3 ms·
Isn't the point of OTP is to keep it on one device only (ideally not the primary one?) If someone gets access to iCloud then they will automatically be able to
by lukaslukas 2y ago
Isn't the point of OTP is to keep it on one device only (ideally not the primary one?) If someone gets access to iCloud then they will automatically be able to read all OTP passwords?
- deltaknight 2y agoYes you’re right, ideally OTPs should be on a single device you control (to fulfil the “something you have” factor of authentication). However, for me personally the syncing of OTPs is basically a requirement to ensure you don’t lose access to accounts when transitioning between devices, which happens often with phones. This problem is best solved if you use something like a Yubikey which gives you a dedicated device for your OTPs. If someone gains access to your iCloud Keychain (assuming you have it turned on, if you don’t then no syncing occurs) then yes they’ll be able to access encrypted OTP secrets and metadata, from which they could calculate your OTP. If they can decrypt the data, then yes your OTP will be compromised. In my eyes this issue exists for most of the popular OTP apps out there, and so I prefer to trust one service (Keychain) rather than multiple. That’s just me though. For me, the usability and availability of my OTPs is more important than keeping them on an isolated device.