31–40 of 56 posts
Congrats on launching and building something. Unfortunately I think this is very bad for security. We have seen numerous accounts take overs from iMessage and sms based 2fa. This makes it even easier. I also don’t understand why password managers are starting to support storing totp. It is a terrible idea.
Congrats on launching and building something. Unfortunately I think this is very bad for security. We have seen numerous accounts take overs from iMessage and sms based 2fa. This makes it even easier. I also don’t understand why password managers are starting to support storing totp. It is a terrible idea.
If your 2FA code is as autocompletable as your password, is it really a second factor?
Yes — because 2FA is commonly stored on a separate device (phone), people are very quick to conclude that it is pointless otherwise without thinking further. Even if it is stored in your password manager, it is still useful. Consider the case where your network or website is compromised: the password is compromised and can be reused, but the totp 2fa that is in your password manager still prevents login by anyone who…
A laptop, or even better, a large, immobile desktop PC, is a much better second factor than a phone, and there is no reason why a user should be forced to go find their phone when they have console access to a much larger device.
Putting a Yubikey semi-permanently on every device and having you do a one-time registration of each device (initially using another already-registered device) should be the default way of implementing 2FA.
If your 2FA code is as autocompletable as your password, is it really a second factor?
I personally don't think so. It's something you know + something you have with you. If your computer is compromised, the 2FA should be somewhere else, not in a keychain. This is why I like Yubikey and other forms of 2FA (phone based TOTP, mostly).
I'm glad to see someone making this for Chrome. I really like how Safari does it. It can check mail and messages, then delete the message after verifying. One of the reasons why I am finding it difficult to switch from safari.
Broken websites aren't enough of a reason to switch?
I think what helps a lot is that if it's broken in Safari on macOS (not a big deal for the business), it would also be broken in Safari on iOS (which would be a disaster).
Congrats on launching and building something. Unfortunately I think this is very bad for security. We have seen numerous accounts take overs from iMessage and sms based 2fa. This makes it even easier. I also don’t understand why password managers are starting to support storing totp. It is a terrible idea.
1Password's had this for many years now. In a perfect world with users who followed the rules perfectly every time, a separate TOTP gadget is clearly better. In this world, a slightly less secure TOTP system that's convenient enough that regular people actually use it is vastly better than a perfect system that gets worked around.
Analogy: NIST says to stop requiring periodic password rotations. In dreamland, users would use their password manager to create a new, ultra-strong, unique password every time. In reality, people tired of the rotation treadmill go from `SecurePassword!202406` to `SecurePassword!202407`.
As a component, a separate TOTP generator is better. As a system, an integrated one is more useful.
Congrats on launching and building something. Unfortunately I think this is very bad for security. We have seen numerous accounts take overs from iMessage and sms based 2fa. This makes it even easier. I also don’t understand why password managers are starting to support storing totp. It is a terrible idea.
My view is that totp/2FA prevents someone with only your password from logging in. Having the totp seed inside a password manager doesn't break this goal, so I'm fine with it. Of course it means if my password manager gets hacked, there's everything to log in inside, but I'm more concerned about services leaking password hashes that get broken, or accidentally getting phished (and giving up a password + totp combo th…
Earlier quoted context omitted.
Broken websites aren't enough of a reason to switch?
which websites are broken? I'm not seeing them
Earlier quoted context omitted.
My view is that totp/2FA prevents someone with only your password from logging in. Having the totp seed inside a password manager doesn't break this goal, so I'm fine with it. Of course it means if my password manager gets hacked, there's everything to log in inside, but I'm more concerned about services leaking password hashes that get broken, or accidentally getting phished (and giving up a password + totp combo th…
I just went round and round with my bank about needing my phone number so they can text me a TOTP. You know, for security. They just can't quite seem to wrap their head around how having the same device running their banking app that also receives the text is not secure when the device is no longer in your possession.