Hacker News Reader

Comment by schaefer | Hacker News Reader

It completely blows my mind that blizzard got it right over a decade ago with a dedicated physical device that would generate a one-time, time sensitive key for second factor authentication (to protect my video game account).

Where as I feel I'm still waiting for my bank (actual money) to catch up. they took the easy way out by sms-ing me a second factor authentication key. Even though phone number theft is a known attack vector.

View on HN

The thing that is nutty is.. they PAY MONEY for the SMS method! I do not understand why more sites don't support TOTP like Google Authenticator.

Google authentication is great, until it's time to get a new phone.

I store my totp secrets in keepass with everything else and synchronise it to my other devices.

This probably undermines the idea - but phones get lost/destroyed/wiped regularly.

Check out Authenticator Plus - its another TOTP app that lets you backup your (encypted) 2FA secrets and optionally syncs them across devices.

Thankfully Google Authenticator is just TOTP, so you can use whatever client you want.

Thanks for the tip, I only knew about authy before

Also, check out andOTP on F-Droid: https://f-droid.org/en/packages/org.shadowice.flocke.andotp/

Open source and supports backups.

andOTP is amazing, I thoroughly recommend it.

Had no idea about this. I liked Google's Auth since it was simple but it missed the crucial backup feature. Authy is nice but you're putting trust in a 3rd party that doesn't have a channel for donations, though it seems they're making money through SMS (Twilio).

andOTP is just what I was looking for since it's FOSS and had backup! This would have been a lifesaver when I lost my phone but glad to have run into it now.

TOTP is old and busted, U2F is the new hotness.

https://en.m.wikipedia.org/wiki/Universal_2nd_Factor

> The device key is secured against duplication by a degree of social trust in the commercial manufacturer

TOTP sounds much better. Also doesn't requires "trusted magic hardware"

U2F prevents some vulnerabilities that TOTP alone can't. It's possible to replicate it in software instead of a hardware token, but so far nobody has. So if you're adopting 2FA, suggestion is to use U2F if you can.

Print out the QR code and store it in a safe.

A while back because of shifting mobiles a lot ( due to repairing my mobile and also having a temporary replacement) I ended up making a rudimentary program to store shows codes and even qrcodes for reading from the mobile working in my Linux terminal. https://github.com/lcabral37/terminalOathApp

It did the work and even today I use it every now and then, instead of pulling out the mobile.

If you have 1Password it supports OTP and thus can be used across devices.

Whenever discussing this with colleagues there’s always been a bit of debate about whether OTP inside 1password constitutes 2FA or not.

On the one hand a password could be popped from the target site or phishing, and you’d still need the 2nd factor from 1password to get in.

But on the other hand, if you leave your phone lying around unlocked with a poor master password, both get popped together.

If you leave your phone unlocked with Google Authenticator / SMS 2fa and a weak master password, you still get popped. The only difference to me in convenience of 2fa code auto fill.

LastPass has this too I think. But something seems off to me storing my 2FA with the service that manages my first factor.

YubiKeys can store and access OTP secrets. I put the secret in both Google Authenticator and my YubiKeys as backup.

Lastpass categorically does not have this. We could find no way to use it to share TOTP among administrators for a root account for example.

They refused a refund as well.

Horrifically bad company customer service, UX, UI. Save yourself the trouble and skip them, call 1Password.

1Password can store 2FA and will auto-fill them on desktop and mobile.

I do this too. I guess it sort of undermines the idea of a second factor but the only way someone could get at it would be to break into my 1Password account, which seems unlikely.

Google authenticator allows you to transfer all your codes to a new phone and that includes if you lost your old phone. So they must be backing up to your Google account.

Do you have a source on this ? I don't think google authenticator backs up by design, and that's good.

This is why it's best to use something like Authy

Some financial providers offer a 2FA choice at login that includes email. The 2FA email can be directed to an account protected by a hardware key.

agreed: my investment bank (real "real" money) finally started offering an authenticator (that adds random numbers to your password every login) two years ago.

i worked at a major semiconductor company in the late 1990's and to use their VPN from home you needed an authenticator fob. eventually this was replaced with a password, but hardware fobs (& parellel port dongles) have been around since at least the 80's. astonishing this has taken so long.

although i still have trouble understanding how to best protect myself against MYSELF. I'm just now getting my head around multiple yubikeys and subkeys in case i get locked out.

Barclays has the slot-your-card in pin sentry gadgets. Those are quite nifty. They don't need to be personal, because they take their pin from the bank card. So they can just hand them out.

My first experience with 2FA was the Paypal Security Key[1]. Unfortunately it's proprietary, and to this day, they only support it or SMS for 2FA.

It would be great if everyone adopted TOTP, I'm up to a dozen sites in Authy and it's fantastic. Still waiting for my actual banks to support it though.

[1] https://i.imgur.com/ABcZXrP.jpg

My bank used to do the tokens until some mathematician reverse engineered the algorithm proving it insecure.

They've now moved on to certificates on your phone.

You go to the bank, prove your identity, they sms you a certificate. When you choose electronic authentication on the website you get a popup on your phone to accept. You put in a password and it validates the cert on your phone and sends the response to the website.

All without having to install anything.

My bank did that, maybe a decade ago. It was pretty inconvenient any time I wanted to access my bank account away from home. SMS is a godsend by comparison.

U2F keys are ideal in this regard. You typically have your keys with you. The only weakness is that not enough apps incorporate u2f over nfc.

It's nothing new, I was using and also admin for RSA token 20 years ago.

Reply on news.ycombinator.com