Terence Eden’s Blog<p><strong>FobCam '25 - All my MFA tokens on one page</strong></p><p><a href="https://shkspr.mobi/blog/2025/04/fobcam-25-all-my-mfa-tokens-on-one-page/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">shkspr.mobi/blog/2025/04/fobca</span><span class="invisible">m-25-all-my-mfa-tokens-on-one-page/</span></a></p><p>Some ideas are timeless. Back in 2004, an anonymous genius set up "<a href="https://web.archive.org/web/20060215092922/http://fob.webhop.net/" rel="nofollow noopener noreferrer" target="_blank">FobCam</a>". Tired of having to carry around an RSA SecurID token everywhere, our hero simply left the fob at home with an early webcam pointing at it. And then left the page open for all to see.</p><p></p><p>Security expert Bruce Schneier approved0 of this trade-off between security and usability - saying what we're all thinking:</p><blockquote><p>Here’s a guy who has a webcam pointing at his SecurID token, so he doesn’t have to remember to carry it around. Here’s the strange thing: unless you know who the webpage belongs to, it’s still good security. <a href="https://www.schneier.com/crypto-gram/archives/2004/0815.html#:~:text=webcam" rel="nofollow noopener noreferrer" target="_blank">Crypto-Gram - August 15, 2004</a></p></blockquote><p>Nowadays, we have to carry dozens of these tokens with us. Although, unlike the poor schmucks of 2004, we have an app for that. But I don't always have access to my phone. Sometimes I'm in a secure location where I can't access my electronics. Sometimes my phone gets stolen, and I need to log into Facebook to whinge about it. Sometimes I just can't be bothered to remember which fingerprint unlocks my phone1.</p><p>Using the <a href="https://shkspr.mobi/blog/2025/03/using-the-web-crypto-api-to-generate-totp-codes-in-javascript-without-3rd-party-libraries/" rel="nofollow noopener noreferrer" target="_blank">Web Crypto API, it is easy to Generate TOTP Codes in JavaScript directly in the browser</a>. So here are all my important MFA tokens. If I ever need to log in somewhere, I can just visit this page and grab the code I need2.</p><p><strong>All My Important Codes</strong></p><p><strong>What The Actual Fuck?</strong></p><p>A 2007 paper called <a href="https://cups.cs.cmu.edu/soups/2007/proceedings/p64_bauer.pdf" rel="nofollow noopener noreferrer" target="_blank">Lessons learned from the deployment of a smartphone-based access-control system</a> looked at whether fobs met the needs of their users:</p><blockquote><p> However, we observed that end users tend to be most concerned about how convenient [fobs] are to use. There are many examples of end users of widely used access-control technologies readily sacrificing security for convenience. For example, it is well known that users often write their passwords on post-it notes and stick them to their computer monitors. Other users are more inventive: a good example is the user who pointed a webcam at his fob and published the image online so he would not have to carry the fob around.</p></blockquote><p>As for Schneier's suggestion that anonymity added protection, a contemporary report noted that <a href="https://www.schneier.com/crypto-gram/archives/2004/0915.html#:~:text=Fobcam" rel="nofollow noopener noreferrer" target="_blank">the owner of the FobCam site was trivial to identify</a>3.</p><p>Every security system involves trade-offs. I have a password manager, but with over a thousand passwords in it, the process of navigating and maintaining becomes a burden. <a href="https://shkspr.mobi/blog/2020/08/i-have-4-2fa-coverage/" rel="nofollow noopener noreferrer" target="_blank">The number of 2FA tokens I have is also rising</a>. All of these security factors need backing up. Those back-ups need testing4. It is an endless cycle of drudgery.</p><p>What's a rational user supposed to do5? I suppose I could buy a couple of hardware keys, keep one in an off-site location, but somehow keep both in sync, and hope that a firmware-update doesn't brick them.</p><p>Should I just upload all of my passwords, tokens, secrets, recovery codes, passkeys, and biometrics6 into the cloud?</p><p>The cloud is just someone else's computer. This website is <em>my</em> computer. So I'm going to upload all my factors here. What's the worst that could happen7.</p> <ol start="0"><li><p>🫠 ↩︎</p></li><li><p>🖕 ↩︎</p></li><li><p>🙃 ↩︎</p></li><li><p>The neologism "doxing" hadn't yet been invented. ↩︎</p></li><li><p>As was written by the prophets: "<a href="https://lkml.iu.edu/hypermail/linux/kernel/9607.2/0292.html" rel="nofollow noopener noreferrer" target="_blank">Only wimps use tape backup: <em>real</em> men just upload their important stuff on ftp, and let the rest of the world mirror it</a>" ↩︎</p></li><li><p>I in no way imply that I am rational. ↩︎</p></li><li><p>Just one more factor, that'll fix security, just gotta add one more factor bro. ↩︎</p></li><li><p>This is left as an exercise for the reader. ↩︎</p></li></ol> <p><a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/2fa/" target="_blank">#2fa</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/cybersecurity/" target="_blank">#CyberSecurity</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/mfa/" target="_blank">#MFA</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/satire-probably/" target="_blank">#SatireProbably_</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/security/" target="_blank">#security</a></p>