Hacker News Reader

Comment by teeray | Hacker News Reader

I’m not crazy about these “consult your phone to log in” things. There’s just so many more moving parts. Sometimes the push notification doesn’t make it through. Other times the acknowledgment from the phone doesn’t make it back. Occasionally my phone is doing updates when I urgently need to log in.

I’d love for the “something you have” to be “my laptop.” It has a TPM; we can do this securely. Something like the MBP’s Touch Bar where there is a separate integrated physical device with a screen that can make security prompts is ideal.

View on HN

I had a particularly hard time recently due to this when my phone broke and I couldn't replace it for a week or so. It all got figured out in the end, but not being able to access my Google account and all that entails was more of a problem than I expected.

That's why I have the set of printable backup codes in my wallet. One time I forgot my phone, but I had my wallet and was able to log in to my Google account.

I keep Authy installed on my tablet for exactly this reason, in case I lose my phone I still have a backup device for 2FA. Won't help for the SMS 2FA for the sites I'm forced to use that on, but at least Authy lets me get to the important ones.

A well-designed MFA system has multiple fall backs available. Google's has options to fall back to sending an SMS (not the highest level of security, but security is always a trade-off), so if you're phone's broken you can move the SIM to another one. Or a phone call to a pre-registered landline that will read out a code to you. As well as the paper/printable emergency codes.

That said, there's always going to be compromises and annoyances - I've been using MFA for 10+ years, and occasionally something glitches out, but other things (e.g. basic password systems) also sometimes glitch out, and having an account compromised is much, much worse than a minute or two of mild annoyance.

Google also has a TOTP fallback, which solves the "I want my second factor to be my laptop" perfectly.

Really? How is this activated or enabled?

Go to some google service > profile menu dropdown in the top right > manage your google account > security > signing in to google > security > 2 step verification.

You can then 'add more second steps to verify it's you' including an option for an authenticator app (i.e. totp). Also worth generating some backup codes while you're at it.

Not everyone has a SIM to begin with. Or it is lost with the phone.

Anything that has a single or dual point of failure is dead on arrival. Too bad you will realize only after you are locked out of all your digital life.

Authentication always has a single point of failure: you.

If other people could log in as you it would defeat the point

That is at least within my control, I can live with that.

For what it's worth, google's MFA setup is the best of any I've used. You can (and should) setup a variety of second factors on your google account so that if one of them fails for some reason you've got other options. Between backup codes, TOTP, pixel phone verification and multiple FIDO keys there's plenty of options.

This compares very favourably to, say, AWS where you can only have a single second factor and the recommended(!) way of protecting against loss of a second factor is to have multiple accounts with different second factors registered to each of them.

Your laptop (probably) already supports FIDO2 with your TPM, now it's a matter of Google (and others) implementing it.

They have it already in WebAuthn in a completely siloed way. That is, they only implement hardware token support and if you want software tokens, they will make your life painful.

Desktop (i.e. non-portable) WebAuthn authenticators are good for things like transactional authorization (e.g. confirm a payment on PayPal), but not especially useful for authentication: if you already have your WebAuthn secrets on your browser (or OS), you probably also have your authn cookies, too!

I'm glossing over a few things (e.g. WebAuthn credentials can be stored in secure hardware, so can be more secure than cookies), but in general, WebAuthn secrets stored in a desktop TPM, while valuable in certain applications, aren't alone a very meaningful step toward getting rid of passwords—since passwords are primarily used for authenticating on new (never-before-used) endpoints.

A slightly degenerate case is one where you use passwords to sign into your (say) MacBook, but Apple syncs the WebAuthn credentials via iCloud so you don't need a password on any other services. Which, like, if you're gonna do this—why not just use Apple's password manager and sync passwords? :)

I would never want my laptop to be my authentication device for my personal life. I am away from home when I need to log in to things. Even if I'm at home, I am not sitting at my desk when I need to log in.

Hopefully we can set two devices as trusted?

The worst way is how my bank is currently doing it, they require SMS authentification but do not allow two phones at the same time, and to switch it on you have to sign something and wait for a letter by snail mail.

Now I'm stuck with a decade old phone just to confirm my online transactions, and if it breaks I'm out of luck. The alternative would be to not have working online banking for one or two weeks, which I cannot afford at the moment (thanks to Covid).

Some of these authenticator apps store their state in your phones TPM (or "secure enclave") already.

All you're really saying is you want them to ship the authenticator apps to desktop platforms as well as mobile..

Reply on news.ycombinator.com