News for hackers. Stuff that matters.

A comment on I hate password rules. Parent comment

Re:I hate password rules by OskarS on Tuesday November 16, 2021 @01:50PM (#29244778)
> or a binary that runs on my phone is a deal breaker

Phone numbers, fair enough, but TOTP is an open standard and there are plenty of open source implementations for the client side. It’s also available in most password managers (I use 1passwords implementation).

“MFA can’t require me to run a binary on my phone” is a bit extreme. TOTP is fine.

[ Parent | on HN ]
Re:I hate password rules by NoGravitas on Tuesday November 16, 2021 @01:57PM (#29244857)
MFA can't require me to run your specific app is a good guideline, though. It still leaves TOTP as fine, as long as I can choose my implementation.
[ Parent | on HN ]
Re:I hate password rules by mixmastamyk on Tuesday November 16, 2021 @04:51PM (#29246778)
FYI: https://en.wikipedia.org/wiki/Time-based_One-Time_Password
[ Parent | on HN ]
Re:I hate password rules by Spooky23 on Tuesday November 16, 2021 @07:11PM (#29247936)
TOTP doesn’t meet the security requirements of higher trust level auth. You’re demonstrating why - storing your MFA with your first factor is pretty dumb.

Where I work a bunch of people had a cow about having to put a MFA app on their phones, but refused to take a work phone. Our remedy was to issue them PINs to allow after hours access to the building.

[ Parent | on HN ]