![]() ![]() ![]() For the most part at first the reference to this “something you have” related to physical devices, such as the RSA SecurID and other “tamper proof” tokens that display a one-time code, either changing every given amount of seconds or changing every time you pressed a button. Your username would be effectively the zeroth factor, followed by your password as first factor, and the magical second factor. But before we get to that question, let me explain something that, it turns out, is not obvious to many people.Ģ-factor authentication, also referred to 2-step verification, – which refer to slightly different semantics but I’m not here splitting hairs – is the idea that you need “something you have” (or “something you have access to”) as well as “something you know”. The obvious question that came to me, and probably to anyone with a little bit of security knowledge, when this was announced is «who in their sane mind would use this?». I have honestly wondered why Google Authenticator still does not have a similar feature either, but let’s not go there for now. Authy (which many may know as the authentication system for Humble Bundle or Twilio) has a similar feature for their app. It’s marketed as a solution to the TOTP dance of changing devices which is always a definite pain in the neck, and it’s not alone. But as it happens here is something more.Ī couple of months ago, LastPass announced Cloud Backup for LastPass Authenticator, which effectively means you can upload your TOTP shared key (which is used for the generation of the one-time codes you see in the authenticator app) to LastPass so that you can log in on a different device (phone) and have access to all your previously set up 2FA credentials. I’m still not sure how it is that over the past two years I consider myself a big expert of 2FA, it probably has to do with having wanted to implement this for a very long time for the work I did before my current employer, and the fact that things keeps changing, and bad advices keep being sent out.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |