0

Standard Password

When I create an account somewhere, like let's say a crypto exchange, I'm forced to choose a username and a strong password. Let's say I choose:

username: thirdratecoder
password: someLongPasswordWithMixedCaseAndTheNumber555_*&

Now, that's a pretty obscure password and no one would likely guess it. I'm likely not going to remember it either, so I record it in a password spreadsheet that lives on a Veracrypt-encrypted volume.

Authy

But then, the exchange says, "Hey, your account would be more secure if you used Authy two-factor authentication."

So I agree, and the exchange gives me a code which, when entered into Authy allows a time-based, short-lived number to be generated on demand. Easy enough. So I store that code in my spreadsheet alongside the password. Say it's something like:

REALLYLONGAUTHYCODE

Question

Why is the use of Authy TFA more secure than just having a long password? Presumably the user will record his Authy code right along side his normal password. The net result being that the user now has two passwords instead of one. What's the added security benefit? If my password file is compromised, the thief would have access to both my password as well as the Authy code.

I understand that with Authy, there's an additional step; The short-lived code required for authentication isn't actually the Authy code itself, but rather is derived using (a) knowledge of the current time and (b) knowledge of the code derivation algorithm. But since the current time and the algo are presumably public knowledge, the only private ingredient is the Authy code itself -- which is just basically a long, random password. Feels to me like I just have two passwords. Where's the added security benefit?

4
  • 5
    "If I place the pin code to the door lock under the mat along with the key to the handle lock, what's the benefit?" Frankly, I'm not sure why you are storing the Authy seed at all.
    – schroeder
    Sep 1, 2021 at 18:54
  • Two passwords are better than one, it’ s an additional level of security. The code is more difficult to guess than the password. If the password is stolen the code still work (this protect you from phishing for example). You should not store all info in the same place, that is your fault. Sep 1, 2021 at 18:58
  • "Frankly, I'm not sure why you are storing the Authy seed at all." @schroeder take a wild guess. Sep 1, 2021 at 21:35
  • @Third-rateCoder wild guess: you routinely uninstall and reinstall Authy? Sep 2, 2021 at 17:09

2 Answers 2

3

Why is the use of Authy TFA more secure than just having a long password? Presumably the user will record his Authy code right along side his normal password.

No, the user should not do this.

The user should record the code in a different system, or a system where it's not easily retrievable, but will provide codes, e.g. the Authy app. Someone with access to only the computer via e.g. key logger will not reveal the secret for the TOTP.

This protects against a diverse set of attacks:

  1. Someone shoulder surfing and observing the password will not learn how to generate valid codes.
  2. A phishing site will only get one valid code, which will be valid for only a short time.
  3. If the password is reused across different sites, a breach in Site A won't totally compromise Site B.
  4. A key logger will not learn the secret, only a set of valid codes, which can not be used to reconstruct the secret.

I store a lot of the OTP secrets on a set of yubikeys. Even if I give you one of them, you can't reconstruct the secret - only create valid codes. For other - lower security systems - they are generated by Bitwarden. On a untrusted computer I'd enter them from my phone, thus a keylogger would not learn the secret.

2
  • Ah yes, now we're getting somewhere. Not familiar with "shoulder surfing," but you're right, if you can phish the user into entering his password and one-time-code, the attacker would only have between 0-30 secs to make use of it. Makes sense. As to those suggesting that passwords and authy codes be stored separately... don't disagree, but laughable to think that any more than .50% of users would know what a 'yubikey' is, much less how to use it. Sep 1, 2021 at 21:44
  • But most users would see the QR code and scan it with the app, never storing it or the secret - so that would be mission accomplished; password and secret stored on different devices.
    – vidarlo
    Sep 2, 2021 at 6:18
2

TFA as in TWO Factor Authentification is an additional protection.

Ideally your Password is "What You Know".

Authy or similar is "What You Have".

Well sort-of in the case of Authy and its ilk.
Because it's software it could be invisibly stolen/cloned,
but that's the idea.

Obviously if all of your personal records and passwords and initialization codes are stolen, you're hosed. The intent is to act as a secondary protection in case of server or transport compromise or password reuse. What goes out over the wire and to the server is a changing second factor.

Is it foolproof? No, but it's and additional level.

1
  • "Ideally your Password is "What You Know"."... Is it though? I don't know too many people who memorize all of their passwords, although I guess that might've been more common when people used only two or three sites and simple passwords were allowed. Sep 1, 2021 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .