4 ms·
They keep saying this is 2-factor authentication, but without the first factor (something you know e.g. a password) and going straight to the second factor (som
by Zikes 13y ago
They keep saying this is 2-factor authentication, but without the first factor (something you know e.g. a password) and going straight to the second factor (something you have e.g. your smartphone) they actually only provide a single factor for authentication.
This is of course less secure than true 2-factor authentication, and the web site is misleading in its wording.
- famousactress 13y agoTo be fair if your phone is locked with a pin then we're still at least roughly in "something you have and something you know" territory.
- stcredzero 13y agoVery roughly. When you put in your phone lock pin, you are not authenticating with the website. So roughly, it's not.
- giovannibajo1 13y agoI dont see how that matters. You still need a password + one file (on the phone). SSH keys with passphrase are two factors as well in my book. In fact, I would say that not having to transmit the weakest part (the mnemonic password/pin) over the wire is a plus.
- stcredzero 13y agoI dont see how that matters. Please tell that to anyone thinking of hiring you for security.
- gphil 13y ago> They keep saying this is 2-factor authentication, but without the first factor (something you know e.g. a password) I always wonder about this even when there is a password. For most services, a phone compromise would be a total compromise. I rarely get prompted for a password on my phone (nor do I enjoy typing one when I'm trying to do something quickly.)
- yeukhon 13y agoWell if you choose two-factor by sending the code to your SMS and your device is lost it is certainly doom. Just as if you lose your laptop there is a great chance someone with enough patient and skill can/may hack into an encrypted disk/brute force the login.
- michaelmior 13y agoI asked this exact question to the team on Twitter a few days ago when I first heard about this. Their response[1] was that you need a PIN to unlock the app. [1] https://twitter.com/getclef/status/431095300619390976 https://twitter.com/getclef/status/431095300619390976
- Zikes 13y agoNo matter how well protected the phone or app is, the receiving service still only gets one factor of authentication.
- smsm42 13y agoPIN is short (usually). Which means if somebody gets their hands on your phone, they need to only guess about 13 bits of information (for 4-digit PIN) to get access to every site you ever logged in with this phone. That provided they actually use the PIN to encrypt the data, not just to check access to it, in which case once somebody gets their hands on the phone, it's game over.