Originally invented as a secure Bitcoin hardware wallet, created to protect money, its uses have expanded thanks to the wide applicability of asymmetric cryptography. Trezor is a small dedicated device designed to store private keys and to serve as an isolated computing environment. On the one hand, it makes you responsible for your security, but it also means that you do not need to trust any company to protect your secrets (private keys). Moreover, you can back up your secret (private key). Instead, he has to target individual users, and that is much more costly and time-consuming. E.g., you cannot back up a Yubikey.īecause with U2F, there is no secret shared and no confidential databases stored by the provider, a hacker cannot simply steal the entire databases to get access. No personal information is associated with the secret. No confidential information will ever be shared, thanks to public-key cryptography. No shared secret (private key) is sent over the internet at any time.The resulting message is sent back to the server, which can verify the identity thanks to your public key in its database. The server sends you a challenge, which is then signed by the secret (private key). By using TOTP, you have to trust the providers to be able to protect the secret. The secret can be exposed during the registration, as the provider has to give you a generated secret.This also means that the secret is most likely stored in plaintext form, on the servers of the provider. It cannot be provided as a hash or with a cryptographic salt. The secret is displayed in plaintext or QR code.If an attacker hacks into a company and gains access to both the password and the secrets database, he/she will be able to access every account completely unnoticed. You and Provider share the same secret.Backup codes are sent online, which is often insecure.If you lose your secret and log in with a reserve code, you will have to redo the entire TOTP registration process again. Also, the services often offer reserve codes instead of explicitly suggesting to save the secret. You have to take additional steps to back up the secret. You have to manually input the code at logging in, adding another step to the process.While TOTP is very simple to use, it has weaknesses and inconveniences. Both sides generate the same hash, from the same input factors, sharing a secret at registration.
0 kommentar(er)
