5 ms·

2FA doesn't protect you against cookie/token stealing. The website owners need to invalidate all of that on their ends.

by xuki 10y ago

user5994461 10y ago
It does and you don't even need real 2FA for it. Any non-trivial auth token comes with device or host fingerprinting. That's enough to stop this attack scenario in most cases.
- Programmatic 10y ago
  As someone unfamiliar with this, can you please elaborate? Would the host be fingerprinted on every subsequent usage of the authentication token, and using what methods?
  - sah2ed 10y ago
    Not the parent but I posted a plausible explanation to your question here: https://news.ycombinator.com/item?id=13731656 https://news.ycombinator.com/item?id=13731656
  - user5994461 10y ago
    On a basic level, you can include a IP or a country inside your authentication tokens. That's enough to block some unwanted access. On a more advanced level, there is a two step process, you authenticate as usual with your password and get a token, then the site will authenticate your device. The device fingerprinting is totally transparent, it saves and checks some characteristics from your computer, and ensure you come from the same device next time. For instance, on Facebook you can see a list of known device somewhere. When you connect on a new computer it sends you an email "connected from a new computer is that you?".
- sah2ed 10y ago
  Usually only the big tech companies and well-funded startups can afford to use device fingerprinting in addition with auth tokens. This essentially involves keeping track of the last time you logged in, your IP address, your device characteristics then notifying if there is an unusual change in any of those metrics. For instance, although I have never been to China, I once got a notification from Facebook that someone attempted a password reset on my account from China. This was shortly after the publication of LinkedIn's stolen database of users which affected millions of users including my account.

2FA doesn't protect you against cookie/token stealing. The website owners need to invalidate all of that on their ends.

by xuki 10y ago

2FA doesn't protect you against cookie/token stealing. The website owners need to invalidate all of that on their ends.

It does and you don't even need real 2FA for it. Any non-trivial auth token comes with device or host fingerprinting. That's enough to stop this attack scenario in most cases.

Programmatic 10y ago
As someone unfamiliar with this, can you please elaborate? Would the host be fingerprinted on every subsequent usage of the authentication token, and using what methods?
- sah2ed 10y ago
  Not the parent but I posted a plausible explanation to your question here: https://news.ycombinator.com/item?id=13731656 https://news.ycombinator.com/item?id=13731656
- user5994461 10y ago
  On a basic level, you can include a IP or a country inside your authentication tokens. That's enough to block some unwanted access. On a more advanced level, there is a two step process, you authenticate as usual with your password and get a token, then the site will authenticate your device. The device fingerprinting is totally transparent, it saves and checks some characteristics from your computer, and ensure you come from the same device next time. For instance, on Facebook you can see a list of known device somewhere. When you connect on a new computer it sends you an email "connected from a new computer is that you?".
sah2ed 10y ago
Usually only the big tech companies and well-funded startups can afford to use device fingerprinting in addition with auth tokens. This essentially involves keeping track of the last time you logged in, your IP address, your device characteristics then notifying if there is an unusual change in any of those metrics. For instance, although I have never been to China, I once got a notification from Facebook that someone attempted a password reset on my account from China. This was shortly after the publication of LinkedIn's stolen database of users which affected millions of users including my account.