3 ms·

> If I'm using a long random password generated by a password manager, are these attacks realistic? Most likely no. But some people refuse to use such password

> If I'm using a long random password generated by a password manager, are these attacks realistic? Most likely no. But some people refuse to use such passwords, even when using password managers. Also it was only a few years ago Sony was caught storing passwords in plaintext so… Unless you trust the service is hashing and salting your password, MFA can be a good idea. > But if they can phish or otherwise capture my password, can't they just as easily phish or capture my one-time code? The TOTP lasts ~30 seconds. So the attack needs to occur in real-time (opposed to a form that just captures information). Can this happen? Absolutely. But it still raises the bar for the attack. But yeah I agree, forced 2FA is infuriating.

gregmac 4y ago
> Also it was only a few years ago Sony was caught storing passwords in plaintext so… Unless you trust the service is hashing and salting your password, MFA can be a good idea. Though that site is likely also storing the TOTP shared secret in plaintext, beside the password, making it pretty much pointless. If the site itself is compromised, it's hard to come back from that. Pretty much the best thing you can do is never re-use passwords across sites.
gnabgib 4y ago
Both the time-step size (recommended 30s, 60s isn't uncommon) and the validity window (+-1 (3 windows), +-2 (5 windows)) are configurable by the implementation. The time-step size can't be changed after the setup (both the server and the client would have to agree) and are visible to you. The validity window can be altered server side and isn't visible to a user. It's in the best interests of implementer to keep the validity window small since they have to check all valid TOTP codes for a client, but the phishing window while near-time, is larger than the time your code is visible.[0] [0]: https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238

gregmac 4y ago

> Also it was only a few years ago Sony was caught storing passwords in plaintext so… Unless you trust the service is hashing and salting your password, MFA can be a good idea. Though that site is likely also storing the TOTP shared secret in plaintext, beside the password, making it pretty much pointless. If the site itself is compromised, it's hard to come back from that. Pretty much the best thing you can do is never re-use passwords across sites.

gnabgib 4y ago

Both the time-step size (recommended 30s, 60s isn't uncommon) and the validity window (+-1 (3 windows), +-2 (5 windows)) are configurable by the implementation. The time-step size can't be changed after the setup (both the server and the client would have to agree) and are visible to you. The validity window can be altered server side and isn't visible to a user. It's in the best interests of implementer to keep the validity window small since they have to check all valid TOTP codes for a client, but the phishing window while near-time, is larger than the time your code is visible.[0] [0]: https://www.rfc-editor.org/rfc/rfc6238 https://www.rfc-editor.org/rfc/rfc6238