4 ms·

TOTP has far worse problems, like phishing. TOTP should only ever be implemented for low risk novelty use cases and any website that still supports it should be

by lrvick 4y ago

TOTP has far worse problems, like phishing. TOTP should only ever be implemented for low risk novelty use cases and any website that still supports it should be ashamed of themselves.

Aaron2222 4y ago
Sure, it may not be as secure as FIDO/WebAuthn, but it's a lot better than SMS/Email 2FA.
- lrvick 4y ago
  Arguing SMS is better than TOTP is like arguing IE7 is better than IE6. Sure, but both are so far from being anywhere near a reasonable solution today I cannot understand why people make an argument like this seriously. Everyone has a webauthn capable device, if not multiple, right now. The only reason phishing is still a thing is because people keep implementing and defending phishable 2FA methods.
  - Aaron2222 4y ago
    iPhones have only just gotten support for acting as Bluetooth authenticators, and from what I can tell, Android devices have only had it for a year or so. So we only now seem to be at the point where most people would have a device they could use as a WebAuthn authenticator across multiple devices, making it only now a viable replacement for TOTP for most people (without buying a hardware authenticator). I don't see anything shameful about still supporting what was until recently the best option for most people. (Personally, I'll be waiting until 1Password gets WebAuthn support before moving to it from TOTP.)
    - lrvick 4y ago
      People can also use software browser-plugin authenticators, or software solutions provided by their operating systems. Even software anchored webauthn still stops far more threats than TOTP or SMS. That said few would need that fallback as TouchID or Chromebook authenticators or Windows Hello all work great too. 1Password is a centralized and proprietary database system that leaks all secrets to system memory every time you use one. Why would you want that to manage webauthn secrets for you? You just tap your webauthn device when prompted. No third party control required.
      - Aaron2222 4y ago
        And if I need to sign in on another device, I can't use that platform authenticator, as it's tied to that device. So I'd have to either have another WebAuthn authenticator, or use a fallback method like TOTP or SMS, which defeats the whole point of using only WebAuthn. And most people won't go and buy a hardware authenticator. So like I said, WebAuthn is only now just starting to become viable for the average person to use instead if TOTP.
        lrvick 4y ago
        You simply add each device you want to login with as a trusted device. Most services allow you to add as many devices as you want. I do not understand why this is a adoption barrier.
        Aaron2222 4y ago
        And then if you get a new device, you have to somehow log in on that new device (with either backup codes, enabling TOTP or SMS 2FA temporarily, etc), and add the new device as an authenticator. And repeat that across every service. Same for new/existing accounts, people don't want to have to add every device to every service they use. Not being able to use your WebAuthn authenticator on other devices is an adoption barrier (as is the alternative of buying a hardware authenticator).
      - holigot 4y ago
        Hi. Concerning 1Password and leaking to system memory… What about the others like Bitwarden/Vaultwarden or KeePass and Strongboxsafe? Aren’t they doing the same?
        Aaron2222 4y ago
        Any password manager would need to decrypt passwords in order to use them, and that has to be done in system memory. And short of using something like a TPM or Secure Enclave, or asking for the master password each time, the decryption keys have to be in memory as well. You're always going to be subject to the security of the OS you're running on as to who can read your process's memory.
ssklash 4y ago
This seems like a classic case of perfect being the enemy of good. TOTP is so much better than SMS codes, and they are still very widely used.
- lrvick 4y ago
  This is a "not as bad as" fallacy. https://rationalwiki.org/wiki/Not_as_bad_as https://rationalwiki.org/wiki/Not_as_bad_as TOTP is phishable and the secrets to unlimited codes live in plaintext on both the client and the server. Endpoint malware, phishing, and database dumps are some of the biggest threats online and TOTP offers no strong defense to any of these. In some ways TOTP is even worse than SMS as it is possible to manipulate timestamps to get a code valid in the future. SMS and TOTP both are garbage in terms of both security and UX. Their use should be discontinued ASAP. Webauthn solves for these problems, and everyone has devices that support it already. It is negligent at this point for web service providers to not mandate webauthn and discontinue both SMS and TOTP.
  - Karunamon 4y ago
    You are using that fallacy incorrectly. Additionally, quoting fallacies at people is it itself a fallacy when used in this way, is tiresome, and probably best avoided. Webauthn has a number of severe usability downsides that will conspire to hamper its adoption outside of use cases where people are literally forced to use it. 1. The keys cannot be backed up. Nobody is going to accept being locked out of their online accounts if they lose a physical key. 2. Nobody wants to mess with a physical key when logging in anyways. At least TOTP can live in my password manager. 3. The options for not having physical keys are platform specific, tie you to a platform providers account for backup, and turn an operating system reset or a new smart phone or badly applied ban or account lockout from an annoyance to a possibly catastrophic loss of functionality. None of these are problems in the enterprise because they have simple workarounds. For the rest of us? Yuck. I will gladly keep my platform independent, easy to back up, widely ubiquitous standard with the trade-off of looking at the URL bar when logging in and not clicking links in emails.
    - 4y ago

by lrvick 4y ago

TOTP has far worse problems, like phishing. TOTP should only ever be implemented for low risk novelty use cases and any website that still supports it should be ashamed of themselves.

