3 ms·
> why unmasked TOTP seed storage is not in fact that big of a deal Wait, why is it not a big deal? Isn’t this similar to storing a plain text password server s
by lll-o-lll 2y ago
> why unmasked TOTP seed storage is not in fact that big of a deal
Wait, why is it not a big deal? Isn’t this similar to storing a plain text password server side? (OK, not user generated). If my server gets hacked, doesn’t the hacker get all the totp’s for everyone, much like getting everyones password?
- tptacek 2y agoBecause the secrets have no intrinsic value. If you believe your database has been compromised, you just invalidate them all. The problem with password compromise is that passwords are re-used: losing a user password is a big deal. There's a reason there's no "Has My TOTP Seed Been Pwned" site anywhere.
- lll-o-lll 2y agoLosing a user password is a “bigger deal” when the password is re-used, I get this point. > Because the secrets have no intrinsic value This is too strong. In general, it’s not possible to know my database has not been compromised. TOTP invalidation isn’t a trivial thing either, particularly if it was used instead of passwords and not as a 2nd factor.
- tptacek 2y agoI don't agree, but can you point to a system that uses TOTP as a sole factor?
- lll-o-lll 2y agoNot really (I can login to some systems with just TOTP, but TOTP was registered as a supplemental to something else). I guess your point is that having the seeds exposed is as big a deal as having salted hashes exposed. Which is to say, not a big deal. Fair enough.