Getting Started with Security Keys

Post by jen729w » Thu, Oct 31, 2019, 5:00 AM UTC

skybrian wrote: post #26

I would put greater emphasis on not locking yourself out, since that's the most likely threat for many people. Losing your phone (or having it die on you) is common and you should assume you'll do it sooner or later. Print out backup codes and store them somewhere safe that you won't forget before enabling two-factor authentication that depends on you having your phone or other device that can break.

Post by chowell » Thu, Oct 31, 2019, 5:08 AM UTC

burner589432 wrote: post #29

kadoban wrote: post #17

Earlier quoted context omitted.

Correct me if I'm wrong, but password managers can prevent quite a lot of phishing, because autofill can automatically check the domain. It would be abundantly obvious to me if I were going to put my paypal password into anything but paypal, for instance, because I wouldn't even have the option. I'd have to copy/paste if I wanted to, which would up my suspicion level to the extreme. (this is not to downplay security…

> since the autofill is not 100% reliable, it's not that unusual to go into the password store and manually get the password out of there. I imagine you can extract passwords out of security keys in some form without being on the correct domain, too. Do domain check fails that regularly? I'm sure enterprise configuration policies would provide functionality to prevent password extraction should you be inclined to ena…

Post by cbhl » Thu, Oct 31, 2019, 5:14 AM UTC

skybrian wrote: post #26

I would put greater emphasis on not locking yourself out, since that's the most likely threat for many people. Losing your phone (or having it die on you) is common and you should assume you'll do it sooner or later. Print out backup codes and store them somewhere safe that you won't forget before enabling two-factor authentication that depends on you having your phone or other device that can break.

Post by [deleted] » Thu, Oct 31, 2019, 5:23 AM UTC

kadoban wrote: post #36

pvg wrote: post #25

Earlier quoted context omitted.

It would be abundantly obvious to me That's what people say but even security experts have fallen for phishing attacks. And since the autofill is not 100% reliable, it's not that unusual to go into the password store and manually get the password out of there.

It's really quite unusual. I'm not sure what password managers these security experts are using, but there's no way it works like mine (bitwarden). I've never had it fail to recognize the domain, which is good because that seems like really obvious functionality. I have had it fail to autofill due to site implementation, and the couple of times it happened I was extremely on my guard and triple-checked everything bef…

Post by [deleted] » Thu, Oct 31, 2019, 5:54 AM UTC

jen729w wrote: post #31

skybrian wrote: post #26

I would put greater emphasis on not locking yourself out, since that's the most likely threat for many people. Losing your phone (or having it die on you) is common and you should assume you'll do it sooner or later. Print out backup codes and store them somewhere safe that you won't forget before enabling two-factor authentication that depends on you having your phone or other device that can break.

Or you upgrade your phone, or wipe your phone for some reason, and forget that your OTP codes don't transfer over. This is one reason I love OTP codes stored in 1Password. That was until I read a post here which convinced me that this approach is a total waste of time as I no longer truly have '2FA'. I have 1FA, and that is 1Password.