5 ms·

Oh boy another plug for 2FA. I won't deny the obvious security advantages it confers, but that well has been poisoned a long time ago. Call me paranoid, but I

Oh boy another plug for 2FA. I won't deny the obvious security advantages it confers, but that well has been poisoned a long time ago. Call me paranoid, but I have a hard time seeing the push for 2FA as anything other than a plot to collect valuable user data. As with most any good lie, it's mostly true -- 2FA does improve security -- but what happens when a company goes bankrupt and sells off it's assets? Moreover, I can't help but to question the actual necessity of this security feature. The OP's mess could have been avoided if he'd ... you know ... systematically chosen secure passwords. >Turn on two-factor authentication. Right now. I'll pass, thanks. P.S.: thanks for Requests!

snowwolf 10y ago
> The OP's mess could have been avoided if he'd ... you know ... systematically chosen secure passwords. In this exact scenario that is true but in general, not necessarily. He could of had a very secure password on his dns provider but through some other method that account could still have been compromised (social engineering, sql injection, poor brute force rate limiting, some other attack vector). And then once the dns account is compromised a password reset on github is trivial if there isn't 2FA on the github account - or any other account linked to that email account.
- omginternets 10y ago
  I can make the same argument for 2FA: social engineering can defeat it, or I can turn to some other attack vector. This isn't to say that 2FA doesn't add security. The point is rather twofold: 1. with a little extra attention, I can secure my system without 2FA and achieve comparable security 2. it's absolutely scandalous that the proverbial well has been poisoned and we are, by virtue of the fact that extra attention is required and that most people won't put in the work, in a less secure state. Again, this is due to the irresponsible data-policy of the overwhelming majority of service providers. So again: 2FA is a valid security layer, but I'll pass. :/
  - snowwolf 10y ago
    > with a little extra attention, I can secure my system without 2FA and achieve comparable security How? Lets play devils advocate here and pretend your email is compromised (account takeover or redirect). What have you done on any of the services you use that has given you comparable security to enabling 2FA on them that now prevents the attacker from resetting your password?
    - omginternets 10y ago
      >How? By hardening your email server. Yes, assuming the email server is compromised implies a compromised system in this scenario, but that is tautological and therefore uninteresting. The extra attention should go towards hardening the weak link, in this case the email server that, de facto, provides authentication services. Server hardening is a vast topic, so I leave it as an exercise for the reader to research what can be done. Surely you don't deny that "a little extra attention" to server configuration can provide additional security without necessarily resorting to 2FA? But again, 2FA is valid security, so why not host it yourself? I have nothing against 2FA in principle, but I don't trust Google, Github, Facebook et al with my phone number. While we're on the subject, the inherent insecurity of the SMS protocol should also be weighed in any serious endorsement of phone-based 2FA: http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-...
      - snowwolf 10y ago
        So you're running your own DNS server then too right? A hardened email server doesn't prevent a targeted attacker from just redirecting your mx records (as happened to OP). > but I don't trust Google, Github, Facebook et al with my phone number Github doesn't require a phone number to use 2FA. And if you don't trust Google or Facebook with your phone number then that means you don't use either of them at all? Because otherwise holding back your phone number from them is a rather pointless exercise as they already know everything about you [1] [1] https://en.wikipedia.org/wiki/AOL_search_data_leak https://en.wikipedia.org/wiki/AOL_search_data_leak
vmateixeira 10y ago
Call me paranoid, but I have a hard time seeing the push for 2FA as anything other than a plot to collect valuable user data Exactly. Mostly when I see companies like Google, Facebook, etc constantly trying to trick me to activate it. And yes, I say trick: The option to ignore/skip is always hidden/disguised, totally ignoring the UX and accessibility needs. This and the fact that the input text fields already have my phone number populated on them ...and are just waiting for my consent.. this does not inspire trust, no.
- romaniv 10y ago
  Another interesting thing most people don't realize is that if you switch IP addresses Google demands a phone number for Gmail login, even if the account has no 2FA and no phone number was specified initially. "Give us some phone number to log in". Isn't that strange from security perspective?
- omginternets 10y ago
  Exactly: the dark-pattern design speaks to the true motivation behind this push... and it ain't security.
romaniv 10y ago
I'm beginning to think that a possible solution is to use an email account entirely different from your primary email for all website registrations. Which leads me to another idea. If websites supported separate email accounts for messaging and authentiaction/resets and kept the second account name hidden from general public it would (somewhat) help in a lot of cases. Also, I would be much more likely to do 2FA on more accounts if websites gave me the option to use printed lists of tokens instead of my phone number.
semanticist 10y ago
2FA doesn't automatically require giving any user data. Using SMS-based 2FA requires giving over your mobile phone number, but it's not like that's the only option available to you. TOTP gives the provider absolutely nothing, and has the added benefit of not being able to be compromised by a call to your mobile phone network or SIM cloning. You make this sound like it's part of a conspiracy to force 2FA on the unsuspecting masses so that the Illuminati can sell your contact details to aliens from Mars, or something. That's a bit insulting to the original poster, who is sharing useful information learned through real world experience.
- throwanem 10y ago
  > but it's not like that's the only option available to you A lot of the time, though, it really is. I always prefer TOTP over SMS, but it's rare to be given the option.
zokier 10y ago
Umm what valuable data exactly does TOTP (which for example Github uses) give the companies?

