3 ms·

Reminder also that OTP is NOT a strong factor, anyways. Even if the manufacturer doesn't hold the secret seed (i.e. the device lets you regenerate it - vendors

by zobzu 13y ago

Reminder also that OTP is NOT a strong factor, anyways. Even if the manufacturer doesn't hold the secret seed (i.e. the device lets you regenerate it - vendors usually don't let you do that so that you're forced to buy again from them all the time).. so yes, even if they don't hold that secret seed, the target servers hold them. There is no encrypted version of the secret seed. There is no hashed version. You and the opposite party (the server you authenticate to) both have to be in possession of the secret seed. That means if any server containing those keys is compromised, your OTP token is suddenly just paperweight (yeah, people like these crappy analogies, i heard.) Using something like an opengpg smartcard and true challenge/response type authentication is much better than the "2FA" provided by password + OTP. Something you have (the keys on the smartcard), something you know (the passphrase to decrypt those keys), the key never leaves the smartcard, nobody else has your key.

lstamour 13y ago
Something you have, something you know ... I can see the utility in requiring just those. But I've found it useful to get messages from service providers when, for instance, my ATM card is used, or when I login at a new computer. So I'd like to add to that list "something you monitor" whether through SMS-based 2FA, push notifications, or just plain emails or further challenges if something looks suspicious (e.g. logins from Africa when I'm also logged in from the US)
- zobzu 13y ago
  While I don't consider the notifications to be part of the authentication - I agree, yes, notifications are good. We're doing something like that at my company as well (its not a bank or anything). If you log from other countries, have too many repeated failed (or even successful) attempts in a time period, etc. you get notified on a dashboard/you can optin for an email (or /and an email that forwards to your SMSes). then you can decide if/when you want to see it and to notify security if you think there's a problem. saves a lot of time for the sec team as well which only will manually check when the alerts reach a higher threshold.

by zobzu 13y ago

lstamour 13y ago

Something you have, something you know ... I can see the utility in requiring just those. But I've found it useful to get messages from service providers when, for instance, my ATM card is used, or when I login at a new computer. So I'd like to add to that list "something you monitor" whether through SMS-based 2FA, push notifications, or just plain emails or further challenges if something looks suspicious (e.g. logins from Africa when I'm also logged in from the US)

zobzu 13y ago
While I don't consider the notifications to be part of the authentication - I agree, yes, notifications are good. We're doing something like that at my company as well (its not a bank or anything). If you log from other countries, have too many repeated failed (or even successful) attempts in a time period, etc. you get notified on a dashboard/you can optin for an email (or /and an email that forwards to your SMSes). then you can decide if/when you want to see it and to notify security if you think there's a problem. saves a lot of time for the sec team as well which only will manually check when the alerts reach a higher threshold.