I read the federal government’s Zero-Trust Memo so you don’t have to

Re:I read the federal government’s Zero-Trust Memo so you do... by unethical_ban on Thursday January 27, 2022 @04:06PM (#30106682)

TOTP is not going anywhere for much of the Internet. Hold on while I get a Yuibikey to my dad who thinks "folders can't be in other folders" because that's not how they work in real life.

TOTP is a great security enhancement, and while phishable, considerably raises the bar for an attacker.

The fact that TOTP is mentioned as a bad practice in this document is an indicator that this should not be considered a general best practices guide. It is a valid best practice guide for a particular use case and particular user base.

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by tptacek on Thursday January 27, 2022 @04:19PM (#30106859)

Yubikeys aren't the serious long-term alternative to TOTP; software keys embedded in phones are what we're going to end up with.

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by takumif on Friday January 28, 2022 @01:04PM (#30118196)

I have a newbie question: Can't we embed a hardware key into a phone, and that'd be just as good as a Yubikey? Do we already do this, or is there a reason why we don't?

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by totony on Friday January 28, 2022 @11:22PM (#30123769)

Laptops can have smart cards so there's no reason a phone couldn't

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by zie on Thursday January 27, 2022 @06:41PM (#30108684)

I want to disagree, but I can't, because you are right. Though perhaps as wearable tech grows(watches and what not), perhaps the keys will exist there also.

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by konklone on Thursday January 27, 2022 @10:42PM (#30110488)

The document distinguishes between enterprise-facing and public-facing systems. For enterprise-facing (government employees, contractors, etc.), it's talking about discontinuing use of TOTP. For public-facing systems, it doesn't impose any restrictions, since (as you're saying) the general public really needs options.

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by adgjlsfhk1 on Thursday January 27, 2022 @04:15PM (#30106810)

the advantage of fido2/webauthn is actually biggest for non techies. tech people are the ones who won't fall for take bad phishing attempts. stopping malicious logins from fake sites is a massive win.

[ Parent | on HN ]