8 ms·

I thought the story sounded familiar - Jered Kenna - this story's lead, claimed to have lost 800 BTC in 2013 (1) That story got him quite significant press at

by aresant 10y ago

I thought the story sounded familiar - Jered Kenna - this story's lead, claimed to have lost 800 BTC in 2013 (1) That story got him quite significant press at the time, I found thousands of deviations of the original Bloomberg story - people LOVE the "darwin award" story category. I was going to crack a joke about this being a Paul Graham submarine strategy (2) but it's just too sad and I believe him, 2FA is a mess. (1) https://www.bloomberg.com/news/articles/2013-04-10/meet-the-bitcoin-millionaires https://www.bloomberg.com/news/articles/2013-04-10/meet-the-... (2) http://paulgraham.com/submarine.html http://paulgraham.com/submarine.html

eru 10y ago
It's a shame that 2FA is often implemented via unsecure SMS. The apps are actually more secure.
- ploxiln 10y ago
  I agree, but it's worse than that, with SMS widely used for account recovery. > But 2FA via SMS is ubiquitous because of its ease of use. “Not everyone is running around with a smartphone. Some people still have dumb phones,” says Android security researcher Jon Sawyer. “If Google cut off 2FA via SMS, then everybody with a dumb phone would have no two-factor at all. So what’s worse — no two-factor or two-factor that is getting hacked?” The thing is, SMS is worse than a reasonably good password. So it's a bit annoying that Google strongly encourages me to register my phone number with my gmail account for recovery. And many services, including Google, make it difficult or impossible to enable TOTP without first registering a phone number. They really really push the SMS route. Brings up the average security level for the average person, I'm sure. Very annoying for me.
  - justinclift 10y ago
    This is interesting to me, as I live in an area with no mobile reception. So (for me) it's a real PITA when places require a mobile phone number and there's no way to skip it. Obviously, can't use those services. Does anyone know if Google Authenticator would run on a wifi iPad? As a potential workaround for the "no mobile network" situation.
    - detaro 10y ago
      It should require no connectivity at all, so yes.
      - justinclift 10y ago
        Excellent. Might need to get an up-to-date iPad now. :)
        eru 10y ago
        Why? Any phone or laptop will do. No connectivity required.
        justinclift 10y ago
        I have an original iPad. It doesn't get connected to the net. So, no way to get the app on there, and it probably wouldn't work for iOS ~5.1.1 anyway. ;) That being said, it hadn't clicked that a non mobile (eg laptop/desktop) version of it could exist. The wikipedia page for it says it's strictly mobile only[1], as does the Google install info page[2]. [1]: https://en.wikipedia.org/wiki/Google_Authenticator https://en.wikipedia.org/wiki/Google_Authenticator [2]: https://support.google.com/accounts/answer/1066447 https://support.google.com/accounts/answer/1066447 Oh well.
        detaro 10y ago
        Even the wikipedia page you linked lists alternatives for all kinds of platforms (which is no surprise, since it just implements standard algorithms)
    - joatmon-snoo 10y ago
      No connectivity is required, it's TOTP on a 30-second interval. The tl;dr: is that you have a shared secret (so if this ever gets leaked to an attacker, yes, you're vulnerable) which is used in conjunction with current time (give or take a few seconds) to generate a code you can use to confirm authentication.
  - averagewall 10y ago
    Not only dumb phones, but all regular Android users in China. They don't have the Play store app on their phones and can't sideload it because it's not a simple apk file. Even if they managed to hack that, it's blocked through the great firewall anyway. Whatever Android 2FA app an email service used would probably only be available via the Play store and thus cut off all Chinese users, and even people from China who moved to another country and brought their old phone with them.
    - ploxiln 10y ago
      You can probably sideload FreeOTP (which is what I use, although I do install it from the play store). A reasonably trustworthy APK download can be found on f-droid: https://f-droid.org/repository/browse/?fdfilter=freeotp&fdid=org.fedorahosted.freeotp https://f-droid.org/repository/browse/?fdfilter=freeotp&fdid...
    - rahimnathwani 10y ago
      There's a build of Authenticator in F-Droid, and the source is on GitHub
      - Forbo 10y ago
        FreeOTP, as well.
  - ust 10y ago
    Well, you can generate TOTP codes on your laptop, using oathtool, if someone has a "dumb" phone. One of the downsides is then you need to have your laptop always with you...

