Safari tries to fill username • Hacker News Board

Re: Safari tries to fill username

#391

Post by nl » Mon, May 31, 2021, 3:30 AM UTC

ascar wrote: post #158

nl wrote: post #91

Earlier quoted context omitted.

Sure.

No need to be sarcrastic. He is absolutely right. The seed is all you need in case of the common TOTP algorithm. There is no connection to the device. In fact, in Google Authenticator you can even conveniently export all running TOTP to another Google Authenticator without any connection with the apps or anything else whatsoever.

That wasn't supposed to be sarcastic at all.

I was in total agreement with him - you can in theory run the algorithm by hand.

It isn't especially relevant though - 2-factor is "something you know, something you have". You need to have the hash.

Re: Safari tries to fill username

#392

Post by nl » Mon, May 31, 2021, 3:32 AM UTC

hedora wrote: post #216

thaumasiotes wrote: post #83

Earlier quoted context omitted.

The seed is all you need. The device is unnecessary.

So, it’s a password. All I need for password authentication is the password and a device that can generate a one time proof that I know the password. TOTP just seems more secure because the password is never displayed to the end-user.

It's not a password.

A password/passphrase/passcode is something you know.

A hash for a TOTP is something you have. 2 factor means something you know and something you have (or something you are): https://dis-blog.thalesgroup.com/security/2011/09/05/three-f...

(And yes in theory you could remember the hash, and have a custom TOTP client that lets you enter it in. But unless you do this it is a theoretical argument only).

Re: Safari tries to fill username

#393

Post by 1337shadow » Mon, May 31, 2021, 1:48 PM UTC

flats wrote: post #248

1337shadow wrote: post #23

Earlier quoted context omitted.

As a webdev I can confirm that I have exactly the same experience supporting Safari that I had supporting IE 15 years ago.

As a web developer, I, too, have had moments fixing a Safari bug that reminded me of dealing with IE in the past. But only passing moments, and I don’t blame Safari. Supporting multiple browsers is a uniquely annoying aspect of web development, and almost every developer uses Chrome for development (I’m a Safari user and it’s kind of a running gag at work). This means that for most developers, Safari is the main brow…

I disagree, they have been lagging on webcomponents supported both by FF and Chrome for years