3 ms·

Honestly even TOTP is negligent to support at this point. TOTP is phishable, and the root secrets are stored in most TOTP apps (including Google Authenticator)

by lrvick 3y ago

Honestly even TOTP is negligent to support at this point. TOTP is phishable, and the root secrets are stored in most TOTP apps (including Google Authenticator) in plan text, usually in SQLite, because almost no enclaves support the TOTP algorithm. The only hardware devices that -do- support TOTP like Yubikeys or Nitrokeys also support WebAuthn in which case just use that. A hard requirement of Virtual Passkeys and hardware WebAuthn devices should be a bare minimum for auth security in 2024. Passwords and one time codes are phishable 90s solutions to the problem and it is nuts they still are so dominant.

samtho 3y ago
TOTP is a compromise, like everything in security, and one that’s fairly secure. Until we reach a point where hardware tokens or virtual passkeys become mainstream (and their related usability issues addressed), we will be stuck with the “something you have” factor needing to temporarily move into the “something you know” factor via the the TOTP. The fact this expires within 30 seconds makes the attack vector more limited, also unlike an SMS code that providers use to verify you while on the phone with them, you never give this code out (found on a separate app) to a person on the phone, which helps separate this particular factor from SMS. The truth is that, while it offers superior security, hardware tokens and virtual passkeys are not accessible to the masses one way or other. This is a problem that should eventually be solved but nearly all prior attempts cannot supplant the ubiquity of passwords.
- lrvick 3y ago
  Passkeys are easier to use, harder to lose, and more secure than TOTP or passwords in every way. If you have a web browser from the last couple years you can use a passkey. You do not often get a win that clear in security. It is a no brainer to mandate for users today, and stop wasting customer support hours on dealing with accounts compromised by phishing.

by lrvick 3y ago

samtho 3y ago

TOTP is a compromise, like everything in security, and one that’s fairly secure. Until we reach a point where hardware tokens or virtual passkeys become mainstream (and their related usability issues addressed), we will be stuck with the “something you have” factor needing to temporarily move into the “something you know” factor via the the TOTP. The fact this expires within 30 seconds makes the attack vector more limited, also unlike an SMS code that providers use to verify you while on the phone with them, you never give this code out (found on a separate app) to a person on the phone, which helps separate this particular factor from SMS. The truth is that, while it offers superior security, hardware tokens and virtual passkeys are not accessible to the masses one way or other. This is a problem that should eventually be solved but nearly all prior attempts cannot supplant the ubiquity of passwords.

lrvick 3y ago
Passkeys are easier to use, harder to lose, and more secure than TOTP or passwords in every way. If you have a web browser from the last couple years you can use a passkey. You do not often get a win that clear in security. It is a no brainer to mandate for users today, and stop wasting customer support hours on dealing with accounts compromised by phishing.