2 ms·

TOTP is a second factor because you can't store it in your mind (and therefore it's not something you know, but something you have to have). You could defeat th

TOTP is a second factor because you can't store it in your mind (and therefore it's not something you know, but something you have to have). You could defeat that using this virtual FIDO project or by storing the secret in readable format in a password manager that itself can be unlocked with your knowledge, but if we're just trying to find ways to use factors in a way that makes them useless, you can also just store them in a pastebin, it's free and all you need on any computer is to just visit your paste url!

pas 4y ago
I store both passwords and 2FA in an automated software. 2FA seeds can be exported (eg. when moving to a new phone). the categorization makes some minimal sense, but basically any additional not-identical "factor" is additional security (though there's obviously a diminishing return because of the complexity-vs-security trade off).
- tzmudzin 4y ago
  > I store both passwords and 2FA in an automated software. This effectively reduces the 2nd factor to the first, and indeed produces the diminishing return. It's sufficient to hack one system using one method and you compromise both defenses. The point behind 2nd factor is to provide a second, *independent* layer of protection that would need to be compromised using an entirely different attack. In the case of the FIDO2 dongles including the Yubikeys the secret isn't even stored on your system, but on the device itself that doesn't even disclose it to your connected system.
  - pas 4y ago
    Um, excuse my shoddy phrasing. I meant a desktop password manager and a mobile TOTP manager. Both are software, but they are not "a software", sorry. But yes, recently I have seen people use password managers that really do both in one single piece of software (a browser extension). I have a few U2F hardware devices, they are convenient when set up and plugged in, rather inconvenient otherwise :/

pas 4y ago

I store both passwords and 2FA in an automated software. 2FA seeds can be exported (eg. when moving to a new phone). the categorization makes some minimal sense, but basically any additional not-identical "factor" is additional security (though there's obviously a diminishing return because of the complexity-vs-security trade off).

tzmudzin 4y ago
> I store both passwords and 2FA in an automated software. This effectively reduces the 2nd factor to the first, and indeed produces the diminishing return. It's sufficient to hack one system using one method and you compromise both defenses. The point behind 2nd factor is to provide a second, *independent* layer of protection that would need to be compromised using an entirely different attack. In the case of the FIDO2 dongles including the Yubikeys the secret isn't even stored on your system, but on the device itself that doesn't even disclose it to your connected system.
- pas 4y ago
  Um, excuse my shoddy phrasing. I meant a desktop password manager and a mobile TOTP manager. Both are software, but they are not "a software", sorry. But yes, recently I have seen people use password managers that really do both in one single piece of software (a browser extension). I have a few U2F hardware devices, they are convenient when set up and plugged in, rather inconvenient otherwise :/