4 ms·

>You are supposed to store the password in a Secure Enclave, That's at best a retcon, given given that the RFC was first published in 2008 >You are also suppo

by gruez 10mo ago

>You are supposed to store the password in a Secure Enclave, That's at best a retcon, given given that the RFC was first published in 2008 >You are also supposed to immediately destroy the QR code after importing it. Most TOTP apps support backups/restores, which defeats this.

craftkiller 10mo ago
> That's at best a retcon, given given that the RFC was first published in 2008 How so? Apple didn't invent the idea of a secure enclave. Here is a photo of one such device, similar to one I was issued for work back in ~2011: https://webobjects2.cdw.com/is/image/CDW/1732119 https://webobjects2.cdw.com/is/image/CDW/1732119 No option to get the secret key out. All you can get out is the final TOTP codes. If anything, having an end-user-programmable "secure enclave" is the only thing that has changed. I think they probably meant "Secure Enclave" in the same way that people say "band-aid" instead of "adhesive bandage", "velcro" instead of "hook and loop fastener", and "yubikey" instead of "hardware security token".
- krkhan 10mo ago
  [dead]
aja12 10mo ago
>Most TOTP apps support backups/restores, which defeats this. Citation needed? Yubico authenticator doesn't (the secure enclave is the Yubikey). I'd be very surprised if MS Authenticator and Authy (which I don't use but are the most popular apps that I know of) support such backups
- Rubberducky1324 10mo ago
  > Citation needed? Yubico authenticator doesn't (the secure enclave is the Yubikey). I'd be very surprised if MS Authenticator and Authy (which I don't use but are the most popular apps that I know of) support such backups Google Authenticator has an export option that I've used in the past, so that one does it for sure. Authy allows cloud-based synchronization in any case, so exporting seems quite possible. MS Authenticator also allow cloud sync, so probably exporting is not difficult.
  - aja12 10mo ago
    > cloud-based synchronization Well I don't disagree that it might be possible to abuse cloud sync in some way to export the secrets, but it's not quite as egregious as just including the secrets by default in an app backup Not perfect, but (imho) still better than SMS 2FA, mail 2FA, or lack of 2FA

by gruez 10mo ago

craftkiller 10mo ago

> That's at best a retcon, given given that the RFC was first published in 2008 How so? Apple didn't invent the idea of a secure enclave. Here is a photo of one such device, similar to one I was issued for work back in ~2011: https://webobjects2.cdw.com/is/image/CDW/1732119 https://webobjects2.cdw.com/is/image/CDW/1732119 No option to get the secret key out. All you can get out is the final TOTP codes. If anything, having an end-user-programmable "secure enclave" is the only thing that has changed. I think they probably meant "Secure Enclave" in the same way that people say "band-aid" instead of "adhesive bandage", "velcro" instead of "hook and loop fastener", and "yubikey" instead of "hardware security token".

krkhan 10mo ago
[dead]

aja12 10mo ago

>Most TOTP apps support backups/restores, which defeats this. Citation needed? Yubico authenticator doesn't (the secure enclave is the Yubikey). I'd be very surprised if MS Authenticator and Authy (which I don't use but are the most popular apps that I know of) support such backups

Rubberducky1324 10mo ago
> Citation needed? Yubico authenticator doesn't (the secure enclave is the Yubikey). I'd be very surprised if MS Authenticator and Authy (which I don't use but are the most popular apps that I know of) support such backups Google Authenticator has an export option that I've used in the past, so that one does it for sure. Authy allows cloud-based synchronization in any case, so exporting seems quite possible. MS Authenticator also allow cloud sync, so probably exporting is not difficult.
- aja12 10mo ago
  > cloud-based synchronization Well I don't disagree that it might be possible to abuse cloud sync in some way to export the secrets, but it's not quite as egregious as just including the secrets by default in an app backup Not perfect, but (imho) still better than SMS 2FA, mail 2FA, or lack of 2FA