Hacker News Reader

Comment by sneak | Hacker News Reader

TOTP (the six digit codes) is bad and outdated 2FA anyway. It's vulnerable to phishing.

Use WebAuthn with security keys.

Until people stop using SMS codes it's still way more safe from cell phone cloning attacks.

People should have stopped using SMS codes when NIST told them to stop six years ago. The fact that there are websites that still support it is an abomination and should come with hefty legal penalties.

The Australian Government's national website for its citizens to interact with gov services uses SMS based 2FA, and doesn't appear to support any other type. :/

People? It's banks, who all insist on SMS, not people,

And Apple

Where does Ape use SMS based 2FA? Do you have a Windows computer maybe?

If you don't log into an Apple OS with your account

Apple specifically says for Apple School Manager they want: a work email address that is not associated with an App Store or iCloud account, and has not been used as an Apple ID for any other Apple service or website

Progress, not perfection.

Sms should never be used or offered, and needs congressional action to be stopped as a practice.

TOTP at least prevents turning Wireless carriers into security providers and is "good enough" for nearly everything.

And yes, WebAuthn/U2F is top of totem pole and should be something we're striving for nearly everything.

> Sms should never be used or offered

It's better than nothing.

you could say the same about any shitty security, but most people don't want shitty security

From this thread and elsewhere, I'd argue that's not the case.

No, it's WORSE than nothing. You're turning a 3rd party [wireless provider] into a security service that can authenticate you without your knowledge.

Your comment is aging well: https://arstechnica.com/information-technology/2023/05/t-mob...

The problem with security keys is that they're expensive and you have to carry them around.

TOTP is cheap and much better 2FA than OTP over SMS.

Security keys can be built into the phone and still provide a reasonable expectation of security, e.g. Apple's Passkeys.

Obviously, a YubiKey would be better, but Passkeys don't require you to carry an additional thing and are still more secure than TOTP apps.

> can be built into the phone

I don’t like this idea. As a person whose had a phone break, like many others, tying auth to something so fragile should not be preferable. I’ll never forget my phone breaking and the process of trying to order a new one: the online shopping here, Shopee, demanded SMS 2FA (only option) which I needed to purchase a new phone so I found a different vendor but then my bank required SMS 2FA (only option) to do a transfer.

At least with these hardware security tokens, they’re pretty ‘dumb’ and often covered in epoxy or other weather-resistant material that makes them quite rugged & durable. Mine have gone through the wash and dangle from my motorbike’s keychain during the monsoons without issue.

> YubiKey

Please just use a generic term like “hardware security key/token” rather than endorsing a singular brand–especially one that is closed-source and looking to “go public” (https://news.ycombinator.com/item?id=35625065). If you think the closed nature of Google Authenticator is bad, consider an open hardware token option rather than a closed one.

who’s* had a phone break

This is sort of willfully missing the point, I concede, but I have my U2F token physically embedded in my arm and have minimal fear of losing it/being without it. Right now it runs OpenPGP and a Yubikey U2F emulator, but it can run just about any flavor of MFA with the appropriate companion app (full subdermal Java Card platform).

https://dangerousthings.com/product/flexsecure/

Hard agree, though, TOTP >>>>>> OTP via SMS

That's some wild Bourne Identity stuff. The thing permanently bricks itself after a specific number of failed attempts. About 3cm long and does TOTP and PGP. Wild.

WebAuthn doesn't work with apps. At the moment, FIDO2 relies on either your Big Tech account of choice or an expensive USB key. TOTP is free. There are no backups, so you also need to manually get your second USB key out of that safe place (the fire resistant safe in another physical location people talk about) every time you need to register a 2FA device.

WebAuthn and friends are definitely an improvement, but it's not quite a perfect replacement yet.

Besides, even some banks still use SMS for 2FA at this point. TOTP would make a lot of sites more secure already.

What do you all like to do for security key backups?

I use yubikeys wherever I can, but I've got to admit that fetching all 5+ keys from their various locations and then replacing them every time I need to enroll in something gets old fast, especially when you get into locations like "buried in the mountains".

The phishability of TOTP is indeed a big problem but being able to just save the seed (theoretically, somewhere not next to the other credential) is really nice.

Tangent: why can’t I backup the whole key? I have two OnlyKeys. I like have the second as a backup, and it covers the plaintext and TOTP slots well, but it can’t copy the U2F/FIDO2 slot. Naïvely I thought it would work like this and when I retrieved the backup, I was locked out of the account needing to fallback to TOTP anyhow.

it might not be optimal but it is infinitely better than the no 2fa that most people do or the sms that is all too common among 2fa. it is fine for most people and most things.

Reply on news.ycombinator.com