Re:Uber Paid Hackers to Delete Stolen Data on 57M People
by thaumasiotes on Wednesday November 22, 2017 @01:53AM
(#15754855)
You can also record the TOTP secret in your automated login script, next to your password, and generate the token on the fly right there.
It's things like that that make me wonder why TOTP tokens are supposed to be conceptually different from passwords. A TOTP scheme involves knowing a master password, and nothing else.
Re:Uber Paid Hackers to Delete Stolen Data on 57M People
by Xylakant on Wednesday November 22, 2017 @03:11AM
(#15755158)
Recording a TOTP secret next to your password would make 2FA worthless, true. That’s why you should use hardware generators whenever possible. However, Github supports Fido/u2f which is conceptually superior to TOTP: The authentication secret is bound to the domain and the token generator verifies this. So even a software u2f implementation protects against phishing for example, while TOTP does not.
Re:Uber Paid Hackers to Delete Stolen Data on 57M People
by bringtheaction on Wednesday November 22, 2017 @07:12AM
(#15756179)
Do you know of any open source software implementations of u2f.
Re:Uber Paid Hackers to Delete Stolen Data on 57M People
by Xylakant on Wednesday November 22, 2017 @07:17AM
(#15756201)
Firefox includes one IIRC and there’s githubs SoftU2F for Mac https://github.com/github/SoftU2F
This is incorrect.
You only need the ability to generate TOTP or U2F tokens. This is often done using a smartphone app, but can also be done by a desktop app like 1Password or a hardware device like a Yubikey: https://github.com/blog/2071-github-supports-universal-2nd-f...