4 ms·

I am trying to think on how this could be mitigated and I am not sure there is a good way. Just before we even begin, using an unknown third party is a risk and

I am trying to think on how this could be mitigated and I am not sure there is a good way. Just before we even begin, using an unknown third party is a risk and companies have no problem using whatever providers. Just dropping OTP is not exactly ideal either so we are stuck between rock and a hard place.

vaylian 2y ago
TOTP is a simple and nice solution, but it is susceptible to real-time phishing attacks. Webauthn is a more complex alternative and it is phishing-resistant, because each credential is tied to a domain, which means that a look-alike phishing website doesn't work. But you need to use a hardware token or a special service like Windows Hello or Apple's FaceID to manage your credentials. https://en.wikipedia.org/wiki/WebAuthn https://en.wikipedia.org/wiki/WebAuthn
- lxgr 2y ago
  Several password managers support it at this point too, without any hardware requirements. Bitwarden's implementation works pretty well, for example.
  - bigfatkitten 2y ago
    But then of course you also lose one of the main security properties that made webauthn desirable in the first place. If you can copy the credentials to your own new device, an adversary can copy them to their device also.
    - wongarsu 2y ago
      That's true of SMS 2FA too, though, as well as many TOTP implementations. Being able to copy credentials to a new device is a major usability plus, consequently it is widely implemented. Physical webauthn tokens are obviously better, but software webauthn is the second best thing. Software TOTP is a good bit worse, and SMS OTP shouldn't even qualify as a secure method
    - lxgr 2y ago
      Definitely, so for scenarios where I want the strongest possible 2FA, I use a hardware authenticator. For everything else, WebAuthN based on a software authenticator is both more secure and more convenient than passwords, and realistically even than TOTP (having a higher takeover risk but lower phishing risk).
    - kemotep 2y ago
      You can say the same thing about ssh keys.

vaylian 2y ago

TOTP is a simple and nice solution, but it is susceptible to real-time phishing attacks. Webauthn is a more complex alternative and it is phishing-resistant, because each credential is tied to a domain, which means that a look-alike phishing website doesn't work. But you need to use a hardware token or a special service like Windows Hello or Apple's FaceID to manage your credentials. https://en.wikipedia.org/wiki/WebAuthn https://en.wikipedia.org/wiki/WebAuthn

lxgr 2y ago
Several password managers support it at this point too, without any hardware requirements. Bitwarden's implementation works pretty well, for example.
- bigfatkitten 2y ago
  But then of course you also lose one of the main security properties that made webauthn desirable in the first place. If you can copy the credentials to your own new device, an adversary can copy them to their device also.
  - wongarsu 2y ago
    That's true of SMS 2FA too, though, as well as many TOTP implementations. Being able to copy credentials to a new device is a major usability plus, consequently it is widely implemented. Physical webauthn tokens are obviously better, but software webauthn is the second best thing. Software TOTP is a good bit worse, and SMS OTP shouldn't even qualify as a secure method
  - lxgr 2y ago
    Definitely, so for scenarios where I want the strongest possible 2FA, I use a hardware authenticator. For everything else, WebAuthN based on a software authenticator is both more secure and more convenient than passwords, and realistically even than TOTP (having a higher takeover risk but lower phishing risk).
  - kemotep 2y ago
    You can say the same thing about ssh keys.