Preferred Alternative Login

[Ginix]

What is your preferred alternative login method in Fastmail?

[n5bb]

I use two Alternative Login Methods:

• Regular: If you normally log in using this type of password, your backup email address and existing passwords can't be changed. Since you don't need to change those things very often, this adds security to your account. For example, if you accidentally leave you computer logged into Fastmail where others can access it, others can't change the two most critical settings in your account.
• OTP (One Time Password set): I use this if I'm in a hotel business center or anywhere else I'm using a computer which doesn't belong to me. I print the OTP list and keep it in my wallet (using a short base password I can remember). Then when I need to use Fastmail from that untrusted computer I use an OTP password (with my memorized base password) and mark it off the list, since it can only be used once.
  • If someone is keylogging (capturing your keystrokes) as you log in, they can't use that password later because it only works once.
  • If you lose the OTP printout it can't be used by others, since they don't have the base password you memorized.
  • The only way someone could get around this system would be if they keylogged a successful login (so they knew your base password) and obtained your OTP password list.

Bill

[Ginix]

Thanks for the reply Bill

[Quincy_G]

Originally Posted by GeraldR

Bill,

Are the OTP passwords accepted only in the order they are printed?

No,
One-Time passwords
When you create a one-time password set, a page with 100 randomly generated passwords is presented for printing. You must print it before leaving the page, because it's not cached and you can't view the passwords again. You can use these passwords in any order.

[janusz]

Originally Posted by n5bb

IThe only way someone could get around this system would be if they keylogged a successful login (so they knew your base password) and obtained your OTP password list and knew which password was the next one to be used.[/list]

Originally Posted by Quincy_G

You can use these passwords in any order.

Spot a contradiction ....

[FredOnline]

FastMail Help indicates:

When you create a one-time password set, a page with 100 randomly generated passwords is presented for printing. You must print it before leaving the page, because it's not cached and you can't view the passwords again. You can use these passwords in any order.

For myself, when traveling - I always have my netbook with me, so don't need to use other computers.

However, my netbook has a restricted login to (hopefully) limit any wifi hacking, etc. from severely damaging the account.

[n5bb]

Yes, I made an error. The OTP passwords can be used in any order, but you can only use each of them only one time. I was confused because if you create an OTP list named "test"and try to log in twice with the same password from that OTP list you get this error message:

ERROR: OTP test:15 has been used, first unused is test:16

You are shown the OTP number of your attempt (1-100) and the OTP number of the next unused password starting at 1 (the lowest number which is unused). I thought this meant that you had to use them sequentially starting at 1 (which seems to be easiest). But you can use them in any order if you wish, although I can't see why you would want to do this.

My previous post has been corrected. Thanks for pointing out my error!

Bill

[zyler]

I use an alternative login with a base password plus a yubikey when I am not confident of the environment I am in.