5 ms·

Same factor. It‘s always based on the 1) something you know, 2) something you have, 3) something you are categorisation. Multiple use of a single category

Same factor. It‘s always based on the 1) something you know, 2) something you have, 3) something you are categorisation. Multiple use of a single category still counts as one factor.

jbverschoor 4y ago
By that, totp isn't a second factor either.. it's something you know. If it's something you have, that would be the same with passwords.. I don't know them..
- tzmudzin 4y ago
  Technically correct, but the short-hand naming may be misleading here. It’s the physical interaction or hardware dependency that makes the difference.
- gryn 4y ago
  something you have: mobile phone or email address (in which you'll receive the code).
  - xani_ 4y ago
    The e-mail thing is a bit silly; sure, if someone leaks your password you're safe but if your device is compromised there is good chance attacker have access to your e-mail too
- kevincox 4y ago
  It depends on how you use passwords and TOTP. I think the expectation is that busy people have a generator on their phone so it is know your password and have your phone. Of course if you are like me and keep your TOTP secret in your password manager than it is basically the same factor as a password.
- oneplane 4y ago
  TOTP is a second factor because you can't store it in your mind (and therefore it's not something you know, but something you have to have). You could defeat that using this virtual FIDO project or by storing the secret in readable format in a password manager that itself can be unlocked with your knowledge, but if we're just trying to find ways to use factors in a way that makes them useless, you can also just store them in a pastebin, it's free and all you need on any computer is to just visit your paste url!
  - pas 4y ago
    I store both passwords and 2FA in an automated software. 2FA seeds can be exported (eg. when moving to a new phone). the categorization makes some minimal sense, but basically any additional not-identical "factor" is additional security (though there's obviously a diminishing return because of the complexity-vs-security trade off).
    - tzmudzin 4y ago
      > I store both passwords and 2FA in an automated software. This effectively reduces the 2nd factor to the first, and indeed produces the diminishing return. It's sufficient to hack one system using one method and you compromise both defenses. The point behind 2nd factor is to provide a second, *independent* layer of protection that would need to be compromised using an entirely different attack. In the case of the FIDO2 dongles including the Yubikeys the secret isn't even stored on your system, but on the device itself that doesn't even disclose it to your connected system.
      - pas 4y ago
        Um, excuse my shoddy phrasing. I meant a desktop password manager and a mobile TOTP manager. Both are software, but they are not "a software", sorry. But yes, recently I have seen people use password managers that really do both in one single piece of software (a browser extension). I have a few U2F hardware devices, they are convenient when set up and plugged in, rather inconvenient otherwise :/

Same factor. It‘s always based on the 1) something you know, 2) something you have, 3) something you are categorisation. Multiple use of a single category still counts as one factor.

jbverschoor 4y ago

By that, totp isn't a second factor either.. it's something you know. If it's something you have, that would be the same with passwords.. I don't know them..

tzmudzin 4y ago
Technically correct, but the short-hand naming may be misleading here. It’s the physical interaction or hardware dependency that makes the difference.
gryn 4y ago
something you have: mobile phone or email address (in which you'll receive the code).
- xani_ 4y ago
  The e-mail thing is a bit silly; sure, if someone leaks your password you're safe but if your device is compromised there is good chance attacker have access to your e-mail too
kevincox 4y ago
It depends on how you use passwords and TOTP. I think the expectation is that busy people have a generator on their phone so it is know your password and have your phone. Of course if you are like me and keep your TOTP secret in your password manager than it is basically the same factor as a password.
oneplane 4y ago
TOTP is a second factor because you can't store it in your mind (and therefore it's not something you know, but something you have to have). You could defeat that using this virtual FIDO project or by storing the secret in readable format in a password manager that itself can be unlocked with your knowledge, but if we're just trying to find ways to use factors in a way that makes them useless, you can also just store them in a pastebin, it's free and all you need on any computer is to just visit your paste url!
- pas 4y ago
  I store both passwords and 2FA in an automated software. 2FA seeds can be exported (eg. when moving to a new phone). the categorization makes some minimal sense, but basically any additional not-identical "factor" is additional security (though there's obviously a diminishing return because of the complexity-vs-security trade off).
  - tzmudzin 4y ago
    > I store both passwords and 2FA in an automated software. This effectively reduces the 2nd factor to the first, and indeed produces the diminishing return. It's sufficient to hack one system using one method and you compromise both defenses. The point behind 2nd factor is to provide a second, *independent* layer of protection that would need to be compromised using an entirely different attack. In the case of the FIDO2 dongles including the Yubikeys the secret isn't even stored on your system, but on the device itself that doesn't even disclose it to your connected system.
    - pas 4y ago
      Um, excuse my shoddy phrasing. I meant a desktop password manager and a mobile TOTP manager. Both are software, but they are not "a software", sorry. But yes, recently I have seen people use password managers that really do both in one single piece of software (a browser extension). I have a few U2F hardware devices, they are convenient when set up and plugged in, rather inconvenient otherwise :/