News for hackers. Stuff that matters.

A comment on Listen to a SIM-Jacking, Account-Stealing Ransom. Parent comment

Re:Listen to a SIM-Jacking, Account-Stealing Ransom by shittyadmin on Thursday October 11, 2018 @01:40PM (#18195481)
There's many 2FA apps compatible with the TOTP and HOTP standards and they rarely, if ever require an update.

Absolutely minimal 3rd party involvement, I'd say less than most web browsers these days as there really isn't a significant attack surface for the apps.

[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by kaoD on Thursday October 11, 2018 @02:26PM (#18195881)
If you're truly paranoid, TOTP and HOTP are absurdly easy to implement if you've got an HMAC primitive:

https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_a...

https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...

https://github.com/google/google-authenticator/wiki/Key-Uri-...

[ Parent | on HN ]
Re:Listen to a SIM-Jacking, Account-Stealing Ransom by VectorLock on Friday October 12, 2018 @01:46AM (#18199502)
It always bugged me how Google Authenticator doesn't back up accounts "by design." I know its more secure, but damn its a major hassle if you use it for a lot of things and you need to get a new phone.
[ Parent | on HN ]