4 ms·

Can "same-machine 2FA" be still called 2FA? Where is the independent second factor if it all runs on the same machine?

by vog 10y ago

scrollaway 10y ago
Factor 1 is the password, factor 2 is an ephemeral 1-time-use token. If the token's seed is secure (YMMV), it doesn't matter if it's on the same machine.
- adyus 10y ago
  How does that mitigate against the one machine being stolen? The convention is that the chances of two devices getting stolen together are smaller. That's why offsite backups are a thing.
  - scrollaway 10y ago
    It can, eg. if the seed is encrypted, but that's not what you're warding against. If the machine is stolen, one might install a custom CA or even custom web browser to MITM any https connection and just steal all your credentials, sessions and what not. When Battle.net authenticators were introduced, the primary threat was keyloggers and leaked passwords (from reuse). Both of those threats are eliminated by TOTP, wherever it is.
    - jjnoakes 10y ago
      If the machine is stolen and someone changes your software (browser, CA, whatever), that only hurts you if the machine is later returned to you and you don't wipe it. But this discussion was more about if the machine was stolen and the bad guys logged in to your online accounts from it. In that case it is true they would have your OTP, but they shouldn't have your Blizzard password.
  - jjnoakes 10y ago
    It doesn't. Passwords (on the OS account and on the Blizzard account) mitigate against the machine being stolen. OTP mitigates against the password being stolen. It is what you know and what you have so that if someone gets one they don't automatically get the other.
    - scrollaway 10y ago
      As an aside: The "What you know and what you have" paradigm is failing, imo. We often say passwords should be autogenerated, unguessable and unlearnable, stored in password safes like Keepassx. This removes "what you know" and you end up with "two things you have" (An OTP seed and a password in a safe). When both the password and the TOTP seed are on the same machine - assuming you autogenerated your password - they are both autogenerated and out of your sight so they really are just two things you have, and you have them in the same place. The difference is, it's impossible to capture the TOTP seed from the TOTP token being input - passwords are vulnerable to that. Am I crazy or does that make the password completely redundant?
      - jjnoakes 10y ago
        If you lock your password database with a long, secure password that you know, then you are still doing it "right". If your password database is not encrypted with a strong passphrase, then you are right, they both become "what you have".
        scrollaway 10y ago
        Ah, that's true.
- _nedR 10y ago
  edited: But if your machine is compromised, attacker gains access to both factors. edit: I don't know. Maybe your implementation meets the definition of 2FA. Regardless, it certainly reduces the security
- raesene6 10y ago
  A practical attack against users is malware on the machine, which would allow screen viewing and key logging An attacker can then compromise both factors at the same time. To me, this weakens the point of 2FA a lot.
  - scrollaway 10y ago
    It's pretty irrelevant nowadays anyway. People log on their google, facebook, etc accounts from their phone as well as their desktop so for a lot of user, 2fa is done on the same machine anyway - that machine just happens to be the phone. Additionally, the keylogging threat is severely reduced against most 2fa (because the login has to happen before the user sends the OTP) and can be eliminated completely by ensuring the token code is on a separate screen and creating a 30 second lock on the account while the user is entering the code.
    - raesene6 10y ago
      Mobile device security (well for IOS anyway) is waaaaaaaay better than PC security (for ordinary users), so I'd disagree on that point that app+phone is the same as browser+PC. In what world is malware which has full control of the PC stopped by having the token code on a separate monitor but the same logical system (if that's what you're talking about). An attacker with control of the PC can just get access to any app. on that PC...
      - scrollaway 10y ago
        Maybe on a $300 phone. This is fun, I have a tablet here on my desk I was given to repair a couple days ago. It's a mainstream tablet here in greece, sold for 70-90€, the sort of thing you'd buy if you are an "ordinary user" who doesn't know any better. Well it's running a 4.x android with a custom marketplace and it is FULL OF ADWARE. Seriously. There's fullscreen porn popup ads on the OS itself. There's hundreds of spam notifications, a "fake" screenlocker which captures your taps into ads, etc, etc. Seriously, this thing is like a Windows XP SP0 PC from 2005 after heavy adblockless porn usage with flash and java on. I actually haven't seen anything like that this decade. This is what you get if you buy an off-the-shelf tablet or phone here. This is what "ordinary users" get. We gave up control of our own devices in the name of security, yet shit like this can still happen. (Sorry for the OT rant. Seeing that tablet pissed me off.)
- mtgx 10y ago
  NIST does make a difference between the two, which is why it calls it "out of band authenticator."
- taeric 10y ago
  I'm confused. Both of these are just "something the user knows," right? Making this explicitly not 2-factor. Or, are we treating the ephemeral 1-time-use token as something the user has?

