4 ms·

Thanks but no, google auth can be installed on any mobile device. Why bother with some "keys"

by homakov 11y ago

sjwright 11y ago
On the upside, Google Authenticator has access to an accurate RTC. On the downside, your encryption secret is available "in the clear" in the form of a TOTP token that is loaded into the app. You are highly vulnerable during these moments. If an attacker gets a copy of the TOTP token, they can generate the six digit numbers as easily as you.
sp332 11y ago
Maybe you have a rooted Android device and don't entirely trust the software running on it?
- fragmede 11y ago
  Even if it's not rooted, your carrier and your device manufacturer effectively have remote root access to your phone and you may not trust either of them.
lyall 11y ago
If you have to get an OTP multiple times a day—say to ssh into a prod server—you quickly learn how laborious it is having to take your phone out of your pocket, unlock it, find the Google auth app, find which OTP you're looking for then finally transcribe it without any errors. Pressing a key combo/tapping the yubikey (depends on the model you have and its settings) is much faster. To me, not having a yubikey would be like not being able to use cmd-C/V to copy/paste and having to use the system menu every time instead.
- askbill 11y ago
  The 2FA interaction from Duo is superior here.
  - jnpatel 11y ago
    Are you referring to Duo Push, or something more?
danieldk 11y ago
Because U2F is much safer than TOTP. TOTP is still sensitive to phishing: the MITM could just ask for the TOTP code and forward it. This is not possible with U2F, since only the original site has the key handle that is necessary to initiate the challenge-response. https://developers.yubico.com/U2F/Protocol_details/Overview.html https://developers.yubico.com/U2F/Protocol_details/Overview....
- homakov 11y ago
  Can you elaborate with attack scenarios how U2F mitm is different? There's no display on youbiky, which means it's the same thing

Thanks but no, google auth can be installed on any mobile device. Why bother with some "keys"

by homakov 11y ago

Thanks but no, google auth can be installed on any mobile device. Why bother with some "keys"

On the upside, Google Authenticator has access to an accurate RTC. On the downside, your encryption secret is available "in the clear" in the form of a TOTP token that is loaded into the app. You are highly vulnerable during these moments. If an attacker gets a copy of the TOTP token, they can generate the six digit numbers as easily as you.

sp332 11y ago

Maybe you have a rooted Android device and don't entirely trust the software running on it?

fragmede 11y ago
Even if it's not rooted, your carrier and your device manufacturer effectively have remote root access to your phone and you may not trust either of them.

lyall 11y ago

If you have to get an OTP multiple times a day—say to ssh into a prod server—you quickly learn how laborious it is having to take your phone out of your pocket, unlock it, find the Google auth app, find which OTP you're looking for then finally transcribe it without any errors. Pressing a key combo/tapping the yubikey (depends on the model you have and its settings) is much faster. To me, not having a yubikey would be like not being able to use cmd-C/V to copy/paste and having to use the system menu every time instead.

askbill 11y ago
The 2FA interaction from Duo is superior here.
- jnpatel 11y ago
  Are you referring to Duo Push, or something more?

danieldk 11y ago

Because U2F is much safer than TOTP. TOTP is still sensitive to phishing: the MITM could just ask for the TOTP code and forward it. This is not possible with U2F, since only the original site has the key handle that is necessary to initiate the challenge-response. https://developers.yubico.com/U2F/Protocol_details/Overview.html https://developers.yubico.com/U2F/Protocol_details/Overview....

homakov 11y ago
Can you elaborate with attack scenarios how U2F mitm is different? There's no display on youbiky, which means it's the same thing