3 ms·

I spend a lot of time traveling internationally. I switch phones a lot. I've had at least 2 stolen, and 2 more lost, in the last 5 years. • MFA on my phone wou

I spend a lot of time traveling internationally. I switch phones a lot. I've had at least 2 stolen, and 2 more lost, in the last 5 years. • MFA on my phone would mean using Google or some other cloud service's login; if I lose my phone, my MFA is only as good as my Google password (and Google may require its own separate authentication if my phone number changes, meaning I would be unable to get into AWS until that was completed). • A hardware key can be stolen or lost on the road. • My email server is in a secure location and the DNS is set up through Cloudflare. So if someone hacked that and rerouted my email, it would be a very bad day for a lot of people.

fragmede 2y ago
You could install a command line TOTP app on your email server and get the token via ssh. You're already presuming your email server is up to receive the authentication email, so assuming it's so you can get the token seems neutral. Eg https://github.com/yitsushi/totp-cli https://github.com/yitsushi/totp-cli but there are others.
- necovek 2y ago
  One could even set up an auto-responder email that returns TOTP code: if you include your own password in an incoming email, it returns a new TOTP code. If you properly set up your mail client and server, it should also be TLS encrypted, so no MITM attack vector either.
necovek 2y ago
I don't use Google Authenticator for TOTP. Instead, I use Aegis which can encrypt private keys and is available in F-droid. It allows offline backup too. I am perplexed about "as good as my Google password": isn't your email verification as good as one of your registrar password, DNS/Cloudflare password and email password? How is this different? With hardware key, losing it only matters if you lost the password at the same time: MFA means multiple factors, so that's a password + MFA. If you are referring to a hw passkey, that might be different. Gaining access to your email server/domain name does not necessarily require Cloudflare to be hacked. It all sounds like you really are not fully understanding the security risks between different options, and that this is really mostly about you not wanting to lose the convenience you have. Which is fine, but again, you should be honest about that (or might need to better evaluate your security posture).

fragmede 2y ago

You could install a command line TOTP app on your email server and get the token via ssh. You're already presuming your email server is up to receive the authentication email, so assuming it's so you can get the token seems neutral. Eg https://github.com/yitsushi/totp-cli https://github.com/yitsushi/totp-cli but there are others.

necovek 2y ago
One could even set up an auto-responder email that returns TOTP code: if you include your own password in an incoming email, it returns a new TOTP code. If you properly set up your mail client and server, it should also be TLS encrypted, so no MITM attack vector either.

necovek 2y ago

I don't use Google Authenticator for TOTP. Instead, I use Aegis which can encrypt private keys and is available in F-droid. It allows offline backup too. I am perplexed about "as good as my Google password": isn't your email verification as good as one of your registrar password, DNS/Cloudflare password and email password? How is this different? With hardware key, losing it only matters if you lost the password at the same time: MFA means multiple factors, so that's a password + MFA. If you are referring to a hw passkey, that might be different. Gaining access to your email server/domain name does not necessarily require Cloudflare to be hacked. It all sounds like you really are not fully understanding the security risks between different options, and that this is really mostly about you not wanting to lose the convenience you have. Which is fine, but again, you should be honest about that (or might need to better evaluate your security posture).