snowwolf 10y ago

> The OP's mess could have been avoided if he'd ... you know ... systematically chosen secure passwords. In this exact scenario that is true but in general, not necessarily. He could of had a very secure password on his dns provider but through some other method that account could still have been compromised (social engineering, sql injection, poor brute force rate limiting, some other attack vector). And then once the dns account is compromised a password reset on github is trivial if there isn't 2FA on the github account - or any other account linked to that email account.

omginternets 10y ago
I can make the same argument for 2FA: social engineering can defeat it, or I can turn to some other attack vector. This isn't to say that 2FA doesn't add security. The point is rather twofold: 1. with a little extra attention, I can secure my system without 2FA and achieve comparable security 2. it's absolutely scandalous that the proverbial well has been poisoned and we are, by virtue of the fact that extra attention is required and that most people won't put in the work, in a less secure state. Again, this is due to the irresponsible data-policy of the overwhelming majority of service providers. So again: 2FA is a valid security layer, but I'll pass. :/
- snowwolf 10y ago
  > with a little extra attention, I can secure my system without 2FA and achieve comparable security How? Lets play devils advocate here and pretend your email is compromised (account takeover or redirect). What have you done on any of the services you use that has given you comparable security to enabling 2FA on them that now prevents the attacker from resetting your password?
  - omginternets 10y ago
    >How? By hardening your email server. Yes, assuming the email server is compromised implies a compromised system in this scenario, but that is tautological and therefore uninteresting. The extra attention should go towards hardening the weak link, in this case the email server that, de facto, provides authentication services. Server hardening is a vast topic, so I leave it as an exercise for the reader to research what can be done. Surely you don't deny that "a little extra attention" to server configuration can provide additional security without necessarily resorting to 2FA? But again, 2FA is valid security, so why not host it yourself? I have nothing against 2FA in principle, but I don't trust Google, Github, Facebook et al with my phone number. While we're on the subject, the inherent insecurity of the SMS protocol should also be weighed in any serious endorsement of phone-based 2FA: http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-bank-transactions-322194 http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-...
    - snowwolf 10y ago
      So you're running your own DNS server then too right? A hardened email server doesn't prevent a targeted attacker from just redirecting your mx records (as happened to OP). > but I don't trust Google, Github, Facebook et al with my phone number Github doesn't require a phone number to use 2FA. And if you don't trust Google or Facebook with your phone number then that means you don't use either of them at all? Because otherwise holding back your phone number from them is a rather pointless exercise as they already know everything about you [1] [1] https://en.wikipedia.org/wiki/AOL_search_data_leak https://en.wikipedia.org/wiki/AOL_search_data_leak

vmateixeira 10y ago

Call me paranoid, but I have a hard time seeing the push for 2FA as anything other than a plot to collect valuable user data Exactly. Mostly when I see companies like Google, Facebook, etc constantly trying to trick me to activate it. And yes, I say trick: The option to ignore/skip is always hidden/disguised, totally ignoring the UX and accessibility needs. This and the fact that the input text fields already have my phone number populated on them ...and are just waiting for my consent.. this does not inspire trust, no.

romaniv 10y ago
Another interesting thing most people don't realize is that if you switch IP addresses Google demands a phone number for Gmail login, even if the account has no 2FA and no phone number was specified initially. "Give us some phone number to log in". Isn't that strange from security perspective?
omginternets 10y ago
Exactly: the dark-pattern design speaks to the true motivation behind this push... and it ain't security.

romaniv 10y ago

I'm beginning to think that a possible solution is to use an email account entirely different from your primary email for all website registrations. Which leads me to another idea. If websites supported separate email accounts for messaging and authentiaction/resets and kept the second account name hidden from general public it would (somewhat) help in a lot of cases. Also, I would be much more likely to do 2FA on more accounts if websites gave me the option to use printed lists of tokens instead of my phone number.

semanticist 10y ago

2FA doesn't automatically require giving any user data. Using SMS-based 2FA requires giving over your mobile phone number, but it's not like that's the only option available to you. TOTP gives the provider absolutely nothing, and has the added benefit of not being able to be compromised by a call to your mobile phone network or SIM cloning. You make this sound like it's part of a conspiracy to force 2FA on the unsuspecting masses so that the Illuminati can sell your contact details to aliens from Mars, or something. That's a bit insulting to the original poster, who is sharing useful information learned through real world experience.

throwanem 10y ago
> but it's not like that's the only option available to you A lot of the time, though, it really is. I always prefer TOTP over SMS, but it's rare to be given the option.

zokier 10y ago

Umm what valuable data exactly does TOTP (which for example Github uses) give the companies?