A passive keylogger gets the TOTP code, but only at the same moment it's used up by you successfully logging in with it. TOTP is also not supposed to be re-usable. But yes each OTP expires and that's a difference for an attacker who doesn't know the underlying secret. Yes that includes you (and of course me).Ģ-3 minutes is more realistic for real sites than 30 seconds, because there is usually a margin allowed for clock skew. If you don't put people on pedestals you've got less cleaning up to do later when they inevitably fall off. The basic threat model is that someone gets network access to your machine (but they can't get credentials from the security key, because you have to touch it to make it work) or someone sends you to a phishing website but you access it from a machine that you trust.īest not to assume anyone is infallible.

I'm excited about the use of FIDO U2F becoming more widespread, for now all I use it for is GitHub and GMail. If you somehow managed to clone the security key, services would notice that your nonces are no longer monotonically increasing and you could at least detect that it's been cloned. If you get phished, the browser would send a different domain (to the security key and authentication would fail. It also sends the nonce, which it increments. * To authenticate, the server sends a challenge, and the security key sends a response which validates that it has the private key. * For each website, e.g., GitHub, it creates a HMAC-SHA256 of the domain (and the secret key, and uses this to generate a public/private keypair. * The hardware basically consists of a secure microprocessor, a counter which it can increment, and a secret key.

There's more in a security key than just FIDO U2F, but FIDO U2F is easily the most ergonomic system that these security keys support. For those interested, I recommend reading how FIDO U2F works.

Gmail u2f