Hacker News Reader

Comment by ls612 | Hacker News Reader

Here’s the thing. I consider myself fairly responsible but I’ll bet I’m far more likely to lose my phone than it is that my Authy and Dashlane credentials are both compromised, which are my pw manager and Authenticator app. You have to choose your risks and for a lot of people an authy like feature is much safer overall than GA.

View on HN

All my 2FA codes are backed up. On paper. I have a physically-secured cache of the QR codes which can be pretty quickly imported into a new app.

Do you trust the security of your printer when you print codes? They are historically one of the biggest attack surfaces.

Are you referring to network-enabled printers phoning home?

My 15 year old Brother doesn't have that capability... So on that front, a printout of QR codes is more likely to be compromised by the paper itself being left out somewhere.

I’m not the same person, but anecdotally I’ve been using an ancient printer for years. I’d like to think it’s quite secure. Only works via usb, no wifi or anything complex. The only way I could get it to work is in Linux where I assume the drivers or however it happens is open source. As far as I know the printer is as dumb as a rock.

Worst case, i doubt it would be that difficult to hand draw the qr codes on graph paper. Would be quite tedious, but they should be error correcting to some extent.

What's your threat model? Security researchers or nation-state level adversaries might theoretically be able to tap your printer and parse it for things that look like codes, but if you're receiving that level of expert human attention then you're probably already compromised in one of 1000 other ways.

The huge majority of people don’t have nation state threat models.

If you are worried about that then using a desktop computer in the first place is a bad idea.

I mean, I think it's a lot less likely that someone compromises my printer which is behind all of the same network protection measures as my PC, scours it for previous printouts of QR codes (if it does retain them), to identify what account they can potentially hack... than that they compromise a 2FA cloud service directly and log into all my accounts.

What's the threat model here? If the CIA is in my home network, I'm sure they can get into my email account too.

What happens when you're traveling? What if some combination of your wallet, laptop, paper files or phone are stolen or destroyed by fire or water?

Essentially, what's your backup plan so if the very worst happens when you're in the middle of nowhere you're not completely locked out?

It's not hard to come up with scenarios that get you locked out for longer than expected regardless of your auth set-up.

e.g. "What if I'm traveling, I lose my phone, and the country I'm in blocks internet access to my 2FA service?" "What if I'm traveling, I lose my phone and my wallet?" (In this case, even if you use a syncable 2FA service - how will you pay for a new device to access it without your wallet? You have a different problem here, that likely involves going to an embassy and/or relying on friends & family!)

The question is, (a) how _likely_ are those scenarios? And (b) how much risk/damage/pain do they cause?

If I'm traveling, I'm fine unless I lose my phone. If I lose my phone, then I guess I can't sign in to some/many things until I get back. If I lose my phone AND my wallet and I'm not at home, I'm probably more worried about getting my ID cards and bank cards replaced than accessing certain websites. If my house burns down with my phone, wallet, and backup cards inside, I'm probably just thankful to be alive.

If I'm traveling, and I lose my laptop, phone, and wallet, I really hope I can't restore access to my 2FA codes! Because if I can get access to my 2FA codes somewhere else in the world without those things, so can an attacker!

I see people say this a lot in the tech community, but it’s a preposterous expectation that regular users would be doing something like this. MFA needs to usable by everyone, not just the tech elite.

MFA is a power tool for extra security. It deliberately sacrifices usability and integrity for security. If you want something more usable, you don't want MFA.

Really though, I think "one-time passcodes" is the wrong escape hatch because it is actually just password auth, not a second factor. The way it ought to be is that you hook up multiple devices. (e.g. like having both a phone Authenticator app and a USB key.)

Or, I keep using single factor because services MFA implementation sucks tremendously, and as per service agreements service is liable in any security compromise case.

Frankly, most of MFA is security masturbation, is nowhere near to being a real solution, not even a real problem. Its just neat from a technical standpoint (if done well, which nearly never happens).

A minimum of 2 registered u2f keyfobs, that's all you need to make it usable and safe. Nobody does it, and trusts people either backup their otp codes or never lose or break phones. Ridiculous.

MFA is always better than single factor. At the very least it makes drive by/automated attacks significantly harder. Everything you read about SIM jacking and the like is at bare minimum, much harder than hacking your password.

From a users perspective, MFA is nearly never better than single factor. Attacks are services responsibility anyway.

At some point something has to give though. Security and convenience are constantly at odds with each other. My opinion is that it's far better to convince people that it's worth the inconvenience rather than watering the security down to the point where it's basically pointless. And if they take the consideration that the extra security isn't worth it for them, then that's the choice they make.

I have copied all the 2FA strings in a separate keypass database, with a different password, only in my memory.

I also went through writing a simple javascript page to import all those keys to Google Authenticator via totp:// protocol. It takes a csv of all strings, and spits out the html links with totp://protocol. All using local storage only. So whenever I change phone, I paste the csv from keypass to google keep (pretty safe), open it on the new phone, copy it & paste into my html5 app, and click each link and it auto adds itself to Google Authenticator. Then I select all text in Google Keep and delete it.

A Yubikey is what you are looking for.

https://www.yubico.com/

Paypal though has no backup codes...

Take a look at SAASPASS Authenticator & Password Manager. You can use them separately or integrate them for extra convenience and autofilling options. The desktop browser extension can autofill both passwords and Authenticator codes and on mobile with iOS 12 onwards with autofill capabilities.

Reply on news.ycombinator.com