TOTP tokens on my wrist with the smartest dumb watch

Re:TOTP tokens on my wrist with the smartest dumb watch by vladvasiliu on Tuesday October 18, 2022 @03:58AM (#33244303)

While I agree with your points regarding the security of TOTP / SMS, and I do push for hardware keys at work, I think a case could be made for a mixed use for "regular people".

Maintaining two hardware keys is an absolute PITA, especially if you go down the route of storing one off-site, hence not having it with you to enroll when you get a new account.

What I do, is use the hardware token as the "main" factor and use the TOTP if for some reason I don't have the token (I may sometimes forget it at home when I'm at my parents' house).

The point is that, since I usually have my key, if I'm presented with a Google or whatever prompt for a TOTP, I know something's fishy. I don't normally use that, so I'll investigate why that happens and won't just go ahead and type my code in there.

[ Parent | on HN ]

Re:TOTP tokens on my wrist with the smartest dumb watch by jasonjayr on Tuesday October 18, 2022 @07:24AM (#33245666)

This needs to be repeated too. And developers need to be reminded that anything they secure with hardware keys absolutely needs to accept multiple hardware keys in order to mitigate loss or destruction of the first key.

[ Parent | on HN ]