9 ms·
SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RS
by cbhl 10y ago
SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers).
Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rotatable if compromised.
And there are FIDO U2F security keys, but you still need to issue $18-$50 tokens to each user, and you need host application support.
- DennisP 10y agoHopefully we'll get to a world where people keep a U2F key on their keychain, and use it for all their important logins.
- noja 10y agoWe have a long way to go. People need to understand: * How U2F works on their phone * What if the U2F key gets lost or stolen (revocation) * How to have a backup of the U2F key * Are multiple identities possible (home/work/whatever)
- DennisP 10y agoI think a lot of this is close enough to the way mechanical keys work that it's not a huge leap. You can have more than one house key, you change the lock if a key gets stolen, etc. It's a little different, but not really more complicated.
- jasikpark 10y agoOne good thing is that we are moving towards where most devices will have USB type c as a port, so that mobile devices, laptops, and desktops can all share keys.
- YZF 10y agoIf you have a phone you can run a 2FA app though like Google Authenticator. Much more secure.
- 3pt14159 10y agoBut what happens when thieves steal my phone? How do I authenticate then? Most places use SMS as a backup, which gets us back to the original problem. People with popular YouTube accounts have to deal with this all the time and the advice right now seems to be to buy a burner phone on a false name[1] and never share the phone number with anyone, which is just crazy. [1] Fraudsters are able to convince phone employees that they forgot their phone number and left their phone at home.
- sytse 10y agoWith Google Authenticator you would have to use your one-time codes to reset it if your phone is lost. With 1password the 2FA is no longer linked to the phone, this way you don't have to reset.
- ribosometronome 10y agoGoogle will also let you move your Authenticator to a new device with access to the account from another trusted device without needing to 2FA. So, for example, I can temporarily move Authenticator to an tablet if my phone is lost/stolen using my laptop, which is already trusted. There are some potential security drawbacks to this but access to a trusted device seems a reasonable compromise between security and convenience.
- sebcat 9y agoAlso worth noting: Google Authenticator is just TOTP[1] (X=30, Digit=6, HMAC-SHA-1 IIRC). You can just copy the URL from the QR code and use it from whatever you like, as long as your clock is somewhat synced. [1] https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238
- 10y ago
- otterley 10y agoThere are plenty of second-factor mobile apps as well: Duo, Authy, Google Authenticator, and Symantec VIP access, just to name a few.
- techsupporter 10y agoAnd now I'm trapped in this multi-app universe where every entity uses a different app. My employer uses Symantec, my school uses Duo, my bank has its own app (as does Steam), and a handful of sites use TOTP. Argh.
- dublinben 10y agoAt least TOTP (and U2F) are standards. All sites and organizations should be using them, not something they've created themselves.
- toast0 9y agoDUO and other similar tools where you accept on the phone instead of getting a code and having to type it in can be more convenient than typing; and provided you get the push, you can take care of it from the notification so you don't have to find the app, so it's not terrible if you need seven different apps.
- z3t4 10y agoyou could use a one time pad written one a paper.
- andrewvc 10y agoThe big problem that SMS solves that nothing else does is that you can be completely irresponsible/unlucky and it still works. You can lose your u2f key , lose any one time backup codes on paper, and so long as you can convince your phone company that you are you you're fine. I don't think most people are responsible enough to deal with more secure MFA. Most people don't know how to keep custody of stuff like that.
- hdhzy 10y ago> so long as you can convince your phone company that you are you you're fine. Well I think the problem starts when someone else convinces your phone company that they are you. As we've seen several times now it becomes easier and easier to pull this trick. As for U2F add more than one to your account (2 is minimum) and you are safe. The same applies to any kind of physical key (home, car, etc.)
- andrewvc 10y agoI think there are plenty more people who would lose all their u2f keys than be attacked via the phone company. Sure, that's easy for you to manage, but not for most people.
- deleted 10y ago[deleted]
- inflagranti 9y agoI rather have to convince my bank I'm me as they have much higher security standards generally than the phone companies so less chance of someone else convincing them they are me.
