Tag Info

New answers tagged

1

One idea I had was to apply some sort of simple process (or cipher) to the backup codes so they are obscured, but able to decoded by remembering the process. Perhaps something like ROT13 or xor. After that, you'd print them on a business card template and set them as contact info. This boils down to security through obscurity, but at least partially helps ...


3

First of all, any time you install any software of any variety, you're trusting the author of that software. There's no way around that. You're trusting that the author isn't malicious, that he isn't sloppy, that he knows what he's doing, that his implementation is correct, and a dozen other points as well. Likewise you're trusting the site owner in a lot ...


2

Well, the rather interesting conundrum with 2FA or multiFA is the endpoint and how the tokens traverse through the network. If you use google's SMS service or authenticator, notice how the shared secret key is passed. At the weakest link, at least for SMS services, if the telco stores the SMSes, and has access to your stream, then you will have to trust the ...


4

A TOTP (Time-based One-Time Password) authenticator app will not have your username and password. What it will have is a secret token that is used to generate a specific pseudo-random sequence of numbers that changes based on time (typically every 30 seconds). The app need not even have any network connectivity itself - that is just for backup purposes in ...


1

Yubikey can either be cloud-based with Yubi providing the "yes/no" answer or you can run it locally. Run locally and benefit from the OTP.


10

Two-factor or multi factor authentication is based on three possible forms of authentication: Something you know which is considered secret (password) Something you have (token, SMS token, card,...) Something you are (biometrics) If either two of these three are combined, you can speak of two-factor authentication. Saying two things you know (such as two ...


0

How can they enforce that? The browser plugin will not store the data permanently on your local machine if Permit Offline Access is set to Disallow. It is only available while your internet connection is active and your session with LastPass is current. If they somehow encrypt my password db with a key returned by the google authentication procedure ...


1

Pros: You could gain security by having that the physical access card, that is used to open doors in organization, must be placed on a Reading pad or inserted in a smart card reader, and kept there to keep the computer logged in. As soon as the card is removed, computer is forcefully logged out. (shutdown /l /f /t 0) I would advise against locking the ...


0

From reading the source it looks like the secret is stored on the Yubikey and stored encrypted multiple times with different keys inside the otp.xml file. The encryption keys are derived from the next n OTPs (derived from the secret) starting from OTP i..i+m where i is the current counter and m is the look ahead value. When the user enters their OTP values, ...


0

You can store them in a Keepass database (with a good password). You can print them on paper, and keep that somewhere safe. You can create an Android VM in Virtualbox, install Authenticator and use that as backup for 2FA. In Amazon AWS you can use several of these accounts, but I don't know if Google allows this. That VM should be kept on an encrypted ...


0

For your application, I would suggest, storing the recovery keys on plain paper that you put inside a home safe. Thats enough security. They rather steal the phone or 2FA token from you if they really want your account. And physical attacks are very rare. Actually, you dont even need to put them in a safe. You can put them in the desk drawer at home. But do ...


3

Yes, it loses some of the protection since it fails to protect them if the device is thoroughly compromised. It still, however, protects against any number of limited attacks. For example, if they are configured to connect through a proxy that can strip the encryption, the 2FA will remain safe. If the password DB is compromised somewhere that they used ...



Top 50 recent answers are included