4 ms·

No one thinks SMS is a good idea. That's why most competent places are pushing time based one time passwords, or some kind of cert based push method.

ThunderSizzle 4y ago
Which also assumes I have a particular device or service open. My randomly generated offline passwords should be sufficient security.
- hiccuphippo 4y ago
  I made a simple TOTP client in python so the device they assume I have is the same device from which I intent to log in. Sadly I can't do that for services.
- tracker1 4y ago
  Other than really obscure options, OTP is pretty much available anywhere/everywhere in terms of device support.
- mmh0000 4y ago
  If you want the quickest and dirtiest solution to your problem, then oathtool is for you: $ oathtool --totp -b "S3GXITTAZXNN4LCPXWQREDYBIE" 646063 Otherwise, most password managers, i.e. Bitwarden, have integrated TOTP support.
  - mooreds 4y ago
    Do you store the secret in your password manager? When a password manager has both the password and the secret for TOTP, that always seemed like it degraded the concept of multi-factor authentication to me.
    - secabeen 4y ago
      Personally, I don't, I explicitly and intentionally keep my Email, Password Manager and 2FA providers all distinct and separate. (This was very useful for extracting the TOTP secret out of the Symantec VIP 2FA system: https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess) At work, we do for non-person accounts. It's non-ideal, but I don't want to manage two separate systems for storing that data and trying to keep them in sync. The password vault system itself has a hard requirement for 2FA to download the vault.
    - mmh0000 4y ago
      Convenience and security are constantly at war with each other. I've decided that, for me, the risk of someone obtaining access to my password manager is very low. I've been using password managers since ~2000, randomly generated passwords; I've never had an account compromised. There's enough other sensitive information in my password manager that if someone did obtain access to it, I'd be fucked anyway, to the point that someone getting my TOTP secrets would be minor.
  - marssaxman 4y ago
    That looks promising! Thank you for the reference.
peoplefromibiza 4y ago
physical keys, the equivalent of passwords, have been working for millenia and will keep working in the future, despite their limits, which present a good trade off generally speaking. everything biometric is scary as hell, I can't change my fingerprints. everything involving cryptographic keys has the same problem: if someone get ahold of my keys, I'm f*cked. if I need a device to be close to me, the solution is not as bullet proof as they make it sound. we all know nobody ever loses their devices or forgets them on the train, they never get stolen, they never break or suddenly stop working. They also admit that Passkeys aren’t reused across sites like passwords often are, so stolen credentials do less damage or It sounds simple enough, but in my experience, I’ve found that the process can be confusing. When I attempted to test it by creating a Kayak account, I repeatedly got stuck waiting for a verification email that never showed up. Eventually, I managed to log in, and the passkey worked seamlessly on an iPhone. But when I tried to create a passkey on my Mac, I was locked in a loop where the site repeatedly asked me to enter my email address; I soon realized that I had to select the option to scan a QR code with my phone because my Mac mini doesn’t have Face ID or Touch ID, and I needed to authenticate on a device that does. At no point in the login process was that made clear. so, yeah, thanks, no thanks.
- ehutch79 4y ago
  Passkeys absolutely do not need an email.
afiori 4y ago
recently I found myself in an interesting conundrum; I was for a time near a timezone boundary and so I had my phone's "sync clock to network clock" disabled. At a certain point I discovered that some of my OTP apps stopped working which I blame on my phone's clock drifting by almost 2 minutes.
hansvm 4y ago
Agreed. I just wish literally any bank or 401k provider or other mainstream financial institution were competent.

ThunderSizzle 4y ago

Which also assumes I have a particular device or service open. My randomly generated offline passwords should be sufficient security.

hiccuphippo 4y ago
I made a simple TOTP client in python so the device they assume I have is the same device from which I intent to log in. Sadly I can't do that for services.
tracker1 4y ago
Other than really obscure options, OTP is pretty much available anywhere/everywhere in terms of device support.
mmh0000 4y ago
If you want the quickest and dirtiest solution to your problem, then oathtool is for you: $ oathtool --totp -b "S3GXITTAZXNN4LCPXWQREDYBIE" 646063 Otherwise, most password managers, i.e. Bitwarden, have integrated TOTP support.
- mooreds 4y ago
  Do you store the secret in your password manager? When a password manager has both the password and the secret for TOTP, that always seemed like it degraded the concept of multi-factor authentication to me.
  - secabeen 4y ago
    Personally, I don't, I explicitly and intentionally keep my Email, Password Manager and 2FA providers all distinct and separate. (This was very useful for extracting the TOTP secret out of the Symantec VIP 2FA system: https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess) At work, we do for non-person accounts. It's non-ideal, but I don't want to manage two separate systems for storing that data and trying to keep them in sync. The password vault system itself has a hard requirement for 2FA to download the vault.
  - mmh0000 4y ago
    Convenience and security are constantly at war with each other. I've decided that, for me, the risk of someone obtaining access to my password manager is very low. I've been using password managers since ~2000, randomly generated passwords; I've never had an account compromised. There's enough other sensitive information in my password manager that if someone did obtain access to it, I'd be fucked anyway, to the point that someone getting my TOTP secrets would be minor.
- marssaxman 4y ago
  That looks promising! Thank you for the reference.

peoplefromibiza 4y ago

physical keys, the equivalent of passwords, have been working for millenia and will keep working in the future, despite their limits, which present a good trade off generally speaking. everything biometric is scary as hell, I can't change my fingerprints. everything involving cryptographic keys has the same problem: if someone get ahold of my keys, I'm f*cked. if I need a device to be close to me, the solution is not as bullet proof as they make it sound. we all know nobody ever loses their devices or forgets them on the train, they never get stolen, they never break or suddenly stop working. They also admit that Passkeys aren’t reused across sites like passwords often are, so stolen credentials do less damage or It sounds simple enough, but in my experience, I’ve found that the process can be confusing. When I attempted to test it by creating a Kayak account, I repeatedly got stuck waiting for a verification email that never showed up. Eventually, I managed to log in, and the passkey worked seamlessly on an iPhone. But when I tried to create a passkey on my Mac, I was locked in a loop where the site repeatedly asked me to enter my email address; I soon realized that I had to select the option to scan a QR code with my phone because my Mac mini doesn’t have Face ID or Touch ID, and I needed to authenticate on a device that does. At no point in the login process was that made clear. so, yeah, thanks, no thanks.

ehutch79 4y ago
Passkeys absolutely do not need an email.

afiori 4y ago

recently I found myself in an interesting conundrum; I was for a time near a timezone boundary and so I had my phone's "sync clock to network clock" disabled. At a certain point I discovered that some of my OTP apps stopped working which I blame on my phone's clock drifting by almost 2 minutes.

hansvm 4y ago

Agreed. I just wish literally any bank or 401k provider or other mainstream financial institution were competent.