7 ms·

This is less secure. You're down from requiring Something You Have and Something You Know to just Something You Have. Meaning, anyone who has your phone and ope

This is less secure. You're down from requiring Something You Have and Something You Know to just Something You Have. Meaning, anyone who has your phone and opens your browser history can find and access your Outlook account.

mikehall314 10y ago
Clearly, moving from two-factor to single-factor is going to be less secure, but that's not really the question for me. I want to know if this more secure than user-originated passwords? User-originated passwords can be socially engineered, or just plain guessed. They can be sniffed with a key-logger, or over a non-secure connection. You can steal password databases and run them against rainbow tables, or brute-force them GPU farms. Password re-use also means that you don't have to defeat Microsoft's security to get at the password, you just need to defeat the security of the weakest vendor where that password is used. Some people will even just straight-up tell you their password if you ask them. Using an authenticator app to generate one-time passwords means there is no database of password hashes to be stolen and leaked, nothing for the user to remember, no password to re-use with weaker vendor, and nothing for an attacker to brute-force. Because the passwords are single-use, a key-logger is of limited value too. It also reduces the attack surface down from any script-kiddie who can break the security of the weakest vendor, down to people who physically have access to your phone (or can get malware on to it). Yes, anyone with access to your phone has access to your Outlook, but chances are anyone with access to your phone has that anyway, and your device is probably locked with TouchID or similar. So, I agree this is weaker than two-factor, but I don't think that's the point.
- partycoder 10y ago
  Tricking people into giving away their password (e.g: phishing) is a thing, but: - You can set a policy on password length/characters, making them hard to guess. - You can use SSL, and with free SSL certificates this is even simpler to achieve. - Defense against rainbow tables can be achieved through salted hashes, as long as the salt isn't public. While passwords are not a cure-all solution they're still a valid solution. Another way of tricking someone to give you their password: http://bash.org/?244321 http://bash.org/?244321
  - naasking 10y ago
    > - You can set a policy on password length/characters, making them hard to guess. And hard to remember, so users will write them down, lose or forget them, thus requiring costly and insecure password recovery mechanisms. It's not at all clear that passwords actually add any real security due to these issues.
    - frereubu 10y ago
      We had a panicked client ring us up one morning after their office had been broken into and computers were stolen. They'd been writing all their passwords on Post-It notes, which they then stuck to bottom of their screens.
      - naasking 10y ago
        Terrible, but also amazing.
      - kasey_junk 10y ago
        But honestly better than using the same password across all services for the last 15 years, which to my way of thinking, is the norm.
- tptacek 10y ago
  Empirically, it's more secure over the whole user population than user passwords.
  - kej 10y ago
    Do you have a source for that? (not arguing, just want to read more about this)
    - tptacek 10y ago
      No, just experience training organizations for this stuff. User passwords are extremely bad.
      - derefr 10y ago
        How do you feel about reversed 2FA flows? 1. Install a client cert/pairing token/SSH key/etc. onto each client device; 2. ask the user to configure a password, with a recommendation that that password be short and memorable rather than long and unwieldy; 3. either encrypt the device-credential with the user-password, or send the server the password to hash and store; 4. if the password challenge-response is on the server, have the server validate the device credential "before" or "outside of" accepting password-auth challenges (e.g. in the case of a client cert, validating the cert at the TLS level before the auth request can even reach the backend.) In other words, systems isomorphic to the financial chip-and-PIN system: the chip is something you have, while the PIN—something you know—is only there to prevent robbers from using the chip, rather than to provide any cryptographic security.
- Markoff 10y ago
  how is it single factor if your phone is locked? first you have to unlock it and then you must approve it in app which generates codes in background, that's two factors for me (but yeah, by this counting 2FA is for most users actually 3FA)
  - rascul 10y ago
    Only one factor is required by Microsoft. You may require multiple factors of authentication to unlock the single factor Microsoft requires, but Microsoft still requires only one.
tdb7893 10y ago
I think it's a big deal for important stuff like banks and email but for most stuff I don't mind if it's tied to a physical object. Interestingly, my house is secured by a physical object (the key) and it seems sufficient.
- joaosilva22 10y ago
  > Interestingly, my house is secured by a physical object (the key) and it seems sufficient. You could argue that knowing your house is still secured by something you have (the key) and something you know (your address).
  - mikestew 10y ago
    Your address isn't a secret, and the "something you know" part of TFA isn't supposed to be common knowledge. To stretch the metaphor, your address is your user name, not the password
  - tdb7893 10y ago
    It could be the same with a phone (username / phone). I figure between my phone having a password and (I assume) the fact that I would be able to revoke authenticator access to a device quickly I would be comfortable with the risk. I honestly hope this catches on because I would prefer it to the current system of having to manage a bunch of separate passwords (which currently are also saved on my phone)
    - Markoff 10y ago
      this is only fine if you can trust your own phone and that there is no malicious apps doing something, I don't really trust only my password, same as I don't only trust my phone, thus I prefer 2FA for really secure things as tied combination, both factors have weakness
      - tdb7893 10y ago
        That'd definitely a valid point. It's all about you want to trade off risk and convenience I guess
deleted 10y ago
[deleted]
lucasgonze 10y ago
As long as the user has set a password on the phone, there is still a Something You Know component. Mobile Outlook already has the ability to require a password on the phone.
- Markoff 10y ago
  by mobile outlook you mean policies set up by admin which can be bypassed by mail client sandboxing mailbox from rest of the phone? just don't use official client if you are not comfortable with admin of your company having full access to your personal phone, though admin can block unofficial clients...
dogma1138 10y ago
If an attacker can unlock your phone he already has access to your email. This isn't any different than using a ubikey or a password manager no one who uses really secure passwords remembers them so there isn't a component of something you know any more in any case.

