How to use TOTP for MAXIMUM Security - Techlore
video description
Tying it to a phone number is a more valid issue but isn't really a deal-breaker nor is having to create an Authy account. It may be preferable to have other options but not the worst thing in the world particularly if you find Authy's features of value.
While I do tend to prefer open-source software philosophically, realistically from an end-user point of view it isn't that much of an advantage. Yeah, it is great that in theory thousands of sets or eyes can be looking at the code finding all the bugs, and making sure no one slips something malicious in there. In reality, this doesn't happen much. Ultimately the end-user has to trust the developer whether it is open-source or closed-source and the reputation of the software in the community. Authy overall is well respected and to my knowledge has no actual issues.
Shrugs, I'm not looking to convince anyone to use Authy - I'm thinking about moving away from it myself. I'm not even saying that the issues Techlore brings up are not something to take into consideration when selecting a TOTP authentication app, you should be aware of them and decide how important it is for you. My point is that they don't make Authy the devil's dumpster fire he makes them out to be.
Date: 2022-04-15
Related videos
Comments and reviews: 9
Techlore
We receive so many questions about 2FA, so we went all out on this guide--enjoy it! (Screw Authy)
00: 00 Section 1 - Introduction
00: 38 Section 2 - 2FA Explained
02: 01 Section 2. 1 - SMS 2FA Explained
04: 05 Section 2. 2 - Ecosystem 2FA Explained
06: 34 Section 2. 3 - TOTP Explained (Simple)
09: 42 Section 2. 4 - Hardware 2FA Explained
10: 01 Section 2. 5 - Outlier Services
10: 24 Section 2. 6 - The Best Method
10: 49 Section 3 - TOTP Explained
11: 01 Section 3. 1 - TOTP Clients
12: 07 Section 3. 2 - TOTP Seeds Explained
13: 50 Section 3. 3 - TOTP Real-World Usage
15: 13 Section 3. 4 - TOTP Backups
17: 40 Section 3. 5 - TOTP Pro-Tip & Story Time
19: 07 Section 3. 6 - Enemies of TOTP (F--- Authy)
24: 08 Section 3. 7 - Full TOTP Recap & Summary
26: 50 Section 4 - Conclusion
reply
We receive so many questions about 2FA, so we went all out on this guide--enjoy it! (Screw Authy)
00: 00 Section 1 - Introduction
00: 38 Section 2 - 2FA Explained
02: 01 Section 2. 1 - SMS 2FA Explained
04: 05 Section 2. 2 - Ecosystem 2FA Explained
06: 34 Section 2. 3 - TOTP Explained (Simple)
09: 42 Section 2. 4 - Hardware 2FA Explained
10: 01 Section 2. 5 - Outlier Services
10: 24 Section 2. 6 - The Best Method
10: 49 Section 3 - TOTP Explained
11: 01 Section 3. 1 - TOTP Clients
12: 07 Section 3. 2 - TOTP Seeds Explained
13: 50 Section 3. 3 - TOTP Real-World Usage
15: 13 Section 3. 4 - TOTP Backups
17: 40 Section 3. 5 - TOTP Pro-Tip & Story Time
19: 07 Section 3. 6 - Enemies of TOTP (F--- Authy)
24: 08 Section 3. 7 - Full TOTP Recap & Summary
26: 50 Section 4 - Conclusion
reply
James
You make logical points, but I do not consider Authy a bad tool.
Are there better options than Authy? Answer: Of course, no argument.
I consider it a learning tool.
I am often one of the defacto tech people in my circles. I will explain something. Even people who make way more than me will say this about user and data security. Most are not ignorant on a basic level. They are lazy!
In my experience most do not want to do even basic cyber security stuff. The tools opensource, free, paid, or somewhere in between. Are out there. I know because I use them. I experiment with them. I have paid for them.
When trying to get people to change their horrible habits. I have tried giving them baby steps.
You do good work. As do others in the field of cyber security.
reply
You make logical points, but I do not consider Authy a bad tool.
Are there better options than Authy? Answer: Of course, no argument.
I consider it a learning tool.
I am often one of the defacto tech people in my circles. I will explain something. Even people who make way more than me will say this about user and data security. Most are not ignorant on a basic level. They are lazy!
In my experience most do not want to do even basic cyber security stuff. The tools opensource, free, paid, or somewhere in between. Are out there. I know because I use them. I experiment with them. I have paid for them.
When trying to get people to change their horrible habits. I have tried giving them baby steps.
You do good work. As do others in the field of cyber security.
reply
Cam
Also I can't recommend Bitwarden enough.
My threat level: I am not wealthy, famous, or politically/publically/militarily relevant
Bitwarden has:
1) zero knowledge encryption
2) Cloud Syncing
3) Extensions for all browsers
4) Android, iOS, Windows, Linux, and MacOS apps
5) Built in TOTP authenticator
6) Built in password generator
7) Option to download all passwords and seeds
8) Auditing tools to check for weak, reused, and compromised passwords
9) It is open source
10) Regularly audited by 3rd parties & findings are publically accessible
It is $10 dollars a year to get premium. It is one of the only pieces of software I have bought. It really is a great product.
reply
Also I can't recommend Bitwarden enough.
