Two Factor Authorization

How does Lain secure her logins? >Text 2FA This seems better than nothing, but very extremely flawed given the simjacking problems. >Email 2FA Better, but if they have access to your email as well it's pointless. >Authentication App Better? Phones are spyware, so state agencies could easily just spy on the app I imagine. But for most parties, it would require physical access. >U2F/FIDO/Physical 2FA/whatever This seems like the best in class to me - however, it has the issue of being unused by most services. The most popular manufacturer is Yubico, but their products are completely proprietary as of now. Then there is Nitrokey, which is open source. They also offer higher end keys which do things like GnuPG encryption. However, they lack options for USB type C users. Finally, there is Solo, which is open source and has a USB type C option (and will apparently have one for NFC later). But they are a new company and I have not seen much discussion about them.

>Yubico, but their products are completely proprietary That's like saying your refrigerator is proprietary. The software is burned in on the key. It cannot be updated, therefore it's no different than if it were done entirely in hardware. Even Richard Stallman would be okay with a Yubikey, https://stallman.org/stallman-computing.html "As for microwave ovens and other appliances, if updating software is not a normal part of use of the device, then it is not a computer. In that case, I think the user need not take cognizance of whether the device contains a processor and software, or is built some other way."

>>7463 >Phones are spyware, so state agencies could easily just spy on the app Depends on the phone, depends on the app, depends on the state, depends on the state agency. FBI? They're not going to remotely root your phone. They'll send a warrant to whatever service they want your information from, which will promptly send it to them. NSA/GCHQ? If you're actually being targeted by them (as opposed to being caught up in their dragnet surveillance, like everyone is), 2FA or a lack thereof probably isn't going to make much of a difference for you. Security services of Bumfuckistan? They don't know what the fuarrrk 2FA is. They're just going to beat the soles of your feet with electrical cords until they get what they want. >But they are a new company and I have not seen much discussion about them. The guy behind Solo is also the guy who was behind https://github.com/conorpp/u2f-zero He has been around for a while.

Do you usually have a choice? I recently installed an authenticator app on my phone, thinking that it would be a major improvement over SMS based 2FA, only to find that I couldn't use it for anything except my google account.. Not my bank, not any of my credit cards, not my university. I pick long unique randomly generated passwords so I'm not too worried that my 2FA is mostly just done with text or email, but it's still frustrating that a fuarrrking bank of all places wouldn't have better options. Honestly I feel like 2FA as a whole is a messy and annoying way to hack around the problem of people not using good passwords. I'm not the first to say this and I certainly won't be the last, but why can't we authenticate with RSA certs? If you're using a password database already the UX isn't much different and it has huge potential to simplify every aspect of password authentication. No more worrying about cookie stealing or keyloggers or the various exploits on browser password managers. I realize that on paper the point of 2FA is to provide a "second factor" of authentication, but given how soykaf most passwords are it's effectively being used as the main defense.

>>7463 two-factor usually uses the totp standard. You can use 'oathtool' http://www.nongnu.org/oath-toolkit/man-oathtool.html on the command line, or if you use pass as a password manager, pass-otp https://github.com/tadfisher/pass-otp

>>7470 >I'm not the first to say this and I certainly won't be the last, but why can't we authenticate with RSA certs? Cause every person who doesn't use good passwords can certainly not use RSA certs in the first place. Watch the next big thing by silicon valley be the SecKey(TM) system.