However, I think your average criminal may not have the array of resources that the FBI has…

lol I hope they do not

And you cannot try indefinitely to find out the passcode.

That’s very true. However, as we saw with the San Bernadino shooting, the FBI did in fact manage to hack that device
https://www.theverge.com/2021/4/14/22383957/fbi-san-bernadino-iphone-hack-shooting-investigation

However, I think your average criminal may not have the array of resources that the FBI has…

For most people, I believe this device will be their phone. And I believe phones are quite secure since they will need a passcode to be opened anyway. And you cannot try indefinitely to find out the passcode.

Admittedly, you could easily prevent access by disabling that specific device, but the window of opportunity would still exist for a short period of time, and that may be long enough for any nefarious actor to compromise your accounts.

No technology is going to be absolutely perfect, and we have to accept that. However, I do think it’s going to be a while before this new method of authentication becomes mainstream.

https://www.theverge.com/2023/5/3/23709318/google-accounts-passkey-support-password-2fa-fido-security-phishing

https://community.nodebb.org/post/92962

@crazycells I suppose the only issue which immediately springs to mind here is that if the password manager becomes compromised - for example, if your master password is inadvertently leaked, then an attacker has both the password, and the TOTP code.

This might not sit well with the more paranoid users, but be perfectly acceptable and convenient for the less discerning ones.

Food for thought.

yeah, but thanks to 1password, I am ok with this.
they have a secondary level of encryption. so even if you got my master password, it is useless without a device that I have registered. It is not enough to decrypt my account, even online. You have to enter a “secret code” to add your device to the account so that you can decrypt your passwords on that device, and this secret code is given during registration only.

This might not sit well with the more paranoid users, but be perfectly acceptable and convenient for the less discerning ones.

Food for thought.

@crazycells good call with the password manager. I use Bitwarden myself for personal and family usage, and Dashlane for work. I’ve been experimenting with Bitwarden and it’s 2fa capabilities and I have to admit it’s impressive - so much so that I’m considering using this as a drop in replacement for Authy which I’ve been using for years.

Yeah, I, too, prefer password managers filling 2FAs rather than me checking from an app on the phone. That is why I ditched Authy for this very reason

I agree with you on users being the weakest link in the system… Let’s see how well or how fast this system will be adapted… I hope they can come up with a secure way that is not annoying…

I actually started using the “1password” password manager quite some time ago for this purpose, and I have to tell you that my life got so much easier. I also turn on 2FA if the website offers one in the app, and I do not remember or know any of the passwords I have I only know 1 password that will unlock the 1password app and that is enough to fill the login page details… I usually pick a long alphanumeric password with some special characters in it, so it is hard to guess.

Additionally, after my critical email addresses got exposed in several website hackings last year, I also started using “simplelogin.io” with a custom domain so that I could create unique email addresses for each website. I have been using this for the last 8 months or so, and happy so far…

With this method, each website has a unique email address and also unique password. At least if I am hacked on website X, my info on website Y is still safe…

Ever heard of users being the weakest link ? In most cases, this is absolutely true. For example, you could have the highest grade security on offer, but once you put that electronic fortress into inexperienced hands, it may as well not be there at all. It’s long been considered that the “human firewall” is relatively simple to bypass, and it’s sadly a fact. Humans are susceptible to coercion - easily convinced that even something that looks too good to be true (and often is) is genuine - a “one time” opportunity too good to miss.

Then there’s the social engineering side of things. It really doesn’t matter how strong your security is, the user in control of it can easily open the door to all sorts of unwanted activity, and allow sensitive information to simply walk out of the door at the same time.

Will biometric security replacing passwords resolve this issue ? No - it’ll be exactly the same, just with a modern approach. What’s needed here is awareness - a constant reminder of what can easily happen if you lower your guard. We make the same mistake constantly by requiring users to change their passwords every x days - all that has achieved is to lower entropy and in fact weaken security in the process. This is something I’ve written about before

https://sudonix.com/topic/135/changing-passwords-regularly-actually-weakens-security

Users have a nasty habit of choosing weak passwords that they as humans can remember, and by definition, make that same password vulnerable to a dictionary attack or other simple mechanism - even brute force or sieve attacks - by adding a sequential number to satisfy the change, but to keep the password memorable.

Admittedly, biometric security can stop that in it’s tracks and increasingly enhance the user experience, but it’s not a silver bullet - and should never be regarded as one.

For all the time users remain unaware of the risk (or are ignorant to it), then no amount of security enhancements - even biometric - are not enough to increase security.