NIST declares the age of SMS-based 2-factor authentication over

Re:NIST declares the age of SMS-based 2-factor authenticatio... by scrollaway on Tuesday July 26, 2016 @08:03AM (#12164970)

As an aside: The "What you know and what you have" paradigm is failing, imo. We often say passwords should be autogenerated, unguessable and unlearnable, stored in password safes like Keepassx. This removes "what you know" and you end up with "two things you have" (An OTP seed and a password in a safe).

When both the password and the TOTP seed are on the same machine - assuming you autogenerated your password - they are both autogenerated and out of your sight so they really are just two things you have, and you have them in the same place. The difference is, it's impossible to capture the TOTP seed from the TOTP token being input - passwords are vulnerable to that.

Am I crazy or does that make the password completely redundant?

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by jjnoakes on Tuesday July 26, 2016 @09:08AM (#12165306)

If you lock your password database with a long, secure password that you know, then you are still doing it "right".

If your password database is not encrypted with a strong passphrase, then you are right, they both become "what you have".

[ Parent | on HN ]

Re:NIST declares the age of SMS-based 2-factor authenticatio... by scrollaway on Tuesday July 26, 2016 @09:21AM (#12165381)

Ah, that's true.

[ Parent | on HN ]