4 ms·
> 2FA code is stored on the device That's not how 2FA works.
by divan 3y ago
> 2FA code is stored on the device
That's not how 2FA works.
- lumb63 3y agoI understand, but your statement feels pedantic. Practically, if someone has access to your device, your 2FA codes are compromised.
- divan 3y agoYes, Passkeys do not offer much against rubber-hose cryptanalysis. Actually, it's a bit worse than passwords as it doesn't require captured human to be concious. I believe Passkeys are great for those whose threat profile doesn't include physical assault risks.
- quenix 3y agoWhat? It is how it works. The TOTP secret is stored on device which can be used to arbitrarily generate codes.
- divan 3y agoTOTP is not 2FA, but can be used for 2FA. What is the "secret stored on device" when SMS is used for 2FA? Passkeys are stored in Secure Enclave on Apple devices, or on YubiKeys. Not sure about Androids.
- ForHackernews 3y ago> What is the "secret stored on device" when SMS is used for 2FA? IMEI number?
- hbn 3y agoWhen you request an SMS 2FA code, they're blindly sending an auth code to your phone number over SMS, that's all they know. That number could be registered to any SIM card which could be in any device. Someone could have socially engineered a rep at your carrier to have that number transferred to their device, which is a real thing that happens.
- elwebmaster 3y agoAnd the solution to that is? Disable SMS/phone number as 2FA? No, drop 2FA altogether for a more secure password...nonsense.