Aaron2222 4y ago

Sure, it may not be as secure as FIDO/WebAuthn, but it's a lot better than SMS/Email 2FA.

lrvick 4y ago
Arguing SMS is better than TOTP is like arguing IE7 is better than IE6. Sure, but both are so far from being anywhere near a reasonable solution today I cannot understand why people make an argument like this seriously. Everyone has a webauthn capable device, if not multiple, right now. The only reason phishing is still a thing is because people keep implementing and defending phishable 2FA methods.
- Aaron2222 4y ago
  iPhones have only just gotten support for acting as Bluetooth authenticators, and from what I can tell, Android devices have only had it for a year or so. So we only now seem to be at the point where most people would have a device they could use as a WebAuthn authenticator across multiple devices, making it only now a viable replacement for TOTP for most people (without buying a hardware authenticator). I don't see anything shameful about still supporting what was until recently the best option for most people. (Personally, I'll be waiting until 1Password gets WebAuthn support before moving to it from TOTP.)
  - lrvick 4y ago
    People can also use software browser-plugin authenticators, or software solutions provided by their operating systems. Even software anchored webauthn still stops far more threats than TOTP or SMS. That said few would need that fallback as TouchID or Chromebook authenticators or Windows Hello all work great too. 1Password is a centralized and proprietary database system that leaks all secrets to system memory every time you use one. Why would you want that to manage webauthn secrets for you? You just tap your webauthn device when prompted. No third party control required.
    - Aaron2222 4y ago
      And if I need to sign in on another device, I can't use that platform authenticator, as it's tied to that device. So I'd have to either have another WebAuthn authenticator, or use a fallback method like TOTP or SMS, which defeats the whole point of using only WebAuthn. And most people won't go and buy a hardware authenticator. So like I said, WebAuthn is only now just starting to become viable for the average person to use instead if TOTP.
      - lrvick 4y ago
        You simply add each device you want to login with as a trusted device. Most services allow you to add as many devices as you want. I do not understand why this is a adoption barrier.
        Aaron2222 4y ago
        And then if you get a new device, you have to somehow log in on that new device (with either backup codes, enabling TOTP or SMS 2FA temporarily, etc), and add the new device as an authenticator. And repeat that across every service. Same for new/existing accounts, people don't want to have to add every device to every service they use. Not being able to use your WebAuthn authenticator on other devices is an adoption barrier (as is the alternative of buying a hardware authenticator).
    - holigot 4y ago
      Hi. Concerning 1Password and leaking to system memory… What about the others like Bitwarden/Vaultwarden or KeePass and Strongboxsafe? Aren’t they doing the same?
      - Aaron2222 4y ago
        Any password manager would need to decrypt passwords in order to use them, and that has to be done in system memory. And short of using something like a TPM or Secure Enclave, or asking for the master password each time, the decryption keys have to be in memory as well. You're always going to be subject to the security of the OS you're running on as to who can read your process's memory.

ssklash 4y ago

This seems like a classic case of perfect being the enemy of good. TOTP is so much better than SMS codes, and they are still very widely used.

lrvick 4y ago
This is a "not as bad as" fallacy. https://rationalwiki.org/wiki/Not_as_bad_as https://rationalwiki.org/wiki/Not_as_bad_as TOTP is phishable and the secrets to unlimited codes live in plaintext on both the client and the server. Endpoint malware, phishing, and database dumps are some of the biggest threats online and TOTP offers no strong defense to any of these. In some ways TOTP is even worse than SMS as it is possible to manipulate timestamps to get a code valid in the future. SMS and TOTP both are garbage in terms of both security and UX. Their use should be discontinued ASAP. Webauthn solves for these problems, and everyone has devices that support it already. It is negligent at this point for web service providers to not mandate webauthn and discontinue both SMS and TOTP.
- Karunamon 4y ago
  You are using that fallacy incorrectly. Additionally, quoting fallacies at people is it itself a fallacy when used in this way, is tiresome, and probably best avoided. Webauthn has a number of severe usability downsides that will conspire to hamper its adoption outside of use cases where people are literally forced to use it. 1. The keys cannot be backed up. Nobody is going to accept being locked out of their online accounts if they lose a physical key. 2. Nobody wants to mess with a physical key when logging in anyways. At least TOTP can live in my password manager. 3. The options for not having physical keys are platform specific, tie you to a platform providers account for backup, and turn an operating system reset or a new smart phone or badly applied ban or account lockout from an annoyance to a possibly catastrophic loss of functionality. None of these are problems in the enterprise because they have simple workarounds. For the rest of us? Yuck. I will gladly keep my platform independent, easy to back up, widely ubiquitous standard with the trade-off of looking at the URL bar when logging in and not clicking links in emails.
  - 4y ago