3 ms·
Say, I want to go the extra mile of not storing them together. What would I have to do? - Both in same password manager is obviously storing together. - Both
by weinzierl 2y ago
Say, I want to go the extra mile of not storing them together. What would I have to do?
- Both in same password manager is obviously storing together.
- Both on same phone, but different apps. There are the subvariants of: password manager and dedicated OTP app or two different password managers. Also there is the consideration where the apps really store the secret data, e.g. system provided vault
- OTP on a separate device
I think the middle option has too many ifs and buts and you could argue that as long as its the same device it's not really separate.
So dedicated OTP token. What should I use?
Cheap mobile phone? Does it need a SIM? Are there dedicated devices? Can they store multiple keys?
- piperswe 2y agoYubikeys support OTPs, you can configure and read them using the Yubico Authenticator application on desktop/mobile.
- steve1977 2y agoTo expand on that (for those who might not know), the actual secrets are physically on the Yubikey and the Authenticator app on iOS or Android is using them to generate the One-Time Password. This means you can also roam those secrets to different devices (as they are on the Yubikey). But it also means that you need to have access to the key whenever you need the OTP! One caveat is that you can "only" have 32 or 64 accounts per Yubikey (number depending on the version of the key)
- graftak 2y agoThat number has to be so big I’d be absolutely confident to never exceed it before ever considering it. Nobody has time to manage/backup multiple keys with the fun game of ‘what account is stored on which key’.
- lye 2y agoEither a couple of FIDO keys, if your website supports them, or one of these: https://www.token2.com/shop/category/classic-tokens https://www.token2.com/shop/category/classic-tokens https://www.token2.com/shop/category/c301-tokens https://www.token2.com/shop/category/c301-tokens https://www.token2.com/shop/category/multi-profile-programmable-tokens https://www.token2.com/shop/category/multi-profile-programma... Other vendors probably have something like that, I link to what I've personally used.
- weinzierl 2y agoHow do these hardware devices pair. They probably can't read the QR code provided? They also seem to have just one button, so I need one device per account? EDIT: I see the last link has a multi account device and some devices have USB. How does it work, when it says "factory programmed"? I've never seen that I can sync an app to an existing token.
- drhuseynov 2y agoFactory-programmed ones are for systems supporting secret key import, i.e. Microsoft Entra ID . It is not for replacing your Authenticator apps (although based on the same algorithm, TOTP).
- vaylian 2y ago> So dedicated OTP token. What should I use? You want something that supports the FIDO2 standard (https://en.wikipedia.org/wiki/FIDO_Alliance#FIDO2 https://en.wikipedia.org/wiki/FIDO_Alliance#FIDO2). In practise this means you probably want something like a YubiKey.
- Hamuko 2y agoI feel like the security benefit of using FIDO2 isn't really there, since I don't remember when I've actually set up WebAuthn as my two-factor without being prompted to have another mechanism like OTP or SMS as a backup solution. Not that many sites even support it in the first place though.
- drhuseynov 2y agoThere are systems supporting WebAuthn as the primary method, such as Gmail or M365. The systems requiring OTP or SMS as a backup are just examples of bad security design. Still, even if you have OTP as a backup, and FIDO2 as primary - it reduced phishing attack surface to a certain extent
- steve1977 2y agoYou should certainly have a backup key. So systems which only allow to enroll one key are a bit of a joke.