Downsides of Google Authenticator

Re:Downsides of Google Authenticator by ender341341 on Friday February 28, 2020 @02:19PM (#22445477)

> In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized services and if you also keep your passwords in there, you eliminate the whole point of two factor authentication.

1pass user, while I know that it's not as secure as keeping them separated I view it as if someone has access to my 1password vault unencrypted I'm already screwed, but having 2FA coming from 1 tool still protects me from the case of my username/password pair getting leaked or MITMed.

[ Parent | on HN ]

Re:Downsides of Google Authenticator by J5892 on Friday February 28, 2020 @02:38PM (#22445642)

As a LastPass user, my main defense against the possibility of someone accessing my LastPass account is the fact that all of my important accounts have 2FA completely separate from LastPass.

So if someone got a hold of my LastPass master password, they can't access my google account, banking, etc.

[ Parent | on HN ]

Re:Downsides of Google Authenticator by dillondoyle on Friday February 28, 2020 @03:21PM (#22445962)

I'm curious about LastPass - it's what I use and work in politics.. Their security page says encrypted on device [1] before sending to them? is that not trustworthy or I'm not understanding? or maybe worried about compromised devices (where it's over anyways)?

1: https://www.lastpass.com/enterprise/security

[ Parent | on HN ]

Re:Downsides of Google Authenticator by J5892 on Friday February 28, 2020 @04:03PM (#22446333)

I trust LastPass's security as much as I trust any company's security. I'm not worried about MITM attacks, but there are many other ways that someone could get access to an account.

The biggest security issue is that they hold the keys to my entire kingdom. So if someone somehow gains access to that account, I need another layer of protection, no matter how small the chances are.

[ Parent | on HN ]

Re:Downsides of Google Authenticator by camgunz on Friday February 28, 2020 @04:46PM (#22446714)

I'd recommend 1password over LastPass. LastPass has had some real facepalm security issues, and 1Password has a reputation for passing some pretty strenuous audits. We used LastPass on the tech team at HFA and... I think everyone I know has switched to 1Password or something else. I do 1Password and Yubikeys.

[ Parent | on HN ]

Re:Downsides of Google Authenticator by dillondoyle on Saturday February 29, 2020 @05:31PM (#22453654)

thanks! I used to use 1password - are you sure there haven't been similar problems? [1] I'm happy to switch but it's hard to know what to trust without being a subject matter expert here...

https://www.theregister.co.uk/2017/02/28/flaws_in_password_m...

[ Parent | on HN ]

Re:Downsides of Google Authenticator by camgunz on Monday March 02, 2020 @02:44PM (#22468093)

Oh yeah it's had issues. As a more paranoid than most user I don't use the browser extension or the internal browser in the mobile app, which I catch more than a little flak for haha.

Mostly I'm making an appeal to authority to tptacek [1].

https://duckduckgo.com/?q=tptacek+1password+site%3Anews.ycom...

[ Parent | on HN ]

Re:Downsides of Google Authenticator by lastres0rt on Friday February 28, 2020 @04:07PM (#22446367)

DashLane in the streets, 1pass in the sheets.

My 1pass vault is decentralized, and also includes a robust password generator for making stuff on the fly -- something Dashlane lacks. I'm not sure I'm using either service fully, but one of them is a work freebie and the other is from back before 1pass went to a subscription model.

... the idea isn't that either are perfect, but since password sharing and phishing are a bigger attack vector than whether my phone falls into the wrong hands, using 2FA as anti-phishing insurance is still better than not.

[ Parent | on HN ]