4 ms·

I'm not sure that syncing is a feature that should exist. Once an OTP shared secret has been added to a device, it should be unretrievable, ideally stored in a

by cedws 2y ago

I'm not sure that syncing is a feature that should exist. Once an OTP shared secret has been added to a device, it should be unretrievable, ideally stored in a security enclave. If you can just clone an OTP to as many devices as you want then I'd argue it's not really two-factor. The mechanism used to sync is the same one a malicious actor would use to clone all your OTP entries and gain access to your accounts.

cr125rider 2y ago
That’s fair. Can I have it backup sync to iCloud so I’d lose my phone I can get a new one? I think that’s a usability vs. security risk we’re gonna have to be okay with. People aren’t going to be able to have multiple devices.
- cedws 2y ago
  >Can I have it backup sync to iCloud so I’d lose my phone I can get a new one? Then your accounts are only as secure as your iCloud account, which I wouldn't count on, and you've undermined the purpose of 2FA entirely. There's no way around this - 2FA needs to be bound to a single physical device if you want to benefit from it.
  - JumpCrisscross 2y ago
    > your accounts are only as secure as your iCloud account, which I wouldn't count on, and you've undermined the purpose of 2FA entirely This is extreme. Uploading your 2FA to an encrypted cloud like iCloud widens your circle of trust. But it also increases convenience and utility. I personally take the best of both worlds. A synced 2FA for most accounts. And a locked one for my critical ones, e.g. 1PW. If I couldn't sync any accounts I wouldn't bother turning on 2FA for most because the downside is low and, ultimately, probably someone else's problem to clean up.
  - Marsymars 2y ago
    > There's no way around this - 2FA needs to be bound to a single physical device if you want to benefit from it. Depends what the benefit is. From the PoV of my bank, the benefit is that people who use “Password123!” for all of their accounts don’t get their accounts trivially compromised. From my PoV, the benefit of TOTP 2FA is that my password manager can fill it all in automatically rather than having to find my phone and type in SMS numbers manually. (As a non-iOS user - if you’re on iOS you can have your SMS 2FA codes put in automatically.)
nicoburns 2y ago
That's nice in theory, but leaves you with significant risk of getting completely locked out of your account should you lose the device containing the OTP secret.
eviks 2y ago
They would also need the password, not just OTP to gain access because it's really a two-factor, but also the risk of permanent loss if you lose a device is too extreme, so would still need some alternative restore mechanism, at which point an encrypted sync is a much better alternative
- cedws 2y ago
  But it's called two-factor because it's supposed to be two independent factors to get into your account, so saying they would also need the password to get into the account makes no sense. The assumption that the password is known is baked into the principle of 2FA. I also don't think it's true that you're locked out of your account permanently if you lose your OTP entry. Even the shittiest websites will have a reset mechanism. Also - backup codes?
  - eviks 2y ago
    Your device, as well as another device, and yet another - are all independent "something you have" factors from "the password you know". And adding new device can be restricted via 2FA old device And I've addressed the backup codes - that's the alternative mechanism that's no better than the sync. Also, backup codes are not 2FA, so if you're so strict about 2FA you don't even allow sync, then you can't have them, thus permanent loss

by cedws 2y ago

cr125rider 2y ago

That’s fair. Can I have it backup sync to iCloud so I’d lose my phone I can get a new one? I think that’s a usability vs. security risk we’re gonna have to be okay with. People aren’t going to be able to have multiple devices.

cedws 2y ago
>Can I have it backup sync to iCloud so I’d lose my phone I can get a new one? Then your accounts are only as secure as your iCloud account, which I wouldn't count on, and you've undermined the purpose of 2FA entirely. There's no way around this - 2FA needs to be bound to a single physical device if you want to benefit from it.
- JumpCrisscross 2y ago
  > your accounts are only as secure as your iCloud account, which I wouldn't count on, and you've undermined the purpose of 2FA entirely This is extreme. Uploading your 2FA to an encrypted cloud like iCloud widens your circle of trust. But it also increases convenience and utility. I personally take the best of both worlds. A synced 2FA for most accounts. And a locked one for my critical ones, e.g. 1PW. If I couldn't sync any accounts I wouldn't bother turning on 2FA for most because the downside is low and, ultimately, probably someone else's problem to clean up.
- Marsymars 2y ago
  > There's no way around this - 2FA needs to be bound to a single physical device if you want to benefit from it. Depends what the benefit is. From the PoV of my bank, the benefit is that people who use “Password123!” for all of their accounts don’t get their accounts trivially compromised. From my PoV, the benefit of TOTP 2FA is that my password manager can fill it all in automatically rather than having to find my phone and type in SMS numbers manually. (As a non-iOS user - if you’re on iOS you can have your SMS 2FA codes put in automatically.)

nicoburns 2y ago

That's nice in theory, but leaves you with significant risk of getting completely locked out of your account should you lose the device containing the OTP secret.

eviks 2y ago

They would also need the password, not just OTP to gain access because it's really a two-factor, but also the risk of permanent loss if you lose a device is too extreme, so would still need some alternative restore mechanism, at which point an encrypted sync is a much better alternative

cedws 2y ago
But it's called two-factor because it's supposed to be two independent factors to get into your account, so saying they would also need the password to get into the account makes no sense. The assumption that the password is known is baked into the principle of 2FA. I also don't think it's true that you're locked out of your account permanently if you lose your OTP entry. Even the shittiest websites will have a reset mechanism. Also - backup codes?
- eviks 2y ago
  Your device, as well as another device, and yet another - are all independent "something you have" factors from "the password you know". And adding new device can be restricted via 2FA old device And I've addressed the backup codes - that's the alternative mechanism that's no better than the sync. Also, backup codes are not 2FA, so if you're so strict about 2FA you don't even allow sync, then you can't have them, thus permanent loss