7 ms·
My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some sec
by Jarwain 10y ago
My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices.
^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used in that order (0 code on first login, 1 code on second, etc.), and the page informs the user which number they're on.
- oxguy3 10y agoOh my god that's awful, what's the point of making it so counterintuitive?? I'll never understand the motivation of companies that roll their own 2FA instead of just using TOTP or Authy.
- Jarwain 10y agoIt was probably the worst way they could have implemented 2FA; we're still vulnerable to a MITM attack. One of the more annoying things is that the codes are sent from a random 386 number. Out of the 7+ texts I've received thus far, only 2 were from the same number. Apparently the company they're using is named https://duo.com/ https://duo.com/
- nerdponx 10y agoHuh, I've heard good things about Duo. They're not a nobody at any rate.
- grivescorbett 10y agoThat's odd, we use duo at work and it's great. Every user is configured to get a push notification directly to the device which bypasses the issues with SMS.
- Jarwain 10y agoThat requires the user to use the Duo app though, right? I don't recall whether I had the option to use the app when I enabled MFA initially. However, after the fact, and as far as I can find, I cannot go back and enable the app.
- grivescorbett 10y agoThat's correct, of course without having the app installed there is no option other than SMS or a hardware token. I remember that configuring this is tricky, but I did eventually get user self enrollment configured with push being the default. Happy to dig more into my config, if you're curious: gabe@untapt.com
- Jarwain 10y agoTotally curious, unfortunately it'd probably go in one eye and out the other since I'm not involved in the Uni's implementation.
- hobarrera 10y agoWe have security experts developing 2fa techniques, and then we have these sort of people.
- Latty 10y agoI assume some misguided soul got told that they needed to reduce the number of texts sent to save costs, but that's horrible. SMS for 2fa is poor to begin with. I wish people would at least implement the standard TOTP/HOTP option as well if they are going to pull stuff like that.
- feld 10y agoThis is the most unintuitive approach to 2FA I've ever seen
- striking 10y agoThat's a pretty awful method of securing anything. Like, that would prevent me from using 2FA. Whatever happened to standards?
- Jarwain 10y agoI guess someone wanted to make a new standard (https://xkcd.com/927/ https://xkcd.com/927/)
- deleted 10y ago[deleted]
- jonoberheide 10y agoSorry to hear about your experience, Jarwain! Duo offers a choice of authentication methods, depending on the usability and security requirements of your application or organization. Duo Push is actually one of the easiest (and most secure) authentication methods, as one of the commenters pointed out: https://www.youtube.com/watch?v=tPLxe9HUDjY https://www.youtube.com/watch?v=tPLxe9HUDjY It might be worth pinging your IT/security dept to ask about enabling Duo Push as an option or to change the policy for SMS passcodes (eg. you can just have one passcode sent instead of ten). - Jon Oberheide, Co-Founder & CTO @ Duo
- Jarwain 10y agoHuh, I never would've expected to hear from the CTO just from making this post. Thanks for the reply! I'll definitely get in contact with the school's OIT to figure out alternate options for authentication
- jonoberheide 10y agoNo prob! I can't claim to be a HN veteran (/me glares at @tqbf), but if I hear people are having issues, happy to help.
- Jarwain 10y agoSo it turns out I can still use the Duo Mobile app. I have to re-add the device. Not the most intuitive but then again I figured it out on my own -shrugs-
- voidlogic 10y agoCan Duo be used to Google Authenticator or do you have to use "Duo Push"?
- Jarwain 10y agoCannot use Google Authenticator. Can't even use Duo Push; this is the SMS functioniality. I do plan on getting in contact with the schools OIT for enabling alternatives
- kibwen 10y agoMy university uses the same system as yours, and what's worse is that in order to install their custom 2FA app on Android you have to configure your phone to allow apps from unknown sources. So I have to choose between using SMS codes that can be intercepted or letting an entirely unvetted app run amok on my phone.