4 ms·
Since we're here: Anyone else dealing with the stupid thing where your organization won't let you have your generating token thing and instead force you into e.
by jrm4 3y ago
Since we're here: Anyone else dealing with the stupid thing where your organization won't let you have your generating token thing and instead force you into e.g. Duo?
I have only one, and its frustrating. I know it's probably breakable with rooted Android or something but haven't had much time to look into it (or fight it)
- explosion-s 3y agoDuo lets you use a physical security key, I then use bitwarden to store that as a passkey. Not quite a full replacement but good enough for me (you can also self host bitwarden [0]) [0] Vaultwarden
- lxgr 3y agoTOTPs are inherently less secure than many of these proprietary solutions (they don't offer control over where people store them and whether they create backups of them, for one thing), so I do somewhat understand companies preferring those.
- jrm4 3y agoI agree that "TOTP with user held keys offer relatively more control to the user than to the organization," but I would never call this "inherently less secure." Just a different kind of insecure.
- genpfault 3y agoAegis will happily slurp the secrets out from Duo on a rooted device.
- devsda 3y agoSome organizations disable totp entirely. Instead, everytime there's a login attempt a pop-up notification with "allow" & "deny" options is pushed to the registered device.