Skip to main content
Most people are more likely to lose authenticator tokens (their phone, their yubikey) than be hacked by a sophisticated attacker

Password manager 2FA and SMS 2FA solves the threat model that most people live in

(Organizational security has a far different threat model)
Hypolite Petovan
Hypolite Petovan  
•
@silverwizard But cloud password managers are likely to be hacked as well 😕
@silverwizard
silverwizard
silverwizard  
Which is more likely: a second LastPass situation or me washing my Yubikey?
Hypolite Petovan
Hypolite Petovan  
•
@silverwizard You are a terrible example.
@silverwizard
silverwizard
silverwizard  
Which is more likely - Becky losing her phone number or a second LastPass?
Hypolite Petovan
Hypolite Petovan  
•
@silverwizard A second LastPass, but some SMS 2FA attack vectors don’t require you to lose your phone number, so I’m partial.
@silverwizard
silverwizard
silverwizard  
Oh, no - attacking SMS 2FA is easy to just SIM hijack

I am talking about getting locked out because you accidentally lost your auth app
Hypolite Petovan
Hypolite Petovan  
•
@silverwizard Still LastPass, these days losing a *phone number* is pretty hard to do.
@silverwizard
silverwizard
silverwizard  
That's what I'm saying
You won't lose your phone number for SMS or password manager

Whereas losing a phone with an TOTP authenticator setup or losing a yubikey is pretty simple
Bob Jonkman
Bob Jonkman  
•
So far, every service for which I've registered TOTP (Twitter, Facebook, Mastodon) has offered recovery codes in case I lose my TOTP device. Surely that mitigates @silverwizard 's loss model.

@hypolite
@Hypolite Petovan @silverwizard
Bob Jonkman
Bob Jonkman  
•
And I keep my paasword manager DB on several devices. Does that make me as weird as @silverwizard ?

@hypolite
@Hypolite Petovan @silverwizard
silverwizard
silverwizard  
Does KeePass do TOTP these days?
Hypolite Petovan
Hypolite Petovan  
•
@silverwizard What's TOTO? I have a KeePass TOTP plugin that I use as the truth source for all my TOTP tokens. Based on the seed it can generate a QR code that token apps can read.
@silverwizard
silverwizard
silverwizard  
Also - I am a terrible example because I have a backup yubikey to sign up two tokens
⛅ w chance of bears
⛅ w chance of bears  
•
Mostly I find myself weirded out by people acting like authenticator apps are high friction in comparison to SMS 2FA. The user experience of "hopefully the code arrives quickly" makes it just that bit unpleasant even when they often *do* come promptly. (Yubikeys have a very obvious $$ barrier to being the norm for individuals.)
silverwizard
silverwizard  
Yeah, I just only have the option of Google TOTP which squicks me, or Yubico TOTP which needs a key, so uh, kinda fails the access test

But also - I am *far* more likely to lose a phone than by hit by SIM swapping (to be clear - only because I'm a dumbass)
⛅ w chance of bears
⛅ w chance of bears  
•
Yeah, most of my TOTP tokens are mirrored across my Yubikeys largely to save headaches when changing phones. I have one on Entrust's app that I can't do that with and the couple of times I've had to move it were a pain finding the instructions again.

But using Yubico TOTP also basically primed me for "password manager TOTP is functionally the same as Google TOTP but with the convenience of device portability"
silverwizard
silverwizard  
Well, the issue most people have with password manager TOTP is that then if your password manager is compromised, then your password is

And the answer to that is "it's complicated" - but yeah - in a perfect world we'd all have two security keys, and one is kept in a secure location and one is kept in a wallet/keychain - but that's not feasible (says the man with that)
Hypolite Petovan
Hypolite Petovan  
•
@⛅ w chance of bears Although for authenticator apps, the high friction comes when the device where tokens are installed disappears for some reason (repairs, theft, replacement). Then the real uphill battle starts.
@⛅ w chance of bears
⇧