- Rafert 10y agoI have high hopes for the W3C WebAuthn spec [1], it combines the security of FIDO U2F keys with the ease and ubiquity of devices with fingerprint scanners. Would be cool if Apple will support it too. 1: https://www.w3.org/TR/webauthn/ https://www.w3.org/TR/webauthn/
- mattmanser 10y agoIn the UK we got hardware authenticators for free. And most bank accounts for personal accounts are free too.
- raverbashing 10y agoYou can get a pre printed card for cheap for 2fa. No need for RSA token
- distances 10y agoThis is how it works often in Europe, a paper slip with a bunch of one-time tokens. I don't see how any technical solution would be better in security or usability.
- Natanael_L 9y agoU2F is just a button
- lrem 9y agoYou can even turn a profit here, I'm effectively paying a buck per preprinted one time code...
- belorn 10y agoSecurity token devices for online banking is quite old now and came long before the trend of 2fa using sms, and they did not cost 60$. I have owned several by now and the first one one I owned was given as part of a gratis student package by the bank.
- petre 10y agoYup. I had one from Symantec and was never charged for it. If I lost it, it would cost something like 10$. It was also quite small, close to a U2F key/USB flash memory stick but it did not have a keyboard to type a PIN on. Most do.
- peterwwillis 10y agoWell, people do have 10 fingerprints, but the bigger concern is how easy it is to find them and copy them. They're not secure. You'd actually be much more secure using toe prints as auth tokens, as gross and impractical as that sounds. Most biometrics are lame because they're so readily available. However, they are ridiculously useful because of how fast and conveniently they can authenticate you. Honestly, this sounds like a much better technology: http://www.dailymail.co.uk/sciencetech/article-3220886/Forget-Bluetooth-Transmitting-magnetic-fields-human-body-connect-smart-devices-saves-battery-power.html http://www.dailymail.co.uk/sciencetech/article-3220886/Forge... It transmits data through the human body. You could turn it on or off selectively, authenticate with anything you touch, and it would remain cryptographically secure.
- petre 10y agoFingerprints are on file in police records. Whenever you get an US visa, a passport with biometrics or stuff gets stolen from the office and the police is called to investigate, you get fingerprinted.
- peterwwillis 9y agoThat's true, but your toe prints aren't taken! xD Maybe someone can put toeprint scanners in shoes and add bluetooth...
- bostik 10y ago> fingerprints have the unfortunate property of not being rotatable if compromised Coworker has a wonderful term for this. He calls fingertips "amputationware". It really drives the point home. But there is another very good reason to avoid fingerprints auth methods. The scanners are by design doing some level of fuzzy matching, so if/when[0] someone finds a way to generate an input that reproduces the signal pattern from the reader well enough, it can be fooled. (Yep, done already.) My personal take on fingerprint authentication is that they are not passwords. They are usernames. 0: http://engineering.nyu.edu/press-releases/2017/04/10/so-you-think-you-can-secure-your-mobile-phone-fingerprint http://engineering.nyu.edu/press-releases/2017/04/10/so-you-...
- Eridrus 9y agoFingerprints can certainly be "amputationware" if you refuse to give up your passcode and your threat model has a credible threat of amputations. For most people, having their unlocked phone snatched out of their hands on the street[0] is a far more credible threat and somehow we don't have everyone saying you shouldn't unlock your phone outside. [0] https://www.theverge.com/2016/12/2/13819288/uk-police-encryption-mugging-seized-phone-scotland-yard https://www.theverge.com/2016/12/2/13819288/uk-police-encryp...
- xellisx 10y agoYeah - I was going to saw something about people with extreme eczema suffers (Which I happen to be one), can have issues with skin just splitting open on tips of the fingers. This is the reason I don't use my finger print scanner on my phone...
- Ntrails 9y agoHow does it compare to the Vein scanning auth tools in terms of efficacy? Obviously the non rotable issue remains (although less viable to amputation auth)
- tdist 9y agoDo note however, that masterprints are not applicable for all current solutions.[1] Their statement is of course biased, but they nevertheless point out a significant flaw in the referenced study. [1]: https://corporate.fingerprints.com/en/newsroom/faq-regarding-fingerprints-information-disclosure-and-product-launches/current-questions-answers/ https://corporate.fingerprints.com/en/newsroom/faq-regarding...
- user5994461 9y ago10 or 50$ per person is less than peanuts. The challenging part is setting up the 2FA and integrating it into all your systems.