Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device is hardened to physical attack on the stored memory to retrieve the key by force.

Do iPhones or Android device have a secure memory location to store the key, or is it just sitting there on the same partition as other data? We are specifically considering Google Authenticator if there are any specifics you can give regarding its security.

share|improve this question
add comment

1 Answer 1

As far as I'm aware (and I don't have any concrete facts about this), iphone/android phones do not have any special storage area for secure data. However, if you use an OAUTH type app as a 2nd factor authentication, then this shouldn't normally be a huge concern (this is not the only means of authentication - you need a password too). Of course it depends on the situation.

Comparing to something like yubikey, I would imagine the following pros/cons or considerations to take into account:

  • Lost device - People easily notice when their phone is missing. Also they don't stay away from their phones for too long. Not necessarily so with something like yubikey, which you have to use only specifically for authentication (might not be very frequent)
  • Yubikey probably has better hardware protection and it's a dedicated device
  • With both, you should have good, quick procedure in place to revoke access. If someone lost their phone/key they should notify and the access blocked for this device as soon as possible
  • Cost - yubikey will cost extra if you already have a smart phone, but much less for people who don't
  • deployment - might be trickier to distribute the shared keys to smart phone users rather than buying a bunch of yubikeys and handing them to people
  • education - depends on your situation, people might be happier with an app on their phone, but some might prefer a separate device.
  • user-friendliness / mobility - as George Bailey pointed out, it should be easier to use the yubikey as it will automatically type in the key for you. However, if you want to access the app using your mobile phone, then yubikey is probably not usable at all without a USB port.
share|improve this answer
1  
It might be worth mentioning user-friendliness. The Yubikey automatically types in the OTP. I am guessing that the phone Apps aren't gonna do that. –  George Bailey Mar 26 '12 at 17:19
1  
good point @GeorgeBailey!, but conversely, if you want to access an online resource via your phone, then there's nowhere to stick the yubikey in... :) –  Yoav Aner Mar 26 '12 at 19:59
    
The CPU in iPhones (and many Android phones) supports TrustZone, which would allow a “special storage area”: it can have storage that's not hardware-hardened, but encrypted with a device-specific, not-conventionally-extractible key. It's easy to see by source code inspection that Android doesn't use that; what about iOS? –  Gilles Mar 27 '12 at 7:00
    
Another useful note re: usability … authy.com (which is fully interop with Google Auth / TOTP) is doing some interesting things with Bluetooth and OTPs. You can install a helper on your computer that will sync with your phone whenever it's nearby, and make the app work just like Yubikey: hit the key, and your web-page logs you in. –  elliottcable Sep 19 '13 at 18:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.