Earlier quoted context omitted.
TOTP is a second factor. The hash seed that generates a password is connected to the device.
The seed is all you need. The device is unnecessary.
Sure.
Safari tries to fill username
91–100 of 393 posts
Re: Safari tries to fill username
#92Earlier quoted context omitted.
The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…
Autocomplete has one huge, glaring disadvantage: the passwords are stored on your computer, in reversible form.
When you connect to a website with ssl, your sensitive data is transmitted in a reversible form as well.
I believe moat browsers will use the system keyring (which is usually encrypted based on your login password or a tpm) if present or use a master password to encrypt them at rest.
Re: Safari tries to fill username
#93Anything but following standards and making sure that upon joining the internet new users either know how to use the tools, or know what the consequences can be.
I miss netiquette and RTFM
Re: Safari tries to fill username
#94Earlier quoted context omitted.
> TOTP is fundamentally a password I see this view a lot. It's wrong. TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. TOTP in fact has one property that makes it potentially* the most secure of all 2FA methods: it can be used airgapped. As the credential you type into the 2FA form is not the saved secret. * I say "potentially…
> TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. Are you familiar with SRP? TOTP has all of the properties of passwords, and no properties that passwords don't have. That makes it... a password.
I guess you can argue the definition of the word "password"; language is fluid, especially English.
I would say SRP is strictly a misnomer (though it's a useful conflation). Generally speaking password is a value provided for authentication (if it's no longer being "provided", as in SRP, it's something different... but I understand using a familiar word for that something different is helpful when communicating).
Either way, in saying TOTP was "just a password", the point you were trying to make was that TOTP is "no different than and therefore no better than a 2nd traditional password". The fact it's not transmitted makes it very different to, and better than, a traditional password. So whatever you want to define the definition as, the point stands.
> and no properties that passwords don't have
It has 1 property that passwords don't have: it is not transmitted!
Re: Safari tries to fill username
#95Re: Safari tries to fill username
#96Earlier quoted context omitted.
Yes, that shared key is a password, a piece of knowledge known in common between you and them.
A password is something you're supposed to "know", i.e. something in your head. A second factor is something you have, i.e. your phone, a hardware token, or access to a shared secret you don't store in your head. Password managers kind of mangle the idea and turn the password from something you know to something you have.
A password is information, something that can be freely duplicated.
The idea of "something you have" is that the thing can't be duplicated. As soon as it can, it's no longer "something you have". Any number of people might have it. A person who has it might not be you.
SMS hijacking, for example, converts your phone-based authentication to a password, where the password is your phone number. (Since an attacker who knows that number can pass the test.)
TOTP starts its life as a password.
Re: Safari tries to fill username
#97Earlier quoted context omitted.
Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST…
> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.
The issue was that it was ONLY SMS - they immediately deprecated private certificates, 2FA "calculators" and other 2FA schemes.
After the security backlash they now backpedaled and implemented 2FA with ONLY apps. Apps that ONLY work on iOS and Google Android. I had endless calls from family where they couldn't access their banks anymore because they had a Huawei phone or a dumb phone. Banks are citing "security" as explanation why they can't use smartcards, hardware tokens or even bring apps to desktop computers or phones without Google services.
The funny part is - ALL banks did this at once. Why? Because the security consultants had "must have app" and "must check Google Safety net" on their check lists.
Re: Safari tries to fill username
#98Earlier quoted context omitted.
Autocomplete has one huge, glaring disadvantage: the passwords are stored on your computer, in reversible form.
Yes, but let's be fair, it's a galaxy better than writing it on a post-it or password booklet, and still way better than using a memorable passphrase which will get reused and then leaked. Besides, you can encrypt the local storage with a master password (and if you accept online as a requirement, you could even add 2FA to that).
The password booklet can be secure if you have good physical security, and is immune to a software zero-day and autocomplete exploits.
Re: Safari tries to fill username
#99Earlier quoted context omitted.
OTP one-time-password fields
autocomplete="one-time-code" Any others?
Search fields. I don't want it filling in the users address or email address when they're searching for a customer.
We have customer service representatives that accept orders over the phone, including credit card numbers. These should not get stored by the browser as autocomplete data.
Re: Safari tries to fill username
#100Related, there is a "bug" in chrome that disabled autocomplete="off" on input elements, marked as won't fix https://bugs.chromium.org/p/chromium/issues/detail?id=587466
I tend to side with Chrome here. IMHO, the decision of whether to show auto-complete should be with the user and not with the website. When I install an auto-complete add-on or activate a browser feature, I expect the AC to be available on ALL input fields, whether the site owner thought that would be a good idea or not. Now, there is a valid question on how the user should be able to configure the AC behavior, and h…
>IMHO, the decision of whether to show auto-complete should be with the user and not with the website.
There's a setting in Chrome where you can disable auto-complete on a field-by-field basis?