOTP built into the password manager. It’s non-obvious how to set it up and doesn’t auto-prompt readily like password management does, but I’ve moved all of my TOTP over and have a backup, it’s synced to all my devices, and I don’t need a dedicated TOTP app.
    - jb1991 4y ago
      Wow I never knew this.
coding123 4y ago
Too many people lose their phone number. TOTP at least is just a standard so you can either use a client that has backup options, write your own, or whatever. It's better.
- iainmerrick 4y ago
  It’s much more common to lose your phone than to lose your phone number (in the UK at least - most likely this varies by country).
jjav 4y ago
> If I wipe my phone, I have permanently lost all of my TOTP codes if I wasn't careful and backed them up manually before wiping... Do not, ever, store the TOTP seed in your phone! At least not as the one and only location.
- netik 4y ago
  why? what is your threat model that makes this a problem? are your passwords equally insecure?
  - pimterry 4y ago
    Somebody steals your phone. Now you have lost access to all TOTP and you can't log into anything with 2FA. This isn't about an attacker getting access to your TOTP codes - it's about you losing access to them.
- g_sch 4y ago
  I think this is good advice but it also shows why using TOTP as a default 2FA mechanism (instead of SMS) is a tough sell. How many people are set up to store a TOTP seed in a location other than their authenticator app? How many people even know what a TOTP seed is? I would wager that the vast majority of non-HN readers think of TOTP as a QR code that you scan into an authenticator app, if they are even familiar with authenticator apps. SMS, for all its security shortcomings, is at least something that the vast majority of people understand already.
  - gabereiser 4y ago
    Email would be preferred. SMS shouldn’t be the default. If I lost my TOTP tokens, I should be able to go through a tougher path with an email verification step to get in to redo my tokens. What I don’t want is for them to send me an SMS to verify me. What if I’m in a different country? What if I don’t have cell service? What if I don’t have access to my phone and that’s why I’m rotating all my stuff?
  - jjav 4y ago
    > SMS, for all its security shortcomings, is at least something that the vast majority of people understand already. But of course SMS suffers of the same problems as naive use of TOTP: Lose your phone, you're locked out of every account you have. So in the worst case, TOTP is as bad as SMS. But, with some awareness/education TOTP is far superior if the user doesn't fall into the trap of attaching the TOTP seed to a phone. i.e. for the aware user, TOTP is far better. For the naive user, TOTP is no worse than SMS. Thus, always favor TOTP.
netik 4y ago
well that’s not true if you use backups or authy
- guipsp 4y ago
  does your grandma use backups?

by Alupis 4y ago

danmur 4y ago

Bitwarden (and probably others) store the TOTP secrets and are persistent. This isn't a recommendation per se, I'm not sure how I feel about it being stored in the cloud, but it is a bit friendlier.

Alupis 4y ago
Sure, but this still requires a certain level of "awareness" for this technology. It's sort of the same problem PGP suffered from. It's technically great, but cumbersome for non-technical people to use (particularly in a safe way), so people will avoid it. 2FA needs to be simple and easy to achieve mass adoption. Making people install special apps for just one service, or find out one day they're permanently locked out of their facebook account (or far worse) is simply going to hurt adoption. If your grandmother can't make it work on her own, then it's not good enough. I'm not advocating SMS is the best option for 2FA, I'm just pointing out the alternatives are currently not up to snuff.

ByteJockey 4y ago

TOTP isn't inherently tied to phones.

