4 ms·

Seems like requiring second factor to be on a different device would actually enhance security a bit... No?

therealmarv 3y ago
The second factor is not meant for securing you against a compromised system and if you really think about it you already lost mostly when your system is compromised (stealing sessions credentials etc). The second factor usage is to secure that you are really you and securing a service against external unknown logins. The attack vector is the following: Somehow a hacker gets your username and maybe a password you use often or using an brute force attack on an internet service. The second factor basically asking: Is that really you? When the second factor is on the same device (which you own) then that's also a valid way to say "yes, it's really me". Also think about it: When you login on a phone browser or phone app both things are on the same device. Same logic.
winrid 3y ago
I saw an infra guy using 2fa with the desktop app and had the same reaction. Like wait, why is that a thing...
jeroenhd 3y ago
Perhaps, but I don't think it should be a strict requirement. A locked-down, encrypted laptop with all of its keys stored securely in a TPM will do just fine when all you want to prevent is hackers from another country using credential stuffing to log into your online environment. It mostly depends on what kind of threads you're trying to defend against. Then again, with passkeys and Windows Hello/TouchID becoming more and more usable in real life, I think the Authy app has better replacements available that are built right into the operating systems already. The real kicker is Authy's sync feature; you're basically locking your 2FA behind a password and a phone number. It's another thing attackers need to hack, but it's inherently weaker for protecting access than the "hardware you need to destroy to get the secrets" types of second factors.

The second factor is not meant for securing you against a compromised system and if you really think about it you already lost mostly when your system is compromised (stealing sessions credentials etc). The second factor usage is to secure that you are really you and securing a service against external unknown logins. The attack vector is the following: Somehow a hacker gets your username and maybe a password you use often or using an brute force attack on an internet service. The second factor basically asking: Is that really you? When the second factor is on the same device (which you own) then that's also a valid way to say "yes, it's really me". Also think about it: When you login on a phone browser or phone app both things are on the same device. Same logic.

winrid 3y ago

I saw an infra guy using 2fa with the desktop app and had the same reaction. Like wait, why is that a thing...

jeroenhd 3y ago

Perhaps, but I don't think it should be a strict requirement. A locked-down, encrypted laptop with all of its keys stored securely in a TPM will do just fine when all you want to prevent is hackers from another country using credential stuffing to log into your online environment. It mostly depends on what kind of threads you're trying to defend against. Then again, with passkeys and Windows Hello/TouchID becoming more and more usable in real life, I think the Authy app has better replacements available that are built right into the operating systems already. The real kicker is Authy's sync feature; you're basically locking your 2FA behind a password and a phone number. It's another thing attackers need to hack, but it's inherently weaker for protecting access than the "hardware you need to destroy to get the secrets" types of second factors.