by aresant 10y ago

eru 10y ago

It's a shame that 2FA is often implemented via unsecure SMS. The apps are actually more secure.

ploxiln 10y ago
I agree, but it's worse than that, with SMS widely used for account recovery. > But 2FA via SMS is ubiquitous because of its ease of use. “Not everyone is running around with a smartphone. Some people still have dumb phones,” says Android security researcher Jon Sawyer. “If Google cut off 2FA via SMS, then everybody with a dumb phone would have no two-factor at all. So what’s worse — no two-factor or two-factor that is getting hacked?” The thing is, SMS is worse than a reasonably good password. So it's a bit annoying that Google strongly encourages me to register my phone number with my gmail account for recovery. And many services, including Google, make it difficult or impossible to enable TOTP without first registering a phone number. They really really push the SMS route. Brings up the average security level for the average person, I'm sure. Very annoying for me.
- justinclift 10y ago
  This is interesting to me, as I live in an area with no mobile reception. So (for me) it's a real PITA when places require a mobile phone number and there's no way to skip it. Obviously, can't use those services. Does anyone know if Google Authenticator would run on a wifi iPad? As a potential workaround for the "no mobile network" situation.
  - detaro 10y ago
    It should require no connectivity at all, so yes.
    - justinclift 10y ago
      Excellent. Might need to get an up-to-date iPad now. :)
      - eru 10y ago
        Why? Any phone or laptop will do. No connectivity required.
        justinclift 10y ago
        I have an original iPad. It doesn't get connected to the net. So, no way to get the app on there, and it probably wouldn't work for iOS ~5.1.1 anyway. ;) That being said, it hadn't clicked that a non mobile (eg laptop/desktop) version of it could exist. The wikipedia page for it says it's strictly mobile only[1], as does the Google install info page[2]. [1]: https://en.wikipedia.org/wiki/Google_Authenticator https://en.wikipedia.org/wiki/Google_Authenticator [2]: https://support.google.com/accounts/answer/1066447 https://support.google.com/accounts/answer/1066447 Oh well.
        detaro 10y ago
        Even the wikipedia page you linked lists alternatives for all kinds of platforms (which is no surprise, since it just implements standard algorithms)
  - joatmon-snoo 10y ago
    No connectivity is required, it's TOTP on a 30-second interval. The tl;dr: is that you have a shared secret (so if this ever gets leaked to an attacker, yes, you're vulnerable) which is used in conjunction with current time (give or take a few seconds) to generate a code you can use to confirm authentication.
- averagewall 10y ago
  Not only dumb phones, but all regular Android users in China. They don't have the Play store app on their phones and can't sideload it because it's not a simple apk file. Even if they managed to hack that, it's blocked through the great firewall anyway. Whatever Android 2FA app an email service used would probably only be available via the Play store and thus cut off all Chinese users, and even people from China who moved to another country and brought their old phone with them.
  - ploxiln 10y ago
    You can probably sideload FreeOTP (which is what I use, although I do install it from the play store). A reasonably trustworthy APK download can be found on f-droid: https://f-droid.org/repository/browse/?fdfilter=freeotp&fdid=org.fedorahosted.freeotp https://f-droid.org/repository/browse/?fdfilter=freeotp&fdid...
  - rahimnathwani 10y ago
    There's a build of Authenticator in F-Droid, and the source is on GitHub
    - Forbo 10y ago
      FreeOTP, as well.
- ust 10y ago
  Well, you can generate TOTP codes on your laptop, using oathtool, if someone has a "dumb" phone. One of the downsides is then you need to have your laptop always with you...