Re:YubiKey comes to the iPhone with Mobile SDK for iOS and L...
by Fnoord on Monday May 28, 2018 @06:43AM
(#17171707)
I'm not sure which of these is more scariest. It also depends on the user, or their past choices. E.g. I reused passwords before I had a password manager else I couldn't remember all of them.
> the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand
The main disadvantage is the cost of time.
Another disadvantage is that the code can be read by anyone around you. With something physical you got more control over where you keep it, though that also has its disadvantages.
Re:YubiKey comes to the iPhone with Mobile SDK for iOS and L...
by watersb on Tuesday May 22, 2018 @07:16PM
(#17130265)
> The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished.
I can be fooled into reading a 6-digit PIN to Evil Mallory, a MITM attack.
I can be fooled into tapping my NFC auth token on Mallory's Evil Website, and the auth handshake would fail. Or not. It depends on the protocol, I suppose.
Is that what you mean?
The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished.
The advantage of a token for 2FA is that you don't type it in. It takes human judgment out of the equation. Using NFC to supply the one-time code on an iPhone preserves that advantage.
Now, you might not think a phishing threat model is relevant to you, and that's fine. My point is simply that there is a difference between a 2FA code you type in, and a 2FA code that is supplied directly from hardware.