4 ms·

Clearly, moving from two-factor to single-factor is going to be less secure, but that's not really the question for me. I want to know if this more secure than

Clearly, moving from two-factor to single-factor is going to be less secure, but that's not really the question for me. I want to know if this more secure than user-originated passwords? User-originated passwords can be socially engineered, or just plain guessed. They can be sniffed with a key-logger, or over a non-secure connection. You can steal password databases and run them against rainbow tables, or brute-force them GPU farms. Password re-use also means that you don't have to defeat Microsoft's security to get at the password, you just need to defeat the security of the weakest vendor where that password is used. Some people will even just straight-up tell you their password if you ask them. Using an authenticator app to generate one-time passwords means there is no database of password hashes to be stolen and leaked, nothing for the user to remember, no password to re-use with weaker vendor, and nothing for an attacker to brute-force. Because the passwords are single-use, a key-logger is of limited value too. It also reduces the attack surface down from any script-kiddie who can break the security of the weakest vendor, down to people who physically have access to your phone (or can get malware on to it). Yes, anyone with access to your phone has access to your Outlook, but chances are anyone with access to your phone has that anyway, and your device is probably locked with TouchID or similar. So, I agree this is weaker than two-factor, but I don't think that's the point.

partycoder 9y ago
Tricking people into giving away their password (e.g: phishing) is a thing, but: - You can set a policy on password length/characters, making them hard to guess. - You can use SSL, and with free SSL certificates this is even simpler to achieve. - Defense against rainbow tables can be achieved through salted hashes, as long as the salt isn't public. While passwords are not a cure-all solution they're still a valid solution. Another way of tricking someone to give you their password: http://bash.org/?244321 http://bash.org/?244321
- naasking 9y ago
  > - You can set a policy on password length/characters, making them hard to guess. And hard to remember, so users will write them down, lose or forget them, thus requiring costly and insecure password recovery mechanisms. It's not at all clear that passwords actually add any real security due to these issues.
  - frereubu 9y ago
    We had a panicked client ring us up one morning after their office had been broken into and computers were stolen. They'd been writing all their passwords on Post-It notes, which they then stuck to bottom of their screens.
    - naasking 9y ago
      Terrible, but also amazing.
    - kasey_junk 9y ago
      But honestly better than using the same password across all services for the last 15 years, which to my way of thinking, is the norm.
tptacek 9y ago
Empirically, it's more secure over the whole user population than user passwords.
- kej 9y ago
  Do you have a source for that? (not arguing, just want to read more about this)
  - tptacek 9y ago
    No, just experience training organizations for this stuff. User passwords are extremely bad.
    - derefr 9y ago
      How do you feel about reversed 2FA flows? 1. Install a client cert/pairing token/SSH key/etc. onto each client device; 2. ask the user to configure a password, with a recommendation that that password be short and memorable rather than long and unwieldy; 3. either encrypt the device-credential with the user-password, or send the server the password to hash and store; 4. if the password challenge-response is on the server, have the server validate the device credential "before" or "outside of" accepting password-auth challenges (e.g. in the case of a client cert, validating the cert at the TLS level before the auth request can even reach the backend.) In other words, systems isomorphic to the financial chip-and-PIN system: the chip is something you have, while the PIN—something you know—is only there to prevent robbers from using the chip, rather than to provide any cryptographic security.
Markoff 9y ago
how is it single factor if your phone is locked? first you have to unlock it and then you must approve it in app which generates codes in background, that's two factors for me (but yeah, by this counting 2FA is for most users actually 3FA)
- rascul 9y ago
  Only one factor is required by Microsoft. You may require multiple factors of authentication to unlock the single factor Microsoft requires, but Microsoft still requires only one.

partycoder 9y ago

Tricking people into giving away their password (e.g: phishing) is a thing, but: - You can set a policy on password length/characters, making them hard to guess. - You can use SSL, and with free SSL certificates this is even simpler to achieve. - Defense against rainbow tables can be achieved through salted hashes, as long as the salt isn't public. While passwords are not a cure-all solution they're still a valid solution. Another way of tricking someone to give you their password: http://bash.org/?244321 http://bash.org/?244321

naasking 9y ago
> - You can set a policy on password length/characters, making them hard to guess. And hard to remember, so users will write them down, lose or forget them, thus requiring costly and insecure password recovery mechanisms. It's not at all clear that passwords actually add any real security due to these issues.
- frereubu 9y ago
  We had a panicked client ring us up one morning after their office had been broken into and computers were stolen. They'd been writing all their passwords on Post-It notes, which they then stuck to bottom of their screens.
  - naasking 9y ago
    Terrible, but also amazing.
  - kasey_junk 9y ago
    But honestly better than using the same password across all services for the last 15 years, which to my way of thinking, is the norm.

tptacek 9y ago

Empirically, it's more secure over the whole user population than user passwords.

kej 9y ago
Do you have a source for that? (not arguing, just want to read more about this)
- tptacek 9y ago
  No, just experience training organizations for this stuff. User passwords are extremely bad.
  - derefr 9y ago
    How do you feel about reversed 2FA flows? 1. Install a client cert/pairing token/SSH key/etc. onto each client device; 2. ask the user to configure a password, with a recommendation that that password be short and memorable rather than long and unwieldy; 3. either encrypt the device-credential with the user-password, or send the server the password to hash and store; 4. if the password challenge-response is on the server, have the server validate the device credential "before" or "outside of" accepting password-auth challenges (e.g. in the case of a client cert, validating the cert at the TLS level before the auth request can even reach the backend.) In other words, systems isomorphic to the financial chip-and-PIN system: the chip is something you have, while the PIN—something you know—is only there to prevent robbers from using the chip, rather than to provide any cryptographic security.

Markoff 9y ago

how is it single factor if your phone is locked? first you have to unlock it and then you must approve it in app which generates codes in background, that's two factors for me (but yeah, by this counting 2FA is for most users actually 3FA)

rascul 9y ago
Only one factor is required by Microsoft. You may require multiple factors of authentication to unlock the single factor Microsoft requires, but Microsoft still requires only one.