Alupis 4y ago
No, it's tied to the app because the initial secret is destroyed after you set it up. Every single Authenticator App I've used (which is not all of them admittedly), requires manual backups - typically in some printed form. All of my other apps automatically back themselves up, or Apple/Google backs things up for me. When I get a new phone or wipe my phone... after logging into all my account I fully expect my Authenticator app to show up on my home screen and have all my codes in there exactly as I left it before. This is a huge pitfall for the unaware... you will lose all of your codes, and potentially access to whatever services or things they were protecting.
- howinteresting 4y ago
  Use 1password or Bitwarden. They correctly back up TOTP secrets to the cloud. I consider Google Authenticator to be unacceptably bad.
  - Alupis 4y ago
    This is good advice, and I will look into Bitwarden for myself personally, but this isn't a great solution for non-techies... which is the problem with anything that is not SMS 2FA. We all agree SMS 2FA is not as secure as we'd like it to be... but no alternative exists. It's the classic sliding scale between usability and security. The most secure system is one you cannot use... and the most usable system is one with no security. We need something that is very usable, and still secure... perhaps a tall ask but that is indeed what we're after. Until then... regular people will continue to use SMS for 2FA. We should be happy people are at least comfortable with SMS 2FA instead of not using 2FA at all.
- sigstoat 4y ago
  i agree that the authenticator app stuff is fraught for the average user. > No, it's tied to the app because the initial secret is destroyed after you set it up. Every single Authenticator App I've used (which is not all of them admittedly), requires manual backups - typically in some printed form. i scan the QR codes with a normal code reader, and then put the information into keepassxc. i can view the secret, generate codes, do whatever, and it's all with decent open source stuff and stored in a file i can back up.
- happyopossum 4y ago
  Authy, 1password, bitwarden, and others back themselves up. If not having a cloud backup is a negative for you, pick a TOTP app that does have it - it’s not a failure of TOTP that the few apps you’ve used don’t back up (or you aren’t aware they do).
- joshuaavalon 4y ago
  Most of the services provide backup codes when you enable 2FA. I don't think that's a huge problem.

300bps 4y ago

Do you have Android? iPhones are set to backup automatically to iCloud by default. I don’t even think about backups at all. I upgraded to an iPhone 13 about 6 months ago and it was almost completely seamless to restore everything to it.

Alupis 4y ago
Your authenticator apps won't be backed up. They require you to export them to a QR code or some other printed format... then "restored" once you setup your new phone. Probably a security policy thing more than a technology thing... but the result is the same. TOTP is dangerous for the wrong user.
- happyopossum 4y ago
  That’s up to the developer, it’s not a requirement of TOTP apps.
- jonhohle 4y ago
  For the past several years both macOS and iOS have TOTP built into the password manager. It’s non-obvious how to set it up and doesn’t auto-prompt readily like password management does, but I’ve moved all of my TOTP over and have a backup, it’s synced to all my devices, and I don’t need a dedicated TOTP app.
  - jb1991 4y ago
    Wow I never knew this.

coding123 4y ago

Too many people lose their phone number. TOTP at least is just a standard so you can either use a client that has backup options, write your own, or whatever. It's better.

iainmerrick 4y ago
It’s much more common to lose your phone than to lose your phone number (in the UK at least - most likely this varies by country).

jjav 4y ago

> If I wipe my phone, I have permanently lost all of my TOTP codes if I wasn't careful and backed them up manually before wiping... Do not, ever, store the TOTP seed in your phone! At least not as the one and only location.

netik 4y ago
why? what is your threat model that makes this a problem? are your passwords equally insecure?
- pimterry 4y ago
  Somebody steals your phone. Now you have lost access to all TOTP and you can't log into anything with 2FA. This isn't about an attacker getting access to your TOTP codes - it's about you losing access to them.
g_sch 4y ago
I think this is good advice but it also shows why using TOTP as a default 2FA mechanism (instead of SMS) is a tough sell. How many people are set up to store a TOTP seed in a location other than their authenticator app? How many people even know what a TOTP seed is? I would wager that the vast majority of non-HN readers think of TOTP as a QR code that you scan into an authenticator app, if they are even familiar with authenticator apps. SMS, for all its security shortcomings, is at least something that the vast majority of people understand already.
- gabereiser 4y ago
  Email would be preferred. SMS shouldn’t be the default. If I lost my TOTP tokens, I should be able to go through a tougher path with an email verification step to get in to redo my tokens. What I don’t want is for them to send me an SMS to verify me. What if I’m in a different country? What if I don’t have cell service? What if I don’t have access to my phone and that’s why I’m rotating all my stuff?
- jjav 4y ago
  > SMS, for all its security shortcomings, is at least something that the vast majority of people understand already. But of course SMS suffers of the same problems as naive use of TOTP: Lose your phone, you're locked out of every account you have. So in the worst case, TOTP is as bad as SMS. But, with some awareness/education TOTP is far superior if the user doesn't fall into the trap of attaching the TOTP seed to a phone. i.e. for the aware user, TOTP is far better. For the naive user, TOTP is no worse than SMS. Thus, always favor TOTP.

netik 4y ago

well that’s not true if you use backups or authy

guipsp 4y ago
does your grandma use backups?