My threat level: I am not wealthy, famous, or politically/publically/militarily relevant
Bitwarden has:
1) zero knowledge encryption
2) Cloud Syncing
3) Extensions for all browsers
4) Android, iOS, Windows, Linux, and MacOS apps
5) Built in TOTP authenticator
6) Built in password generator
7) Option to download all passwords and seeds
8) Auditing tools to check for weak, reused, and compromised passwords
9) It is open source
10) Regularly audited by 3rd parties & findings are publically accessible
It is $10 dollars a year to get premium. It is one of the only pieces of software I have bought. It really is a great product.
reply
Sloth
I made an account that force required authy and didn't write my seed down at the time. I thought hey. I can just go log in and get my seed after answering security like I do for other apps that offer Google Auth etc. :/. NO. I have to delete and shut down my entire account and make a new one because the service I used won't let you switch outside of authy and doesn't offer a way to know your original seed. It means this entire account is lost to me with no way in at all if something happens with authy. Customer service was non existence. Long story short. Authy sucks and so does any service that forces it on users and won't let them change to something new.
reply
I made an account that force required authy and didn't write my seed down at the time. I thought hey. I can just go log in and get my seed after answering security like I do for other apps that offer Google Auth etc. :/. NO. I have to delete and shut down my entire account and make a new one because the service I used won't let you switch outside of authy and doesn't offer a way to know your original seed. It means this entire account is lost to me with no way in at all if something happens with authy. Customer service was non existence. Long story short. Authy sucks and so does any service that forces it on users and won't let them change to something new.
reply
Nishit
Is it not possible to steal someones seeds from their authenticator apps (Like GAuth, Authy, Keepass, Bitwarden etc) that are installed on their phone, by malwares, spywares, RATs? I mean since I have these seed codes stored on my authenticator app even if its offline, its still not encrypted, event though its not easily accessible through normal UI of a simple phone there are still malwares that can obtain administrator level (ROOT level) access to an unrooted phone remotely using highly sophisticated malwares? What's your say about this?
reply
Is it not possible to steal someones seeds from their authenticator apps (Like GAuth, Authy, Keepass, Bitwarden etc) that are installed on their phone, by malwares, spywares, RATs? I mean since I have these seed codes stored on my authenticator app even if its offline, its still not encrypted, event though its not easily accessible through normal UI of a simple phone there are still malwares that can obtain administrator level (ROOT level) access to an unrooted phone remotely using highly sophisticated malwares? What's your say about this?
reply
jedikv
I will push back gently on the idea that multi device sync is not important - maybe in your life, you have plenty of people that don't switch devices (or lose them) but to the layman, that stuff happens all the time. I wish the FOSS authenticators did what bitwarden does and have multi-device sync. Usability is important if we want non-technically minded folks to use these things - that's why authy has the reputation (despite the other flaws you rightfully point out)
reply
I will push back gently on the idea that multi device sync is not important - maybe in your life, you have plenty of people that don't switch devices (or lose them) but to the layman, that stuff happens all the time. I wish the FOSS authenticators did what bitwarden does and have multi-device sync. Usability is important if we want non-technically minded folks to use these things - that's why authy has the reputation (despite the other flaws you rightfully point out)
reply
Cam
7: 32 Symantec VIP
BRUH. I use bitwarden. It has a TOTP generator included. For my threat level having everything in one place is a good usability/security compromise
Then 1 bank I use required Symantec VIP. Ruined my beautifully efficient life. I had to spend 10+ hours building/collecting the software tools I needed to turn a Symantec VIP secret into a TOTP secret; to eliminate that annoyance.
reply
7: 32 Symantec VIP
BRUH. I use bitwarden. It has a TOTP generator included. For my threat level having everything in one place is a good usability/security compromise
Then 1 bank I use required Symantec VIP. Ruined my beautifully efficient life. I had to spend 10+ hours building/collecting the software tools I needed to turn a Symantec VIP secret into a TOTP secret; to eliminate that annoyance.
reply
Satanic
-I switched to Aegis on recommendation from this vid but I've had non-stop problems where the generated code is -invalid- and its super annoying to be somewhat soft locked out of my accounts. I have no clue if its a bug, User error or if I just got unlucky but it's super frustrating. -
Edit: user error, Due to constantly living on BST and not changing the clocks lol
reply
-I switched to Aegis on recommendation from this vid but I've had non-stop problems where the generated code is -invalid- and its super annoying to be somewhat soft locked out of my accounts. I have no clue if its a bug, User error or if I just got unlucky but it's super frustrating. -
Edit: user error, Due to constantly living on BST and not changing the clocks lol
reply
Iluv
When I got the TOTP from Microsoft, I pasted it in a note, and pasted the same text file into an authenticator. A few days later, I pasted the same text string into a different authenticator, and it gives the same numbers, but not with exactly the same time. Why are they not changing at exactly the same time?
reply
When I got the TOTP from Microsoft, I pasted it in a note, and pasted the same text file into an authenticator. A few days later, I pasted the same text string into a different authenticator, and it gives the same numbers, but not with exactly the same time. Why are they not changing at exactly the same time?
reply
Add a review, comment
Other channel videos
