41–50 of 139 posts
I have little trust that google authenticator app is any different. But as far I can see you can’t use any of these alternatives from the article.
Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…
As long as you use encrypted backups with iPhone, your GA keys are backed up and you can restore a new phone with them also.
My Google Authenticator data survived me migrating to a different phone because my flow is: 1. Backup old phone using Titanium Backup. 2. Get new Android phone. 3. Root it. 4. Copy TB backup files from old phone to new. 5. Restore apps and data on new phone using Titanium Backup. Obviously it's not a procedure a normal user is expected to do...
In Iphone I just do backup and restore in itunes. Everything is migrated. I dont see why you need to do all these.
I use Microsoft Authenticator and it has cloud backups. Maybe it's unsafe, they promise it's super safe. https://docs.microsoft.com/el-gr/azure/active-directory/user...
Earlier quoted context omitted.
All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.
I see people say this a lot in the tech community, but it’s a preposterous expectation that regular users would be doing something like this. MFA needs to usable by everyone, not just the tech elite.
Really though, I think "one-time passcodes" is the wrong escape hatch because it is actually just password auth, not a second factor. The way it ought to be is that you hook up multiple devices. (e.g. like having both a phone Authenticator app and a USB key.)
Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…
>- Passcode or biometric locks on an app are a gimmick and offer negligible value. Biometric locks are interfaces that the OS does not expose to users, and that are backed via an HSM. On the iPhone and modern Android, they allow you to envelope encrypt a message via biometrics in such a way that it can only be unlocked from within the app that locked it AND via enrolled biometric signatures. Passcodes are the same, b…
Earlier quoted context omitted.
>- Passcode or biometric locks on an app are a gimmick and offer negligible value. Biometric locks are interfaces that the OS does not expose to users, and that are backed via an HSM. On the iPhone and modern Android, they allow you to envelope encrypt a message via biometrics in such a way that it can only be unlocked from within the app that locked it AND via enrolled biometric signatures. Passcodes are the same, b…
Your biometrics are already getting analyzed from all angles somewhere in China just from all the face apps that predict which Disney princess you are. And you cannot change it like a password. So that's why it's a gimmick.
I ended up writing my own TOTP app. It's about 50 lines of common lisp code.
Strongly disagree with the premise of this article: - Passcode or biometric locks on an app are a gimmick and offer negligible value. - The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface. - In particular, Authy, LastPass and 1password have a giant attack surface compar…
>- Passcode or biometric locks on an app are a gimmick and offer negligible value. Biometric locks are interfaces that the OS does not expose to users, and that are backed via an HSM. On the iPhone and modern Android, they allow you to envelope encrypt a message via biometrics in such a way that it can only be unlocked from within the app that locked it AND via enrolled biometric signatures. Passcodes are the same, b…
I'm well aware of how the mechanism works.
If the host OS or the app is compromised, it won't help - the attacker can just steal the codes after they're unlocked by the enclave.
For physical theft, it only provides a meaningful advantage if the phone is unlocked. Someone stealing your unlocked phone to get at your 2FA codes is well outside of most people's threat model.
Earlier quoted context omitted.
All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.
What happens when you're traveling? What if some combination of your wallet, laptop, paper files or phone are stolen or destroyed by fire or water? Essentially, what's your backup plan so if the very worst happens when you're in the middle of nowhere you're not completely locked out?
e.g. "What if I'm traveling, I lose my phone, and the country I'm in blocks internet access to my 2FA service?" "What if I'm traveling, I lose my phone and my wallet?" (In this case, even if you use a syncable 2FA service - how will you pay for a new device to access it without your wallet? You have a different problem here, that likely involves going to an embassy and/or relying on friends & family!)
The question is, (a) how _likely_ are those scenarios? And (b) how much risk/damage/pain do they cause?
If I'm traveling, I'm fine unless I lose my phone. If I lose my phone, then I guess I can't sign in to some/many things until I get back. If I lose my phone AND my wallet and I'm not at home, I'm probably more worried about getting my ID cards and bank cards replaced than accessing certain websites. If my house burns down with my phone, wallet, and backup cards inside, I'm probably just thankful to be alive.