YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

Post by johnbatch » Wed, May 23, 2018, 3:34 AM UTC

sbr464 wrote: post #52

jakobegger wrote: post #10

Earlier quoted context omitted.

Yes, iPhones allow storing data that can’t leave the device. Otherwise OTP apps would be pointless. I don’t know the details, but some apps use it to store OTP secrets. Eg. if you use the DUO app, your secrets will be backed up, but they can only be restored on your phone. (was quite a hassle to reset 2FA on all the websites after my phone was replaced in warranty repair) Not sure what Google authenticator does.

Duo recently added a feature (haven’t tested it yet) that allows you to transfer to another phone. Quote from email: In late August we will release an updated version of the Duo Mobile app that includes a new feature called Duo Restore. This functionality enables Android and iOS Duo Mobile users to recover their Duo-protected accounts when they get a new device. Duo Restore is an opt-in feature that can be enabled or…

Microsoft added this feature also recently https://docs.microsoft.com/en-us/azure/multi-factor-authenti...

Post by Fnoord » Mon, May 28, 2018, 10:43 AM UTC

snowwrestler wrote: post #58

zaroth wrote: post #39

Earlier quoted context omitted.

If I install a TOTP generator on a machine and setup 2FA on a 3rd party service, and I then later login with a password and a 6 digit TOTP code, that is definitely 2FA. You can argue my TOTP shared secret may or may not be secure enough from malware. But it’s definitely 2FA and it successfully protects against the attack vectors that adding a “something you have” factor is designed to protect against. Better than SMS…

2FA protects against "password spraying" but that is not really the scariest threat model. The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished. The advantage of a token for 2FA is that you don't type it in. It takes human judgment out of the equation. Using NFC to supply the one-time code on…

I'm not sure which of these is more scariest. It also depends on the user, or their past choices. E.g. I reused passwords before I had a password manager else I couldn't remember all of them.

> the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand

The main disadvantage is the cost of time.

Another disadvantage is that the code can be read by anyone around you. With something physical you got more control over where you keep it, though that also has its disadvantages.

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support

Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support