3 ms·

Moving from Google authenticator to another application is extremely simple. I don't know why the author has so much trouble transferring 2FA. You take a pictu

Moving from Google authenticator to another application is extremely simple. I don't know why the author has so much trouble transferring 2FA. You take a picture of a QR code and it's all done for you. (This is also a good way to backup your tokens on a different device) With that being said I love my yubikey and want to try this app.

dp-hackernews 3y ago
Storing the text version of the QR code is the easiest, and its how bitwarden stores the 2FA anyway....
- NoZebra120vClip 3y ago
  There is an extra wrinkle, too: Many MFA implementations will not allow you to register more than 1 TOTP authenticator, and so that is why I typically use the trick of registering both Yubikeys simultaneously. If you wish to register another, the service will often require you to deactivate MFA and set it up from scratch, which de-registers the original one. I think this is probably mandatory, due to the way the secrets work. There's no way a service can safely store such a secret on-site, because this would defeat the purpose. So in fact, if your alternate key/auth is offsite, then you're actually forced to manage your own secrets in order to properly register all affected devices. You can have BitWarden or another password manager manage those secrets for you, but you've just reduced your MFA to 1FA, because obviously that's where you store your passwords. In fact, revealing a TOTP secret is more damaging than revealing a simple password. But, you do you...
NoZebra120vClip 3y ago
It wasn't always this way. Google Authenticator used to be much more secure. That is to say, it closely guarded all the secrets and they never left the app. Unfortunately they had to bend to pressure of convenience for users, and that meant that now you can extract the secrets and push them around to your heart's content. That also means that an attacker can do likewise, or intercept them in transit, and so you lose the safety of a security key that is a "roach motel" for secrets. I don't know about the author, but it seems there are still problems with secret portability. If your phone breaks, or it's stolen, and you have no access to the app, how're you going to export your secrets now? The other cool thing about Yubikeys is that they're purpose-built, inexpensive, single-purpose. I don't want to be using my phone as a Swiss Army Knife authenticator. That's way too risky and dumb. It has a huge attack surface. Any malware could get at the phone. Plus all the risks of loss, breakage, or theft. A key can stay safe on my keyring and is "nearly indestructible" and it does only that one thing very well.

dp-hackernews 3y ago

Storing the text version of the QR code is the easiest, and its how bitwarden stores the 2FA anyway....

NoZebra120vClip 3y ago
There is an extra wrinkle, too: Many MFA implementations will not allow you to register more than 1 TOTP authenticator, and so that is why I typically use the trick of registering both Yubikeys simultaneously. If you wish to register another, the service will often require you to deactivate MFA and set it up from scratch, which de-registers the original one. I think this is probably mandatory, due to the way the secrets work. There's no way a service can safely store such a secret on-site, because this would defeat the purpose. So in fact, if your alternate key/auth is offsite, then you're actually forced to manage your own secrets in order to properly register all affected devices. You can have BitWarden or another password manager manage those secrets for you, but you've just reduced your MFA to 1FA, because obviously that's where you store your passwords. In fact, revealing a TOTP secret is more damaging than revealing a simple password. But, you do you...

NoZebra120vClip 3y ago

It wasn't always this way. Google Authenticator used to be much more secure. That is to say, it closely guarded all the secrets and they never left the app. Unfortunately they had to bend to pressure of convenience for users, and that meant that now you can extract the secrets and push them around to your heart's content. That also means that an attacker can do likewise, or intercept them in transit, and so you lose the safety of a security key that is a "roach motel" for secrets. I don't know about the author, but it seems there are still problems with secret portability. If your phone breaks, or it's stolen, and you have no access to the app, how're you going to export your secrets now? The other cool thing about Yubikeys is that they're purpose-built, inexpensive, single-purpose. I don't want to be using my phone as a Swiss Army Knife authenticator. That's way too risky and dumb. It has a huge attack surface. Any malware could get at the phone. Plus all the risks of loss, breakage, or theft. A key can stay safe on my keyring and is "nearly indestructible" and it does only that one thing very well.