Protectimus TOTP tokens with time synchronization are going on sale tomorrow

http://www.releasewire.com/press-releases/the-first-totp-tokens-time-synchronization-protectimus-slim-1205627.htm

by AnnaKorobkyna • 7 years ago

11 17 7 years ago

geofft2• 7 years ago

The only disadvantage of this token to date was the possibility of time drift. This problem is inherent to all TOTP tokens, without exception. TOTP tokens contain an on-board clock. Inevitably, the clock gradually gets ahead of or falls behind the actual time. Per RFC 6238, the time difference between the token and server should be monitored by the server software.
But users often don't have access to the authentication server, so Protectimus figured out a way of correcting the token's clock instead. The time will be resynchronized when a secret key is flashed to the to the token.

Not sure I follow... the sync happens because when the user sends an attempted TOTP code to the server, the server calculates a few codes just before/after the current time, and if they match, the server updates its cache of the token's clock drift. Nothing is stored on the client. Why would this not be an option? (It requires the same access as required to send it a code in the first place, no more.)

It seems like a serious negative to have a hardware token with significant complexity on board; at that point you're better off using a smartphone which gets software updates, because you have a platform that's rich enough to have vulnerabilities and an attack surface. (And you can do things like put a password on the smartphone.) Hardware tokens with no inputs, like RSA keyfobs, make more sense.

icebraining4• 7 years ago

Not sure I follow... the sync happens because when the user sends an attempted TOTP code to the server, the server calculates a few codes just before/after the current time, and if they match, the server updates its cache of the token's clock drift. Nothing is stored on the client. Why would this not be an option? (It requires the same access as required to send it a code in the first place, no more.)

"The server" here is owned by the site where you're logging into, not by Protectimus, so you can't make it do those things. They found a way to fix the clock issue from the end they can affect.

Plus you need some input anyway, since the TOTP protocol requires a shared secret, and for some reason it became a standard that the server is the one providing it on setup.

geofft2• 7 years ago

Are there servers that don't sufficiently deal with clock drift on their own? (And TOTP devices that drift their clock by more than a few minutes a year?)

jsiepkes• 7 years ago

I there still a need to evolve TOTP now that we have FIDO2 / WebAuthn?

mjlee• 7 years ago

There are a huge number of services out there that support TOTP and show no sign of implementing WebAuthn.

Apple's business tools still only support SMS authentication.

underyx• 7 years ago

At a price tag of $30, you're better off buying a U2F hardware key such as a Solo[0], a YubiKey, or Google's Titan.

TOTP is still vulnerable to phishing attacks and MitM, while U2F machine-verifies the application ID, thus making phishing impossible (unless the phishing site tricks the user into using a non-U2F backup method for 2FA.) The downside is limited adoption, such as no support from Safari, and no support on most websites today. But I expect U2F to have a bright future ahead.

[0] https://shop.solokeys.com/

yangl1996• 7 years ago

Webkit's webauthn support is in development [0]. Hopefully the adoption will improve a lot once all major browsers support it.

[0] https://bugs.webkit.org/show_bug.cgi?id=181943

StavrosK• 7 years ago

WebAuthn can't get here soon enough. I am really really looking forward to it.

icebraining4• 7 years ago

What's the user story for mobile browsers? Other than having a key hanging off an OTG adapter, how can we secure a login made over a phone or tablet?

icebraining4• 7 years ago

OTOH, an advantage of TOTP is that it can be used without plugging in stuff, so it works on machines that don't let you access the USB ports, or that don't have them at all.

dmix• 7 years ago

Is Solo better than Yubikey in any way?

Edit: looks like solo has a USB-C + NFC option that seems to be missing from Yubikey's selection.

Edit 2: Same with Feitian which also only has USB-A for the NFC product...

yarrel• 7 years ago

Top Of The Pops?

Freak_NL2• 7 years ago

I was confused to find I landed on a page about some British pop music show when looking for a general overview of TOTP on Wikipedia.

fmajid• 7 years ago

I'm guessing Top Of The Pops, a British institution?

Try: https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...

Protectimus TOTP tokens with time synchronization are going on sale tomorrow

Related Stories