News for hackers. Stuff that matters.

A comment on NIST declares the age of SMS-based 2-factor authentication over. Parent comment

Re:NIST declares the age of SMS-based 2-factor authenticatio... by bigiain on Tuesday July 26, 2016 @03:13AM (#12163855)
I always refuse to use the "scan QR code" thing, and everybody I've tried that with (at least Google, Amazon, Github, Dropbox, Linode) give you a TFA secret to type in as an alternative - I then store these in 1Password and can back that up and use them to key Google Authenticator on additional devices. (I've never tried to extract or backup.reuse secrets from Authenticator.)
[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by rahkiin on Tuesday July 26, 2016 @04:32AM (#12164153)
In 1Password premium, you can put the secrets directly as TOTP in a login item (on your phone) by scanning a qr or entering the secret. Then 1Password will generate the OTP for you. It then also works nicely in the desktop browser.
[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by asuffield on Tuesday July 26, 2016 @05:52AM (#12164466)
This only works for services using TOTP mode; HOTP prevents replay/cloning attacks.
[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by Rafert on Tuesday July 26, 2016 @07:24AM (#12164808)
The HOTP counter is something you can increment yourself if needed when storing it somewhere?

Proper implementations of TOTP do not just rely on expiring the codes. From chapter 5.2 of RFC 6238: "Note that a prover may send the same OTP inside a given time-step window multiple times to a verifier. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP."

[ Parent | on HN ]
Re:NIST declares the age of SMS-based 2-factor authenticatio... by vel0city on Tuesday July 26, 2016 @11:53AM (#12166477)
Yep, right at the top of page 7 of the RFC: https://tools.ietf.org/html/rfc6238

If it accepted the same token more than once, it couldn't possibly be called a "one-time password".

[ Parent | on HN ]