undefined | Better HN

0 pointsthaumasiotes7y ago0 comments

A 60-second TOTP code is a fully deterministic function of a permanent, unchangeable secret. That's why you and the server can agree on what the code should be without needing to communicate beyond setting up the code originally.

This makes it identical to a password from a theoretical perspective. There's really no difference between a TOTP secret that you keep in a TOTP app and haven't memorized, and a password you keep in your password manager and also haven't memorized. Both are "something you know", and nothing else.

You're correct that leaking a temporary code from a single login attempt doesn't compromise the TOTP secret. That is an artifact of the login process, not of whether the mechanism is labeled "2FA" or "password". You can do the same thing while calling the secret a password: https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

0 comments

theamk7y ago

I disagree, I believe TOTP belongs firmly in the "something you have" category. You cannot memorize TOTP password, nor you can store in your password manager. You also cannot pass that knowledge to another person. So this is more like a public key than a password.

Ultimately, everything is "permanent, unchangeable secret", including private key and biometric data. Where the data is stored and how is it accessed makes all the difference.

I could not find the original definition of "something you have", but modern standards like PCI actually give OTP auth as an example of "something you have" (p. 4 of [1])

(I am not looking at the degenerate case of running TOTP app on the same device / same security domain -- it does not describe most cases, and there are some fairly straightforward technical measures to defeat this)

[1] https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authe...

thaumasiotesOP7y ago

> You cannot memorize TOTP password, nor you can store in your password manager. You also cannot pass that knowledge to another person.

But none of these things are true. For example, my most recent job involved sharing a 2FA-protected online account. We all had the code.

theamk7y ago

Sorry, "none of these things are true" in your environment. They are certainly true for other people, in fact, I bet they are true for majority of them.

I think analogy to physical house keys is very helpful. What did your work do?

Did you show the enrollment QR code, and multiple people scanned it --> this is like duplicating house key.

Did you put the key into password manager -> this is like that combination lockbox that releases house key if you enter the right combination.

People do all sorts of unusual things, this does not change the properties of intended usage.

thaumasiotesOP7y ago

> They are certainly true for other people, in fact, I bet they are true for majority of them.

Well, no. Everyone who uses TOTP, without exception, has their secret stored in a password manager. That's what the TOTP app or device is.

1 more reply

michaelmior7y ago

> nor you can store in your password manager

Some 2FA apps also allow you to back up your codes to a cloud service.

theamk7y ago

Yes, but I put it into category of "unsafe things that defeat the point of mechanism"

For example, you can put your spare house key under doormat. This effectively makes a lock on your house door require "something you know" (you need to know where the key is stored).

However, that does not mean that we can say that all keys are "something you know". The fact that many people decided to compromise their security does not reflect on other intended use of locks and keys.

michaelmior7y ago

Agreed. But I think it goes to show how blurry the line is between "know" and "have."

j / k navigate · click thread line to collapse

0 comments

theamk7y ago

Ultimately, everything is "permanent, unchangeable secret", including private key and biometric data. Where the data is stored and how is it accessed makes all the difference.

I could not find the original definition of "something you have", but modern standards like PCI actually give OTP auth as an example of "something you have" (p. 4 of [1])

[1] https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authe...

thaumasiotesOP7y ago

> You cannot memorize TOTP password, nor you can store in your password manager. You also cannot pass that knowledge to another person.

But none of these things are true. For example, my most recent job involved sharing a 2FA-protected online account. We all had the code.

theamk7y ago

Sorry, "none of these things are true" in your environment. They are certainly true for other people, in fact, I bet they are true for majority of them.

I think analogy to physical house keys is very helpful. What did your work do?

Did you show the enrollment QR code, and multiple people scanned it --> this is like duplicating house key.

Did you put the key into password manager -> this is like that combination lockbox that releases house key if you enter the right combination.

People do all sorts of unusual things, this does not change the properties of intended usage.

thaumasiotesOP7y ago

> They are certainly true for other people, in fact, I bet they are true for majority of them.

Well, no. Everyone who uses TOTP, without exception, has their secret stored in a password manager. That's what the TOTP app or device is.

1 more reply

michaelmior7y ago

> nor you can store in your password manager

Some 2FA apps also allow you to back up your codes to a cloud service.

theamk7y ago

Yes, but I put it into category of "unsafe things that defeat the point of mechanism"

For example, you can put your spare house key under doormat. This effectively makes a lock on your house door require "something you know" (you need to know where the key is stored).

michaelmior7y ago

Agreed. But I think it goes to show how blurry the line is between "know" and "have."

j / k navigate · click thread line to collapse