9:10 p.m.
I use the IOS of FreeOTP and love the app but would it be possible to add a
backup option in case the phone gets lost or stolen? That is the only thing
missing with this great app.
Thanks
9:13 p.m.
On Tue, 2015-08-18 at 21:10 -0500, Jonathan Brown wrote:
I use the IOS of FreeOTP and love the app but would it be possible to
add a backup option in case the phone gets lost or stolen? That is
the only thing missing with this great app.
The problem is that if the phone is lost or stolen you don't want to
have a backup. Rather, you want to disable the token altogether (since
it is now compromised) and create a new one.
Similarly, if you can backup the token, then someone can compromise the
backup. For instance, if you left your phone on a table someone could
quickly perform a backup and then return the phone to you. You would
have no idea the key was compromised.
Nathaniel
1:06 a.m.
You're right: In case of compromised tokens you of course have to replace them.
However not all providers provide backup methods, so it's me confident to login to an
account with the current token and create a new token. (Even that's often not
possible...)
About not noticing when another backs your tokens up: Of course you have to lock your
phone with a PIN or padlock. That's where we have no influence - the user of course
has to secure the phone. Otherwise it's not better if the phone is stolen so the
attacker can not read the tokens more but just use the phones App. So if the phone is not
secured properly you should not recommend him to use FreeOTP at all.
Of course you could add another PIN to the app but I think that's not really
necessary.
BTW I'm using they Android version - there is no backup method too.
And there is another (not such critical) scenario were backups would be useful: if you
switch to another phone, reset your phone or flash a custom ROM or something like this.
There no attacker has access, but you just want a backup for obvious reasons: to transfer
your tokens. (or to make sure that they are not completely lost if something should fail)
Subject: Re: FreeOTP Backup
From: npmccallum(a)redhat.com
To: freeotp-devel(a)lists.fedorahosted.org
Date: Tue, 18 Aug 2015 22:13:51 -0400
On Tue, 2015-08-18 at 21:10 -0500, Jonathan Brown wrote:
> I use the IOS of FreeOTP and love the app but would it be possible to
> add a backup option in case the phone gets lost or stolen? That is
> the only thing missing with this great app.
The problem is that if the phone is lost or stolen you don't want to
have a backup. Rather, you want to disable the token altogether (since
it is now compromised) and create a new one.
Similarly, if you can backup the token, then someone can compromise the
backup. For instance, if you left your phone on a table someone could
quickly perform a backup and then return the phone to you. You would
have no idea the key was compromised.
Nathaniel
_______________________________________________
freeotp-devel mailing list
freeotp-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/freeotp-devel
2:29 a.m.
Am Wed, 19 Aug 2015 08:06:11 +0200
schrieb Roland Krüger <ro.krueger(a)outlook.com>:
About not noticing when another backs your tokens up: Of course you
have to lock your phone with a PIN or padlock. That's where we have
no influence
Hm, for iOS with tokens in the keychain that might not be a big
problem. You could not backup without preestablished trust, and if you
can, you cannot recover them from backup as they are protected with a
device key. And you can selectively make the data backed up only if the
itunes backup is encrypted.
Not sure if Android offers a similiar protection. But if not, it would
at least be good to have an "exportable" flag on the secrets. And/or a
passphrase protection of the secret database.
Gruss
Bernd
3:29 a.m.
On 19/08/2015 03:13, Nathaniel McCallum wrote:
On Tue, 2015-08-18 at 21:10 -0500, Jonathan Brown wrote:
> I use the IOS of FreeOTP and love the app but would it be possible to
> add a backup option in case the phone gets lost or stolen? That is
> the only thing missing with this great app.
The problem is that if the phone is lost or stolen you don't want to
have a backup. Rather, you want to disable the token altogether (since
it is now compromised) and create a new one.
Similarly, if you can backup the token, then someone can compromise the
backup. For instance, if you left your phone on a table someone could
quickly perform a backup and then return the phone to you. You would
have no idea the key was compromised.
In case you trust your computer 100%, you can always screenshot the QR
codes. But the compromise issue is always there.
9:17 a.m.
Adding your keys to FreeOTP on a replacement or additional device can be
quite cumbersome. It would require contacting many of the services to set
up new keys, which in turn would require verifying your identity for each
of those services.
To guard against the keys being stolen, the backup could be encrypted with
a key from AGP or OpenKeychain (Android). Thus, backup and restore would
require the key - if possible, FreeOTP could be made to require that the
chosen key have a passphrase.
9:48 a.m.
It is no more cumbersome than buying a replacement yubikey. The only difference is that
phones get replaced more often. This is an inherent tension when using a mobile device for
long-term security.
