6

Basically 2FA relies on the idea that instead of just something you know, using a service also requires something you own.

I am quite confident, especially when used on iOS (which has a better system level app segregation), that this gives a pretty good security. Though I am not sure about adding a desktop 2FA utility.

In my understanding, an attacker would need to intercept my password (likely through a keylogger on my desktop machine were I log most) and an access to my phone, or to the key stored on my phone. But I can likely picture that someone able to setup a keylogger could steal enough information to reuse any 2FA system available on my desktop computer.

Writing this I am understanding that this is based on the perception that:

Computer integrity < Phone integrity < iOS integrity

Computer are more likely to be corrupted through the pile of junk I am installing on it and their more important "openness" to system changes.

Smartphones have a more restrictive ecosystem and a shorter livespan, thus a lighter probability to be infected.

iOS, is comparatively the most closed ecosystem where unlike on Android most access are not opened in API and the app checking is more thorough.

1
  • 2
    More importantly, a piece of malware on your computer can't access your phone directly. It's two different devices, with different vulnerabilities. – vidarlo Dec 17 '17 at 16:21
7

You made an assumption that affects your outcome, and you cannot forget that you are making this assumption: that one "likely" gets your password via the desktop computer (i.e. keylogger). If that is your threat analysis, that's perfectly fine, just don't forget that you have made this differentiation.

Since your threat analysis is desktop-based, then yes, your conclusion is correct that adding a security function to the already-assumed-to-be-compromised desktop does not add a layer of security. If one can get your password, then one can get your 2FA code.

But, a desktop 2FA option is not useless if we change our assumptions. If we assume that one is more likely to get our passwords from the services we use (instead of our desktops), or even that one can get passwords from our mobile devices, then the desktop security measure legitimately adds a useful security function.

The ultimate question becomes: what is the most likely vector of password compromise? And that question changes constantly. And that's why being mindful of our threat assessments and reviewing them from time to time is very important.

So, the desktop 2FA option is a valid one, depending on your threat analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.