5 ms·

Why not just make some sound with one and have the other pick it up?

by ikeboy 11y ago

slg 11y ago
That might be easier to intercept. If you are simply recording sound, an attacker doesn't know the exact moment that the recording is starting or ending. If the system is generating sound, the trigger is easier to pick up.
- ikeboy 11y ago
  But if you hear your phone making noise and you didn't just sign in, you can stop it (just have an "it wasn't me" button in the app).
  - slg 11y ago
    The problem is when you are in a coffee shop, someone notices you are logging in to Facebook, and now your phone broadcasts the login sound to the browser on both of your laptops. Suddenly two factor authentication is one factor again. It reduces the requirement from having physical access to your phone to having proximity to your phone.
    - ikeboy 11y ago
      But that's the same if you listen as well. Either way, they need your password and proximity.
      - slg 11y ago
        Not really because the timing is a secret. If the sound is broadcast you know "I should start attacking now". It is a trigger to tell you something important is happening. If you are simply recording, it is passive. You can't tell that someone is trying to log in at that exact moment with a sound signature starting at 2:51:05 PM and running to 2:51:08 PM.
        ikeboy 11y ago
        First of all, if two people log in at once, the system knows something's wrong. Second, how is your attack more likely to succeed from the passive attack? In yours, I know you're connecting to Facebook, I log in and use your sound. Without a broadcast sound, you're not connecting to Facebook at all, I'm just next to you. It seems to me that you'd need strictly more things to go right in the broadcast sound attack. Whatever you have then, you can use to succeed in the regular attack. Where is the narrowing of the threat model? The only thing I can think of is that the actual information of a log in is leaked, without it being exploitable because they don't have your password. This doesn't seem very useful by itself especially considering that they won't know which site you're logging into.
        slg 11y ago
        Think of it like a traditional two factor authentication except instead of the key being sent discreetly to your phone it is broadcast to everyone around you. They now all have the chance to use that broadcast code in an attempt to login before you. I don't think it's a problem for the average user in the average login scenario. However, it still doesn't mean it isn't a security concern.
        ikeboy 11y ago
        >They now all have the chance to use that broadcast code in an attempt to login before you. As I said above, by that time, it's too late, because the server should detect multiple logins and disable the code (and hopefully alert you that someone has your password).

Why not just make some sound with one and have the other pick it up?

by ikeboy 11y ago

Why not just make some sound with one and have the other pick it up?

slg 11y ago

That might be easier to intercept. If you are simply recording sound, an attacker doesn't know the exact moment that the recording is starting or ending. If the system is generating sound, the trigger is easier to pick up.

ikeboy 11y ago
But if you hear your phone making noise and you didn't just sign in, you can stop it (just have an "it wasn't me" button in the app).
- slg 11y ago
  The problem is when you are in a coffee shop, someone notices you are logging in to Facebook, and now your phone broadcasts the login sound to the browser on both of your laptops. Suddenly two factor authentication is one factor again. It reduces the requirement from having physical access to your phone to having proximity to your phone.
  - ikeboy 11y ago
    But that's the same if you listen as well. Either way, they need your password and proximity.
    - slg 11y ago
      Not really because the timing is a secret. If the sound is broadcast you know "I should start attacking now". It is a trigger to tell you something important is happening. If you are simply recording, it is passive. You can't tell that someone is trying to log in at that exact moment with a sound signature starting at 2:51:05 PM and running to 2:51:08 PM.
      - ikeboy 11y ago
        First of all, if two people log in at once, the system knows something's wrong. Second, how is your attack more likely to succeed from the passive attack? In yours, I know you're connecting to Facebook, I log in and use your sound. Without a broadcast sound, you're not connecting to Facebook at all, I'm just next to you. It seems to me that you'd need strictly more things to go right in the broadcast sound attack. Whatever you have then, you can use to succeed in the regular attack. Where is the narrowing of the threat model? The only thing I can think of is that the actual information of a log in is leaked, without it being exploitable because they don't have your password. This doesn't seem very useful by itself especially considering that they won't know which site you're logging into.
        slg 11y ago
        Think of it like a traditional two factor authentication except instead of the key being sent discreetly to your phone it is broadcast to everyone around you. They now all have the chance to use that broadcast code in an attempt to login before you. I don't think it's a problem for the average user in the average login scenario. However, it still doesn't mean it isn't a security concern.
        ikeboy 11y ago
        >They now all have the chance to use that broadcast code in an attempt to login before you. As I said above, by that time, it's too late, because the server should detect multiple logins and disable the code (and hopefully alert you that someone has your password).