5 ms·

What? Where the 2FA codes come from isn't relevant, as long as the device (laptop, phone, desktop, hardware) is protected in some way or another (like password)

What? Where the 2FA codes come from isn't relevant, as long as the device (laptop, phone, desktop, hardware) is protected in some way or another (like password). Backup codes come from the service which is 2FA protected anyways, not from the 2FA authenticator itself. Edit: oh, reading your message again, are you referring to SMS-based 2FA? I assumed TOTP 2FA in this submission. If you mean SMS-based 2FA, then yeah I agree, makes your account less secure than not having 2FA at all.

rat9988 4y ago
I'm pretty sure he talks about totp too.
bluGill 4y ago
Nobody has a secure password on their phone, so your requirement fails. There is no way to get a secure password on a phone as one of the requirements of a phone is quick access, and no fast password is secure. (maybe finger prints, but I have found them unreliable and so I quit using them) If your phone based code system is also available on other accounts, and you can access those other accounts without the phone then maybe. However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS.
- capableweb 4y ago
  > Nobody has a secure password on their phone, so your requirement fails. Well, you could if you want to. That you don't want to, is a failure on your part, not on "everyone"'s part, since most phones do offer you the feature of setting a sufficiently secure password. > However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). You don't need a second device in order to backup your codes. By leveraging "cryptographic splitting" you can divide a secret into N parts and share them with friends and family, and if you need to regain access, ask them each for their part back and then you can recover from there. Now I guess that's kind of advanced so most people won't/can't do that, but it is possible at least. You could try something like https://iancoleman.io/shamir/ https://iancoleman.io/shamir/ if you're curious about the process, I've done this myself for some things. Easier solution is to create a encrypted archive with your backups, and upload to various cloud services. As long as the encryption scheme is secure, you'll be safe. > The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS. I'm using TOTP 2FA for 100% of every service I use and that offers it. I think only one requires SMS-based fallback, the rest are optional so obviously I'm not using that.
- carlosjobim 4y ago
  > Nobody has a secure password on their phone, so your requirement fails. > maybe finger prints, but I have found them unreliable and so I quit using them You mean that you specifically do not have a secure password on your phone because you chose not to. The rest of us use finger print sensors or facial recognition to make our devices as secure as can be. Your argument applies only to you and a handful of people. The SMS fallback is always combined with your finger print in all applications I've used.
  - goosedragons 4y ago
    How long is the pin code that can be used to log-in into your phone and likely must be used when you restart it? 4-6 digits?
    - konha 4y ago
      Use a long passphrase and unlock via biometrics. Disable biometrics when handing the phone to somebody else or even remotely (e.g. mark as lost via “find my”). Good compromise of usability and security.
  - jkepler 4y ago
    Biometric phone security is only secure until a judge or police officer compels you to unlock your phone; and legally you must comply, because your face or finger aren't speech. However, if you use a passphrase, (at least in the US and other countries with string freedom of speech laws) you can't be legally compelled to unlock the phone, as that would impinge on freedom of speech. I never use biometrics to unlock my phone or computer for that reason.
    - konha 4y ago
      On iPhones you can press Volume Down + Power to disable biometrics (faceid) before you hand it to somebody else or when going through customs etc. It will require your passphrase to unlock then.
      - 4y ago
- philwelch 4y ago
  > Nobody has a secure password on their phone, so your requirement fails. There is no way to get a secure password on a phone as one of the requirements of a phone is quick access, and no fast password is secure. (maybe finger prints, but I have found them unreliable and so I quit using them) I think you’re overextrapolating from your experience. I‘ve used Face ID on my phone for 5-6 years now, and the fingerprint sensors on my recent devices have been very reliable.
- friendlyHornet 4y ago
  Idk how secure this is, but my iPhone is protected with Face ID and a 16-character long password with a mix of upper and lower case letters, numbers and symbols. The password itself was generated randomly and I managed to memorise it (it took a while).

rat9988 4y ago

I'm pretty sure he talks about totp too.

bluGill 4y ago

Nobody has a secure password on their phone, so your requirement fails. There is no way to get a secure password on a phone as one of the requirements of a phone is quick access, and no fast password is secure. (maybe finger prints, but I have found them unreliable and so I quit using them) If your phone based code system is also available on other accounts, and you can access those other accounts without the phone then maybe. However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS.

capableweb 4y ago
> Nobody has a secure password on their phone, so your requirement fails. Well, you could if you want to. That you don't want to, is a failure on your part, not on "everyone"'s part, since most phones do offer you the feature of setting a sufficiently secure password. > However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). You don't need a second device in order to backup your codes. By leveraging "cryptographic splitting" you can divide a secret into N parts and share them with friends and family, and if you need to regain access, ask them each for their part back and then you can recover from there. Now I guess that's kind of advanced so most people won't/can't do that, but it is possible at least. You could try something like https://iancoleman.io/shamir/ https://iancoleman.io/shamir/ if you're curious about the process, I've done this myself for some things. Easier solution is to create a encrypted archive with your backups, and upload to various cloud services. As long as the encryption scheme is secure, you'll be safe. > The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS. I'm using TOTP 2FA for 100% of every service I use and that offers it. I think only one requires SMS-based fallback, the rest are optional so obviously I'm not using that.
carlosjobim 4y ago
> Nobody has a secure password on their phone, so your requirement fails. > maybe finger prints, but I have found them unreliable and so I quit using them You mean that you specifically do not have a secure password on your phone because you chose not to. The rest of us use finger print sensors or facial recognition to make our devices as secure as can be. Your argument applies only to you and a handful of people. The SMS fallback is always combined with your finger print in all applications I've used.
- goosedragons 4y ago
  How long is the pin code that can be used to log-in into your phone and likely must be used when you restart it? 4-6 digits?
  - konha 4y ago
    Use a long passphrase and unlock via biometrics. Disable biometrics when handing the phone to somebody else or even remotely (e.g. mark as lost via “find my”). Good compromise of usability and security.
- jkepler 4y ago
  Biometric phone security is only secure until a judge or police officer compels you to unlock your phone; and legally you must comply, because your face or finger aren't speech. However, if you use a passphrase, (at least in the US and other countries with string freedom of speech laws) you can't be legally compelled to unlock the phone, as that would impinge on freedom of speech. I never use biometrics to unlock my phone or computer for that reason.
  - konha 4y ago
    On iPhones you can press Volume Down + Power to disable biometrics (faceid) before you hand it to somebody else or when going through customs etc. It will require your passphrase to unlock then.
    - 4y ago
philwelch 4y ago
> Nobody has a secure password on their phone, so your requirement fails. There is no way to get a secure password on a phone as one of the requirements of a phone is quick access, and no fast password is secure. (maybe finger prints, but I have found them unreliable and so I quit using them) I think you’re overextrapolating from your experience. I‘ve used Face ID on my phone for 5-6 years now, and the fingerprint sensors on my recent devices have been very reliable.
friendlyHornet 4y ago
Idk how secure this is, but my iPhone is protected with Face ID and a 16-character long password with a mix of upper and lower case letters, numbers and symbols. The password itself was generated randomly and I managed to memorise it (it took a while).