3 ms·
And that is why I utilize the "very secure" flow of also keep the original qr codes ... in a keepass vault, but still. Most of the security is theater. On the
by ReptileMan 4y ago
And that is why I utilize the "very secure" flow of also keep the original qr codes ... in a keepass vault, but still.
Most of the security is theater. On the other hand I think that every tech savvy person should at least try to keep the TOTP seeds.
- gravitronic 4y agoGood idea! That had never occurred to me before this incident.
- ClassyJacket 4y agoYou have to take a photo of the screen on another phone, Google disallows you from screenshotting them.
- msdrigg 4y agoJust use a different 3rd party authenticator app
- yieldcrv 4y agoReally? At what point do we blame the victim because this is so obvious to me. I keep the TOTP and only sometimes keep the backup codes I avoid the issue created from losing my phone, because the next device can generate codes immediately by importing or scanning the TOTP I also don’t call it “2 factor” I just call it “one time passcode”
- happytoexplain 4y agoNothing is "obvious" in tech any more, because there is simply too much. Two "tech savvy" people will often each have things they think is "obvious" that the other isn't familiar with. And this isn't even a good example of something that is "obvious" to some people, because Google makes it very, very clear that saving the QR code is NOT a backup option. It is labeled only as a mechanism to transfer to a new phone, so one has no reason to believe that it's non-ethereal. Further, the app disallows taking a screenshot. You have to point a camera at your phone. It's mind-blowing to suggest that it might be appropriate to blame the user for not doing this.
- yieldcrv 4y agoall TOTP is the same it doesn't matter what Google says is normal is this really people's only experience with TOTP delivered via QR codes?
- ClassyJacket 4y agoI would love to save the QR codes, but Google bans screenshots in the Authenticator app.
- Tepix 4y agoOther apps will reveal the underlying seed string. No need to deal with QR codes after scanning them once.
- alasdair_ 4y agoTake a photo with a second phone/webcam?
- bikeformind 4y agoAuhenticator has an option to generate back up codes. it creates one or two QR codes that you can scan in a new Authenticator app and it will clone all of your accounts.
- jofer 4y agoGood luck trying to save those QR codes, though. I had to resort to pulling out my DSLR to take a photo of my phone with them. All screenshot/print/save functionality is disabled when you have the codes up on your phone. You need an actual camera on a second device to save them in most cases.
- nonfamous 4y ago
- jetpackjoe 4y agoDoesn't keeping the seed remove the whole point of one time passwords? If an attacker steals at TOTP, its only good for (I think) less than a minute. If they steal the seed, its good forever.
- blibble 4y agothe point is to have a second factor which isn't really destroyed by having a printout of what you entered onto your phone somewhere secure (now if you store both in your password manager: that completely defeats the point)
- gonehome 4y agoIt doesn’t. The threat model is someone gets your password, not somebody gets access to your password manager. If the latter is your threat model then yes having your 2F in there is worse, but really the former is the more common thing to protect against and the tradeoff of not having 2F in your 1Password and getting locked out because your phone breaks is worse than the risk of having it in there. It’s similar to the tradeoff of having a nano yubikey always in your laptop or a large one on your keys. For most people the nano is better (though you should have a second one in either case)
- hot_gril 4y agoIf you're using a password manager, you probably have one-time secure passwords, so the only probable way someone gets it is by stealing your password manager.
- hot_gril 4y agoEr, not one-time use passwords, I mean the password is only used on one website.
- gonehome 4y agoThis isn't accurate - they don't get access to multiple stuff. - Site0 leaks your password because they store it poorly. - It's just one password, but it's still leaked. - You have 2F in 1Password so even though it's picked up in an account list the attacker can't login. - Weeks later you learn there was a breach. This is the common case for most accounts and breaches. Though the sites most likely to leak are also ones unlikely to have 2F so it's not perfect.
- Spivak 4y agoIn Bitwarden you can just store the key itself and it'll generate the codes for you, right next to your password, so convenient!
- bityard 4y agoI expect the "so convenient" is sarcastic, but yes it is more convenient and also more secure. It helps to consider the threat model. 2FA is protection against (at least) several things: brute-force password guessing, a stolen password, a hijacked email account, etc. Since password vaults like bitwarden are designed to be uncrackable on their own, the only plausible way for an attacker to compromise one is to gain control of the user's device, at which point they don't really need access to the vault because they don't just have the keys to the kingdom, they have the kingdom. Any technology that allows users to add security to their assets while still being convenient enough to use daily, leads to greater security overall. Personally I think we're about a decade or two overdue to switch away from passwords (as currently implemented) and towards public/private keys managed by the browser or an extension, but I don't see that happening anytime soon as it's 100% certain that if it's ever tried, each FAANG will just try to push their own system, break the whole effort with fragmentation, and everyone will still just be using passwords in frustration for the next 100 years.
- Spivak 4y agoWhat's the word, tongue in cheek? I meant it sincerely but phrased in a sarcastic tone. I unironically do this and it's saved me from two phone breakages. I cannot understand how anyone would trust any of their accounts to a single physical device that is routinely lost, stolen, or broken. My 2FA token is just a second password that doesn't get sent over the wire directly -- it's almost like a private key where you auth via challenge... wait a minute, thought you could sneak PAKE on me?!
- thekonqueror 4y agoI have a spare cheap android phone with Google authenticator. I export accounts from my primary phone to this phone every quarter or so as a low tech backup.