3 ms·

I actually prefer TOTP, at least personally, as a perfect compromise. The problems with FIDO, besides the obvious lack of adoption, are the expense of key devic

I actually prefer TOTP, at least personally, as a perfect compromise. The problems with FIDO, besides the obvious lack of adoption, are the expense of key devices, difficulty of backups, and lack of support on many devices that don't have NFC (even those that do are frequently spotty) The 'leaking' of the secret is, to me, a feature. That means I can safely store it as a backup (printed in a safe, even) and restore it to any device I want in seconds. I don't care about a leak by the service, because that is game over for my data there anyway: if they can't protect 2F secrets, nothing is safe. Really, mutual TLS would be perfect, but nobody is going to support that. I seem to remember even Windows tried something like that a decade ago and even their weight couldn't break us away from passwords for Internet sites.

Aaron2222 4y ago
Both Android[1] and iOS[2] have both recently gained support for acting as WebAuthn authenticators, supporting authenticating on other devices (Chrome/Safari on desktop gives you a QR code to scan, then the devices communicate via Bluetooth to use the phone as a WebAuthn authenticator). The keys also sync via your Apple ID/Google account. Should go someway towards making WebAuthn a viable replacement to TOTP for people who need to sign in across multiple devices and don't want to buy a hardware authenticator, though more widespread support is necessary I think. [1]: https://developers.google.com/identity/passkeys/use-cases#sign-in-with-a-phone https://developers.google.com/identity/passkeys/use-cases#si... [2]: https://support.apple.com/en-gb/guide/iphone/iphf538ea8d0/ios https://support.apple.com/en-gb/guide/iphone/iphf538ea8d0/io...
- hn_go_brrrrr 4y ago
  Sounds awful. I don't want Google or Apple owning my 2FA keys.
  - tialaramex 4y ago
    Sure, don't then. But other people are insistent that they can't tolerate the inconvenience of needing to own more than one authenticator, and yet they also can't tolerate the risk of losing an authenticator, so this is how they can square that circle.
    - Aaron2222 4y ago
      My point was more that WebAuthn is starting to become a more viable option for the average person, with phone based authenticators that can be used to authenticate on multiple devices and keeps your keys backed up. I wouldn't use Google sync for WebAuthn myself either.

Aaron2222 4y ago

Both Android[1] and iOS[2] have both recently gained support for acting as WebAuthn authenticators, supporting authenticating on other devices (Chrome/Safari on desktop gives you a QR code to scan, then the devices communicate via Bluetooth to use the phone as a WebAuthn authenticator). The keys also sync via your Apple ID/Google account. Should go someway towards making WebAuthn a viable replacement to TOTP for people who need to sign in across multiple devices and don't want to buy a hardware authenticator, though more widespread support is necessary I think. [1]: https://developers.google.com/identity/passkeys/use-cases#sign-in-with-a-phone https://developers.google.com/identity/passkeys/use-cases#si... [2]: https://support.apple.com/en-gb/guide/iphone/iphf538ea8d0/ios https://support.apple.com/en-gb/guide/iphone/iphf538ea8d0/io...

hn_go_brrrrr 4y ago
Sounds awful. I don't want Google or Apple owning my 2FA keys.
- tialaramex 4y ago
  Sure, don't then. But other people are insistent that they can't tolerate the inconvenience of needing to own more than one authenticator, and yet they also can't tolerate the risk of losing an authenticator, so this is how they can square that circle.
  - Aaron2222 4y ago
    My point was more that WebAuthn is starting to become a more viable option for the average person, with phone based authenticators that can be used to authenticate on multiple devices and keeps your keys backed up. I wouldn't use Google sync for WebAuthn myself either.