News for hackers. Stuff that matters.

A comment on Keybase's mission is to make encryption mainstream. Parent comment

Re:Keybase's mission is to make encryption mainstream by scrollaway on Wednesday September 27, 2017 @02:21PM (#15350710)
On Android, I use FreeOTP; I can make backups with `adb`.

Separately, I use KeepassXC (https://keepassxc.org) and store all my 2fa seeds in a dedicated (separate) 2fa database which I keep locked. You can also keep it in the same database as your password db if you want to trade the 2nd factor for convenience but still get the added benefit of one time passwords.

[ Parent | on HN ]
Re:Keybase's mission is to make encryption mainstream by philsnow on Wednesday September 27, 2017 @03:35PM (#15351476)
> I can make backups with `adb`

does it follow that an attacker can make a "backup" of your 2fa codes as well, if they get ahold of your phone for a minute or two?

[ Parent | on HN ]
Re:Keybase's mission is to make encryption mainstream by scrollaway on Wednesday September 27, 2017 @05:43PM (#15352596)
Physical device access is where this kind of security ends. If someone stealing your phone just to get your 2fa codes is a threat vector for you, you should be using different/additional factors.

In any event, as was pointed out, adb needs usb debugging turned on, which needs the device unlocked to be enabled.

[ Parent | on HN ]
Re:Keybase's mission is to make encryption mainstream by veeti on Wednesday September 27, 2017 @08:54PM (#15353650)
You need to authorize each adb key on the phone, so a screen lock prevents this.
[ Parent | on HN ]
Re:Keybase's mission is to make encryption mainstream by craftyguy on Wednesday September 27, 2017 @05:07PM (#15352358)
No, because you can (and should) disable usb connectivity/debugging.
[ Parent | on HN ]