3 ms·

What happens if I lose my phone? I have human ways of authenticating myself to my wireless provider and getting a new phone with same phone number back. Do I ne

by aleyan 13y ago

What happens if I lose my phone? I have human ways of authenticating myself to my wireless provider and getting a new phone with same phone number back. Do I need to backup the RSA private key? If my phone is compromised physically or with malware, this does nothing to protect my twitter account. Both proverbial eggs are in the same phone.

joeblau 13y ago
> “My phone fell in the ocean!”: Backup codes generated in the application can be written down, stored in a safe place, and used to access your account on twitter.com even if you lose your phone. You should probably take a look at Twitters official blog post which has a bit more explanation[1]. I hear what you're saying about the "Well what if i lose my private keys" because we had the same issue with CACs. Every private key was escrowed somewhere, but you have to remember that this system is optional, not mandatory. This is security measure is designed to help prevent future AP incidents[2]. As far as phone compromise, that's a valid concern. Any large company should policy in place to regulate devices for validating logins (which don't happen that often). As far as individual users, we'll have to see. Since Android is the dominant mobile platform, I'm guessing that malware will be more prevalent on those devices. [1] - https://blog.twitter.com/2013/improvements-to-login-verification-photos-and-more https://blog.twitter.com/2013/improvements-to-login-verifica... [2] - http://www.huffingtonpost.com/2013/04/23/ap-twitter-hacked_n_3140277.html http://www.huffingtonpost.com/2013/04/23/ap-twitter-hacked_n...
echohack 13y ago
Rule #1 of security: There is no such thing as perfect security. Of course there are still problems with two factor authentication, but it's better than the alternative. If you lose your phone with two factor auth the provider should give you several temporary keys that you can use, or a way to contact their support line and confirm your identity.
- aleyan 13y ago
  Agree on rule #1. > " or a way to contact their support line and confirm your identity" That is one of the nice things about SMS 2-factor auth, the backup authentication method (lost phone) is on the wireless company instead of you. I suppose twitter can handle the extra responsibility though. They have ways of verifying accounts, so now it is just a question of scaling that for support.
  - sehrope 13y ago
    > That is one of the nice things about SMS 2-factor auth, the backup authentication method (lost phone) is on the wireless company instead of you. This is one of the terrible things about SMS 2-factor auth! In exchange for having them be able to replace your phone (so your 2FA works again) you're giving them the ability to spoof you at any given time. From a company's perspective it might be better (don't have to deal with "I lost my ...") but it's a terrible trade off for users.

by aleyan 13y ago

joeblau 13y ago

> “My phone fell in the ocean!”: Backup codes generated in the application can be written down, stored in a safe place, and used to access your account on twitter.com even if you lose your phone. You should probably take a look at Twitters official blog post which has a bit more explanation[1]. I hear what you're saying about the "Well what if i lose my private keys" because we had the same issue with CACs. Every private key was escrowed somewhere, but you have to remember that this system is optional, not mandatory. This is security measure is designed to help prevent future AP incidents[2]. As far as phone compromise, that's a valid concern. Any large company should policy in place to regulate devices for validating logins (which don't happen that often). As far as individual users, we'll have to see. Since Android is the dominant mobile platform, I'm guessing that malware will be more prevalent on those devices. [1] - https://blog.twitter.com/2013/improvements-to-login-verification-photos-and-more https://blog.twitter.com/2013/improvements-to-login-verifica... [2] - http://www.huffingtonpost.com/2013/04/23/ap-twitter-hacked_n_3140277.html http://www.huffingtonpost.com/2013/04/23/ap-twitter-hacked_n...

echohack 13y ago

Rule #1 of security: There is no such thing as perfect security. Of course there are still problems with two factor authentication, but it's better than the alternative. If you lose your phone with two factor auth the provider should give you several temporary keys that you can use, or a way to contact their support line and confirm your identity.

aleyan 13y ago
Agree on rule #1. > " or a way to contact their support line and confirm your identity" That is one of the nice things about SMS 2-factor auth, the backup authentication method (lost phone) is on the wireless company instead of you. I suppose twitter can handle the extra responsibility though. They have ways of verifying accounts, so now it is just a question of scaling that for support.
- sehrope 13y ago
  > That is one of the nice things about SMS 2-factor auth, the backup authentication method (lost phone) is on the wireless company instead of you. This is one of the terrible things about SMS 2-factor auth! In exchange for having them be able to replace your phone (so your 2FA works again) you're giving them the ability to spoof you at any given time. From a company's perspective it might be better (don't have to deal with "I lost my ...") but it's a terrible trade off for users.