3 ms·
> So dedicated OTP token. What should I use? You want something that supports the FIDO2 standard (https://en.wikipedia.org/wiki/FIDO_Alliance#FIDO2 https://en.
by vaylian 2y ago
> So dedicated OTP token. What should I use?
You want something that supports the FIDO2 standard (https://en.wikipedia.org/wiki/FIDO_Alliance#FIDO2 https://en.wikipedia.org/wiki/FIDO_Alliance#FIDO2). In practise this means you probably want something like a YubiKey.
- Hamuko 2y agoI feel like the security benefit of using FIDO2 isn't really there, since I don't remember when I've actually set up WebAuthn as my two-factor without being prompted to have another mechanism like OTP or SMS as a backup solution. Not that many sites even support it in the first place though.
- drhuseynov 2y agoThere are systems supporting WebAuthn as the primary method, such as Gmail or M365. The systems requiring OTP or SMS as a backup are just examples of bad security design. Still, even if you have OTP as a backup, and FIDO2 as primary - it reduced phishing attack surface to a certain extent
- steve1977 2y agoYou should certainly have a backup key. So systems which only allow to enroll one key are a bit of a joke.