3 ms·
I've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook. I work in computer security, so I know this sounds crazy. But my
by forgottenpass 10y ago
I've been a big fan of yubikeys for years, but I'd never use mine for something like Facebook.
I work in computer security, so I know this sounds crazy. But my brain has been rewired to work in failure modes by the not-security domain I happen to do security stuff in.
The obvious argument for TFA is to reduce the chances that my Facebook account is subject to the bad consequences of that come from a compromised Facebook account.
I'd much rather they reduce or eliminate the severity of the failure mode in the first place. TFA is only a mitigation that reduces the likelihood of account compromise. It shouldn't be possible for someone who swipes my yubikey to do any more than cause a minor social annoyance.
Unfortunately the presence of the mitigation (TFA) will - if adopted to significant numbers - combine with Facebook's other incentives to produce more severe failure effects for account compromise.
Remember back when facebook was still in it's just-college phase? And dicking around on your friend's facebook account if they left their computer unlocked was normal? And when you saw someone acting unusual, you sorta assumed someone was messing with their account? Yeah, I don't want a compromise of my facebook account to ever be more severe than it was back then.
- CaveTech 10y agoI don't think I follow your reasoning of how increased security increases the severity of a compromise. Can you elaborate on that?
- nothrabannosir 10y agoIt lowers the barrier to adopting "login with facebook" on other platforms. "You get 2fa for free!"
- OJFord 10y agoIf my network knows that I use PGP to login, they may well accept an (illegitimate) announcement that I'm changing my keys to {attacker-generated.asc}. Of course, really such a login key should only be able to authenticate, and my network should only accept a proper revocation certificate that would need to have been generated by a different key with the 'Certify' action enabled. How likely or damaging that is obviously depends a lot on who you are, and probably wouldn't be for many people at all. But I assume that's the sort of thing your parent commenter is alluding to.
- corey_moncure 10y agoWhy would your network accept that announcement if it wasn't signed with your signing key?
- forgottenpass 10y agoIt doesn't increase severity in and of itself, it just changes the nature of the system. And people will adapt their decision making processes to the new properties of that system. Facebook would feel more comfortable expanding their scope of features in a way that increases severity. -- For example, my primary objection to using my facebook account to log into unrelated websites isn't about privacy, it's that I think I can manage unique credentials for each one better than adding facebook as a shared point of failure and risking a cascade if my facebook account gets compromised. Contacts would assume a higher degree of authenticity to actions done with my account. It only sets the stage for the change, it doesn't implement it. I know the tech bubble likes to pretend speculation around obvious system effects is 100% unfounded if it might lead to even-the-slightest-bit-unflattering conclusions. But I don't play that game.
- tptacek 10y agoHas someone else read this and understood the argument? Because I don't follow it.
- forgottenpass 10y agohttps://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis https://en.wikipedia.org/wiki/Failure_mode_and_effects_analy... You don't have to mitigate failures modes that don't matter. When you have existing mitigation in place, you can add more failure modes/effects "for free."
- tptacek 10y agoI don't understand, and I'm really trying. What's the additional failure mode --- one I don't already have --- that might get added because of the moral hazard of me having a U2F token?
- forgottenpass 10y agoI'm not saying they come as a package. My original post was only about Facebook's future product decisions after a hypothetical point where they get a large enough portion of their userbase to use 2FA. Edit: I don't want my facebook account to become the _kind_ of thing I'd want to protect with 2FA = I won't use 2FA for facebook.
- j_s 10y agoI agree. It seems as though the same thing could be said for having any password at all on a Facebook account?
- DashRattlesnake 10y agoI think he was saying something along the lines of: If you increase the strength of the authentication on an account, then you increase the expectation (in others) that anyone authenticated to the account was authenticated legitimately. So, for example, if you have weak authentication and illegitimate access is common, then others are accustomed to distrusting the service and will react accordingly (for instance, by discounting weird behavior as the result of a hack). However, if you have strong authentication (via 2FA) and illegitimate access is uncommon, then people are accustomed to trusting the service, so they will be less likely to correctly discount and distrust weird things posted by illegitimate actors. Basically, I think he was saying that for something low-value like Facebook, 2FA is a bad bargain because it trades a stronger social mitigation for a weaker technical one.
- arnarbi 10y agoLet me see if I understand your points: 1. You ensure your FB account isn't valuable, in order to decrease the bad effects of it being hijacked. 2. You argue that hardening against hijacking means eventually the stakes of hijacks get higher, and therefore we shouldn't be hardening. Is that correct understanding? If so, that's short-sighted at best. Many accounts are extremely valuable. It can be in terms of actual money, career, influence, politics, etc. For some people it is the primary vehicle for their livelihood. Same goes for many other online services, that open possibilities for people to earn a living, partake in politics/governance, and maintain social relations that they otherwise could not.