mikehall314 10y ago

Clearly, moving from two-factor to single-factor is going to be less secure, but that's not really the question for me. I want to know if this more secure than user-originated passwords? User-originated passwords can be socially engineered, or just plain guessed. They can be sniffed with a key-logger, or over a non-secure connection. You can steal password databases and run them against rainbow tables, or brute-force them GPU farms. Password re-use also means that you don't have to defeat Microsoft's security to get at the password, you just need to defeat the security of the weakest vendor where that password is used. Some people will even just straight-up tell you their password if you ask them. Using an authenticator app to generate one-time passwords means there is no database of password hashes to be stolen and leaked, nothing for the user to remember, no password to re-use with weaker vendor, and nothing for an attacker to brute-force. Because the passwords are single-use, a key-logger is of limited value too. It also reduces the attack surface down from any script-kiddie who can break the security of the weakest vendor, down to people who physically have access to your phone (or can get malware on to it). Yes, anyone with access to your phone has access to your Outlook, but chances are anyone with access to your phone has that anyway, and your device is probably locked with TouchID or similar. So, I agree this is weaker than two-factor, but I don't think that's the point.

partycoder 10y ago
Tricking people into giving away their password (e.g: phishing) is a thing, but: - You can set a policy on password length/characters, making them hard to guess. - You can use SSL, and with free SSL certificates this is even simpler to achieve. - Defense against rainbow tables can be achieved through salted hashes, as long as the salt isn't public. While passwords are not a cure-all solution they're still a valid solution. Another way of tricking someone to give you their password: http://bash.org/?244321 http://bash.org/?244321
- naasking 10y ago
  > - You can set a policy on password length/characters, making them hard to guess. And hard to remember, so users will write them down, lose or forget them, thus requiring costly and insecure password recovery mechanisms. It's not at all clear that passwords actually add any real security due to these issues.
  - frereubu 10y ago
    We had a panicked client ring us up one morning after their office had been broken into and computers were stolen. They'd been writing all their passwords on Post-It notes, which they then stuck to bottom of their screens.
    - naasking 10y ago
      Terrible, but also amazing.
    - kasey_junk 10y ago
      But honestly better than using the same password across all services for the last 15 years, which to my way of thinking, is the norm.
tptacek 10y ago
Empirically, it's more secure over the whole user population than user passwords.
- kej 10y ago
  Do you have a source for that? (not arguing, just want to read more about this)
  - tptacek 10y ago
    No, just experience training organizations for this stuff. User passwords are extremely bad.
    - derefr 10y ago
      How do you feel about reversed 2FA flows? 1. Install a client cert/pairing token/SSH key/etc. onto each client device; 2. ask the user to configure a password, with a recommendation that that password be short and memorable rather than long and unwieldy; 3. either encrypt the device-credential with the user-password, or send the server the password to hash and store; 4. if the password challenge-response is on the server, have the server validate the device credential "before" or "outside of" accepting password-auth challenges (e.g. in the case of a client cert, validating the cert at the TLS level before the auth request can even reach the backend.) In other words, systems isomorphic to the financial chip-and-PIN system: the chip is something you have, while the PIN—something you know—is only there to prevent robbers from using the chip, rather than to provide any cryptographic security.
Markoff 10y ago
how is it single factor if your phone is locked? first you have to unlock it and then you must approve it in app which generates codes in background, that's two factors for me (but yeah, by this counting 2FA is for most users actually 3FA)
- rascul 10y ago
  Only one factor is required by Microsoft. You may require multiple factors of authentication to unlock the single factor Microsoft requires, but Microsoft still requires only one.

tdb7893 10y ago

I think it's a big deal for important stuff like banks and email but for most stuff I don't mind if it's tied to a physical object. Interestingly, my house is secured by a physical object (the key) and it seems sufficient.

joaosilva22 10y ago
> Interestingly, my house is secured by a physical object (the key) and it seems sufficient. You could argue that knowing your house is still secured by something you have (the key) and something you know (your address).
- mikestew 10y ago
  Your address isn't a secret, and the "something you know" part of TFA isn't supposed to be common knowledge. To stretch the metaphor, your address is your user name, not the password
- tdb7893 10y ago
  It could be the same with a phone (username / phone). I figure between my phone having a password and (I assume) the fact that I would be able to revoke authenticator access to a device quickly I would be comfortable with the risk. I honestly hope this catches on because I would prefer it to the current system of having to manage a bunch of separate passwords (which currently are also saved on my phone)
  - Markoff 10y ago
    this is only fine if you can trust your own phone and that there is no malicious apps doing something, I don't really trust only my password, same as I don't only trust my phone, thus I prefer 2FA for really secure things as tied combination, both factors have weakness
    - tdb7893 10y ago
      That'd definitely a valid point. It's all about you want to trade off risk and convenience I guess

deleted 10y ago

[deleted]

lucasgonze 10y ago

As long as the user has set a password on the phone, there is still a Something You Know component. Mobile Outlook already has the ability to require a password on the phone.

Markoff 10y ago
by mobile outlook you mean policies set up by admin which can be bypassed by mail client sandboxing mailbox from rest of the phone? just don't use official client if you are not comfortable with admin of your company having full access to your personal phone, though admin can block unofficial clients...

dogma1138 10y ago

If an attacker can unlock your phone he already has access to your email. This isn't any different than using a ubikey or a password manager no one who uses really secure passwords remembers them so there isn't a component of something you know any more in any case.