Can "same-machine 2FA" be still called 2FA? Where is the independent second factor if it all runs on the same machine?

by vog 10y ago

Can "same-machine 2FA" be still called 2FA? Where is the independent second factor if it all runs on the same machine?

Factor 1 is the password, factor 2 is an ephemeral 1-time-use token. If the token's seed is secure (YMMV), it doesn't matter if it's on the same machine.

adyus 10y ago
How does that mitigate against the one machine being stolen? The convention is that the chances of two devices getting stolen together are smaller. That's why offsite backups are a thing.
- scrollaway 10y ago
  It can, eg. if the seed is encrypted, but that's not what you're warding against. If the machine is stolen, one might install a custom CA or even custom web browser to MITM any https connection and just steal all your credentials, sessions and what not. When Battle.net authenticators were introduced, the primary threat was keyloggers and leaked passwords (from reuse). Both of those threats are eliminated by TOTP, wherever it is.
  - jjnoakes 10y ago
    If the machine is stolen and someone changes your software (browser, CA, whatever), that only hurts you if the machine is later returned to you and you don't wipe it. But this discussion was more about if the machine was stolen and the bad guys logged in to your online accounts from it. In that case it is true they would have your OTP, but they shouldn't have your Blizzard password.
- jjnoakes 10y ago
  It doesn't. Passwords (on the OS account and on the Blizzard account) mitigate against the machine being stolen. OTP mitigates against the password being stolen. It is what you know and what you have so that if someone gets one they don't automatically get the other.
  - scrollaway 10y ago
    As an aside: The "What you know and what you have" paradigm is failing, imo. We often say passwords should be autogenerated, unguessable and unlearnable, stored in password safes like Keepassx. This removes "what you know" and you end up with "two things you have" (An OTP seed and a password in a safe). When both the password and the TOTP seed are on the same machine - assuming you autogenerated your password - they are both autogenerated and out of your sight so they really are just two things you have, and you have them in the same place. The difference is, it's impossible to capture the TOTP seed from the TOTP token being input - passwords are vulnerable to that. Am I crazy or does that make the password completely redundant?
    - jjnoakes 10y ago
      If you lock your password database with a long, secure password that you know, then you are still doing it "right". If your password database is not encrypted with a strong passphrase, then you are right, they both become "what you have".
      - scrollaway 10y ago
        Ah, that's true.
_nedR 10y ago
edited: But if your machine is compromised, attacker gains access to both factors. edit: I don't know. Maybe your implementation meets the definition of 2FA. Regardless, it certainly reduces the security
raesene6 10y ago
A practical attack against users is malware on the machine, which would allow screen viewing and key logging An attacker can then compromise both factors at the same time. To me, this weakens the point of 2FA a lot.
- scrollaway 10y ago
  It's pretty irrelevant nowadays anyway. People log on their google, facebook, etc accounts from their phone as well as their desktop so for a lot of user, 2fa is done on the same machine anyway - that machine just happens to be the phone. Additionally, the keylogging threat is severely reduced against most 2fa (because the login has to happen before the user sends the OTP) and can be eliminated completely by ensuring the token code is on a separate screen and creating a 30 second lock on the account while the user is entering the code.
  - raesene6 10y ago
    Mobile device security (well for IOS anyway) is waaaaaaaay better than PC security (for ordinary users), so I'd disagree on that point that app+phone is the same as browser+PC. In what world is malware which has full control of the PC stopped by having the token code on a separate monitor but the same logical system (if that's what you're talking about). An attacker with control of the PC can just get access to any app. on that PC...
    - scrollaway 10y ago
      Maybe on a $300 phone. This is fun, I have a tablet here on my desk I was given to repair a couple days ago. It's a mainstream tablet here in greece, sold for 70-90€, the sort of thing you'd buy if you are an "ordinary user" who doesn't know any better. Well it's running a 4.x android with a custom marketplace and it is FULL OF ADWARE. Seriously. There's fullscreen porn popup ads on the OS itself. There's hundreds of spam notifications, a "fake" screenlocker which captures your taps into ads, etc, etc. Seriously, this thing is like a Windows XP SP0 PC from 2005 after heavy adblockless porn usage with flash and java on. I actually haven't seen anything like that this decade. This is what you get if you buy an off-the-shelf tablet or phone here. This is what "ordinary users" get. We gave up control of our own devices in the name of security, yet shit like this can still happen. (Sorry for the OT rant. Seeing that tablet pissed me off.)
mtgx 10y ago
NIST does make a difference between the two, which is why it calls it "out of band authenticator."
taeric 10y ago
I'm confused. Both of these are just "something the user knows," right? Making this explicitly not 2-factor. Or, are we treating the ephemeral 1-time-use token as something the user has?