----- Original Message -----
Adding your keys to FreeOTP on a replacement or additional device can
be
quite cumbersome. It would require contacting many of the services to set up
new keys, which in turn would require verifying your identity for each of
those services.
To guard against the keys being stolen, the backup could be encrypted
with a
key from AGP or OpenKeychain (Android). Thus, backup and restore would
require the key - if possible, FreeOTP could be made to require that the
chosen key have a passphrase.
_______________________________________________
freeotp-devel mailing list
freeotp-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/freeotp-devel
10:06 a.m.
I remembered the following thread from exactly a year ago. Is this still valid?
===
On Tue, 2014-08-19 at 12:55 -0400, a k'wala wrote:
How can I backup existing tokens in order to later add them (e.g., on
a different device)?
Is there a way to restore the tokens other than manually entering the
info?
On iOS, this is handled transparently by iTunes.
On Android, you can use the adb command on your computer.
Connect your phone and run:
# adb backup -f freeotp.bak org.fedorahosted.freeotp
That will store the FreeOTP data to the file freeotp.bak. To restore
this data, just run:
# adb restore freeotp.bak
Note, that during this process, Android will ask you if you wish to
encrypt your backup. Doing this is *highly* recommended. Otherwise, an
attacker could read your token data in plain text.
Nathaniel
freeotp-devel mailing list
freeotp-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/freeotp-devel
On August 19, 2015 10:48:26 AM EDT, Nathaniel McCallum <npmccallum(a)redhat.com>
wrote:
It is no more cumbersome than buying a replacement yubikey. The only
difference is that phones get replaced more often. This is an inherent
tension when using a mobile device for long-term security.
----- Original Message -----
> Adding your keys to FreeOTP on a replacement or additional device can
be
> quite cumbersome. It would require contacting many of the services to
set up
> new keys, which in turn would require verifying your identity for
each of
> those services.
> To guard against the keys being stolen, the backup could be encrypted
with a
> key from AGP or OpenKeychain (Android). Thus, backup and restore
would
> require the key - if possible, FreeOTP could be made to require that
the
> chosen key have a passphrase.
> _______________________________________________
> freeotp-devel mailing list
> freeotp-devel(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/freeotp-devel
------------------------------------------------------------------------
_______________________________________________
freeotp-devel mailing list
freeotp-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/freeotp-devel
--aslamK
Sent from my mobile device.
10:14 a.m.
It is still valid, but only for a short time. It is already gone in iOS master. It will
probably disappear in Android once we land fingerprint support.
----- Original Message -----
I remembered the following thread from exactly a year ago. Is this
still
valid?
===
On Tue, 2014-08-19 at 12:55 -0400, a k'wala wrote:
How can I backup existing tokens in order to later add them (e.g., on
a different device)?
Is there a way to restore the tokens other than manually entering the
info?
On iOS, this is handled transparently by iTunes.
On Android, you can use the adb command on your computer.
Connect your phone and run:
# adb backup -f freeotp.bak org.fedorahosted.freeotp
That will store the FreeOTP data to the file freeotp.bak. To restore
this data, just run:
# adb restore freeotp.bak
Note, that during this process, Android will ask you if you wish to
encrypt your backup. Doing this is *highly* recommended. Otherwise, an
attacker could read your token data in plain text.
Nathaniel
freeotp-devel mailing list
freeotp-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/freeotp-devel
On August 19, 2015 10:48:26 AM EDT, Nathaniel McCallum
<npmccallum(a)redhat.com> wrote:
It is no more cumbersome than buying a replacement yubikey. The only
difference is that phones get replaced more often. This is an inherent
tension when using a mobile device for long-term security.
Adding your keys to FreeOTP on a replacement or additional device can be
quite cumbersome. It would require contacting many of the services to set up
new keys, which in turn would require verifying your identity for each of
those services.
To guard against the keys being stolen, the backup could be encrypted with a
key from AGP or OpenKeychain (Android). Thus, backup and restore would
require the key - if possible, FreeOTP could be made to require that the
chosen key have a passphrase.
_______________________________________________
freeotp-devel mailing list
freeotp-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/freeotp-devel
freeotp-devel mailing list
freeotp-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/freeotp-devel
--aslamK
Sent from my mobile device.
_______________________________________________
freeotp-devel mailing list
freeotp-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/freeotp-devel
3171
days inactive
3171
days old
freeotp-devel@lists.fedorahosted.org
8 comments
6 participants
participants (6)
-
a k'wala -
Bernd Eckenfels -
Jonathan Brown -
Nathaniel McCallum -
Pedro Francisco -
Roland Krüger