undefined | Better HN

0 pointsDarthNebo3y ago0 comments

2FA should be TOTP not SMS

0 comments

5 comments · 2 top-level

unethical_ban3y ago· 2 in thread

My work-based 2FA is tied to my phone and is non-transferrable. If I lost my main phone without switching the 2FA install while logged in, I'd have to go through a recovery process.

Culprits: RSA Authenticate and Okta Verify.

My personal accounts that have 2FA are all backed up with Authy.

nobody99993y ago

>My work-based 2FA is tied to my phone and is non-transferrable.

If that's the case with your workplace, do they issue you a phone to use for work-related stuff.

If not, why not?

Your personal device shouldn't be required to do work-related stuff, IMHO.

I'd add that since there's work-related stuff on your phone, your employer can restrict what you do/don't do with that phone and subject your personal device to its corporate policies via Mobile Device Management (MDM)[0] systems.

Even more, if you ensure that work-related stuff isn't on your personal device, issues with either device won't impact the other one.

I realize that it's out of fashion these days to keep one's work and personal lives separate. But IME, doing so is generally a good idea.

[0] https://en.wikipedia.org/wiki/Mobile_device_management

unethical_ban3y ago

I don't have MDM on my phone (no alt-roots or anything). "Just" the 2FA, gmail and Slack. But I agree, I'm tempted to get the work stuff off and onto an old phone just to have the mental separation.

1 more reply

josefresco3y ago· 1 in thread

95% of my 2FA accounts are TOTP. My issue is that not all providers give me printable backup codes - some just say "get two devices!" and that's just not reasonable for a variety of reasons.

disago3y ago

To get around this I usually just store the secret (from the QR code) in a secure place (encrypted database with yubikey).

This always allows me to recreate the TOTP entry.

j / k navigate · click thread line to collapse