News for hackers. Stuff that matters.

A comment on The "email is authentication" pattern. Parent comment

Re:The "email is authentication" pattern by boneitis on Saturday September 07, 2024 @07:38PM (#41477130)
A little off-topic from the matter of adoption and usability by the greater masses, but I personally prefer these RFC 6238 TOTPs that I have the choice to take into my own hands, as opposed to internet-required, server-side based like my banking app and Okta.

I have a copy of all my TOTP generators (minus my dev Okta account) in a common authenticator app and an offline copy stored in an offline password manager, further replicated with an encrypted backup service.

I was able to create my offline copy in the first place thanks to a rooted phone to export what I already had up to that point out of the authenticator app.

Of course, the discussion starts to morph when we bring in the "un-phishable" software passkeys.

[ Parent | on HN ]
Re:The "email is authentication" pattern by firesteelrain on Sunday September 08, 2024 @01:46AM (#41478427)
I thought the Authenticator apps were great until I upgraded my iPhone and the apps lost all of my Authenticator setups. Good thing it wasn’t super critical.
[ Parent | on HN ]
Re:The "email is authentication" pattern by unethical_ban on Sunday September 08, 2024 @01:45PM (#41481840)
I agree, for personal use cases, RFC standard TOTP that can be backed up and managed by the user is the ideal balance of security and availability.

Enterprise TOTP apps like Okta and MS Authenticator have some enhancements. Push notifications are convenient when you have to access things many times a day. More importantly, push notifications with a number-matching confirmation reduces the chance of TOTP poaching, since the user themselves are interacting with the service requiring auth.

In enterprise environments, there should be a restore process for a lost phone or authenticator. Some kind of backup code with voice/manager approval, or coming into a physical office to reset credentials. This isn't available for regular people/regular retail services except maybe banks, but banks can't even do regular TOTP correctly.

[ Parent | on HN ]