Thank you for the comment! In the article I tried introducing one idea at a time, so the earlier sections unfortunately turned out to be less precise, since I was concentrating on the basics. I’ll try to improve them somehow.
About distinguishing between passwords that you do know and passwords that you don’t know: it’s a difficult topic, because they kinda flip between knowledge and possession forms based on your role: if you’re a defender, you’d probably consider it a possession (you can’t enter it without referencing something), but for an attacker it’s knowledge (no difference from a user-known password). I prefer to think from the attacker’s perspective, so it’s mostly a knowledge factor to me.
there’s no way a password manager can turn 1FA into 2FA.
This sentence seems to contradict the earlier ones about convertibility.
Why? You can convert between factor forms, but you can’t add extra ones. A password manager stores secrets behind 2FA, but the systems those secrets are from are still 1 or 2FA, regardless of the password manager usage. I should add it more explicitly to the post, indeed it’s not clear 🤔
I don’t agree that TOTP is a password you don’t know, because you can’t write it down. It’s a password you can’t know. Yes, there’s a token used to generate TOTPs, but it’s almost never presented to a user, and they can’t remember it. It’s almost impossible to turn TOTP into a knowledge-based factor, unless you put it into your online password manager with 1FA (which I’m trying to discourage). So, I’m strongly considering TOTP as a possession factor (unlike regular passwords).
Thanks again for your notes, I’ll update the post 🙏
Thank you for the comment! In the article I tried introducing one idea at a time, so the earlier sections unfortunately turned out to be less precise, since I was concentrating on the basics. I’ll try to improve them somehow.
About distinguishing between passwords that you do know and passwords that you don’t know: it’s a difficult topic, because they kinda flip between knowledge and possession forms based on your role: if you’re a defender, you’d probably consider it a possession (you can’t enter it without referencing something), but for an attacker it’s knowledge (no difference from a user-known password). I prefer to think from the attacker’s perspective, so it’s mostly a knowledge factor to me.
Why? You can convert between factor forms, but you can’t add extra ones. A password manager stores secrets behind 2FA, but the systems those secrets are from are still 1 or 2FA, regardless of the password manager usage. I should add it more explicitly to the post, indeed it’s not clear 🤔
I don’t agree that TOTP is a password you don’t know, because you can’t write it down. It’s a password you can’t know. Yes, there’s a token used to generate TOTPs, but it’s almost never presented to a user, and they can’t remember it. It’s almost impossible to turn TOTP into a knowledge-based factor, unless you put it into your online password manager with 1FA (which I’m trying to discourage). So, I’m strongly considering TOTP as a possession factor (unlike regular passwords).
Thanks again for your notes, I’ll update the post 🙏
score 1 · canonical