Hacker News Reader

Comment by lmilcin | Hacker News Reader

Just use a token like yubikey. I have a small fleet and am very happy with the decision.

The only problem is there are very few services that get it right. Get it right means support multiple tokens and allow to truly disable any other means of logging in or recovering the password.

Most services seem bent on allowing many ways of logging in without giving a choice. For example, they will advertise they use 2fa tokens but then if you can't produce one they will still allow you to log in with SMS or mail (ie. password recovery by mail). Facebook will not even let you set up tokens without having SMS set up as a factor and the phone number verified.

I hope slowly developers will get more aware and they will be better tooling (and stack exchange answers to ctrl+c ctrl+v...) to do it correctly.

View on HN

What about Authenticator? Maintaining a small fleet of yubikeys costs as much as a whole phone.

https://play.google.com/store/apps/details?id=com.google.and...

Know that if your single phone dies with all your totp credentials, you're sunk.

Only if they neglected to offer backup codes (which anyone who does TOTP should).

Otherwise, you can just grab a few backup codes out of your fireproof safe and register your new totp code, or go to the bank and get them out of your bank vault.

Sure, the fireproof safe costs as much as a few yubikeys, but if you go the yubikey route you both need the yubikeys and a fireproof safe and bank vault for your spare yubikeys too.

Fireproof safe? Just use a text file and encrypt it.

Or a password manager file only for TOTP backups.

Don't use text file. Use regular piece of paper, put it in tamper-evident envelope and keep register with events regarding envelopes.

When you take something from envelope, note the date, the why, the number of envelope you opened and the number of envelope you then put the piece of paper in. Every time you open envelope check with the register that the numbers agree.

True, and this is the reason I instead direct friends to options such as Authy or Aegis which allow the use of more than one device.

Unfortunately my bank (ANZ) and my government's online platform (myGov) in AU both have dedicated OTP apps which only allow single-device installations. When I lived overseas, my bank in Germany also had their own dedicated OTP app but they allowed installation on a backup device as well. Much better.

Reply on news.ycombinator.com