4 ms·

If that's what Reddit's security team was thinking by mid-2018, then Reddit security is in bad shape. NIST recommended the deprecation of SMS 2FA two years ago.

by mtgx 8y ago

If that's what Reddit's security team was thinking by mid-2018, then Reddit security is in bad shape. NIST recommended the deprecation of SMS 2FA two years ago. When NIST recommends the deprecation of a protocol you know you should've already gotten rid of it five years earlier, not keep it around for another five years. The sooner more companies start supporting U2F and WebAuthn, the sooner more people will start buying and using hardware security keys.

aroch 8y ago
I don't think it was up to Reddit. Some providers offer no way to do MFA without mandatory SMS involvement in some way -- either primary delivery is by SMS or you can "reset" / get back up codes via SMS.
- dbg31415 8y ago
  Looking at you, LinkedIn. Microsoft has been lax on this.
- robohoe 8y ago
  Many major banks do that too.
- hackinthebochs 8y ago
  I've been interested in enabling MFA on my google account, but with no obvious way to bypass/disable SMS, I don't even bother.
  - wolf550e 8y ago
    Look at step 18 in this guide: https://techsolidarity.org/resources/security_key_gmail.htm https://techsolidarity.org/resources/security_key_gmail.htm
- Alex3917 8y ago
  Because of cases like this, it's also the admin's responsibility to have their wireless provider put a security pin and a Do Not Port order on their account. Sometimes reps will ignore this and port people's accounts anyway, but it's still negligent not take this precaution.
  - aroch 8y ago
    Phone company reps are notorious for ignoring any and all such notes on accounts, we can't know for sure if Reddit had this in place but it probably wouldn't be much of a hurdle
- shakestheclown 8y ago
  It does sound like they used TOTP when possible but in some instances only SMS was available. My issue is that they seem to act surprised that SMS is so broken. I have trouble believing that any admins of a site that large have missed the various security alerts and news articles about hacked accounts, lost cryptocurrency, etc.
peterwwillis 8y ago
You don't even need those. TOTP is perfectly acceptable. It's simple, it's offline, it's free. It's a weekend project. Two functions and an extra column in a database. No hacking on clients, no implementing protocols, no buying hardware. Implementing TOTP: https://www.serverstack.com/blog/2013/02/21/implementing-totp-authentication-into-your-infrastructure/ https://www.serverstack.com/blog/2013/02/21/implementing-tot... My opinion is hardware tokens are a joke for average user security. If I can't even keep my phone around to use TOTP, I'm sure as hell not going to keep track of my U2F token.
- tptacek 8y ago
  U2F is superior to TOTP because it's much harder to phish, and phishing is one of the two most serious attack vectors most teams face (the other being email attachments). Everyone that does U2F seriously also does TOTP, and doing both is the best option. But yes, TOTP is a good start; the minimum that every serious team should have for its own personnel now.
  - peterwwillis 8y ago
    U2F is pretty cool, but it's also a bit over-complicated. Specifically, I don't think we need USB or NFC. A client (or an extension) could generate a QR code which embeds a signed request from the server (SRS) along with a signed request from the client using a key it generates just for this server (CRS). The user scans this QR, the user's phone app recognizes the SRS+CRS, and spits out a token or QR. The phisher might be able to mitm the SRS, but they can't know what the CRS is, so they can't generate a fake QR that will validate on the client app. So with no special hardware, we generate a one-time token that [as long as they can't mess with browser window pop-ups or some other nonsense] can't be phished. (I'm excluding malware because we all know it's game over by that point)
    - tptacek 8y ago
      Or we can just implement U2F, which was designed specifically based on experiences people had with TOTP phishing. There are software U2F tokens if you nerd-fussy about this stuff.

by mtgx 8y ago

aroch 8y ago

I don't think it was up to Reddit. Some providers offer no way to do MFA without mandatory SMS involvement in some way -- either primary delivery is by SMS or you can "reset" / get back up codes via SMS.

dbg31415 8y ago
Looking at you, LinkedIn. Microsoft has been lax on this.
robohoe 8y ago
Many major banks do that too.
hackinthebochs 8y ago
I've been interested in enabling MFA on my google account, but with no obvious way to bypass/disable SMS, I don't even bother.
- wolf550e 8y ago
  Look at step 18 in this guide: https://techsolidarity.org/resources/security_key_gmail.htm https://techsolidarity.org/resources/security_key_gmail.htm
Alex3917 8y ago
Because of cases like this, it's also the admin's responsibility to have their wireless provider put a security pin and a Do Not Port order on their account. Sometimes reps will ignore this and port people's accounts anyway, but it's still negligent not take this precaution.
- aroch 8y ago
  Phone company reps are notorious for ignoring any and all such notes on accounts, we can't know for sure if Reddit had this in place but it probably wouldn't be much of a hurdle
shakestheclown 8y ago
It does sound like they used TOTP when possible but in some instances only SMS was available. My issue is that they seem to act surprised that SMS is so broken. I have trouble believing that any admins of a site that large have missed the various security alerts and news articles about hacked accounts, lost cryptocurrency, etc.

peterwwillis 8y ago

You don't even need those. TOTP is perfectly acceptable. It's simple, it's offline, it's free. It's a weekend project. Two functions and an extra column in a database. No hacking on clients, no implementing protocols, no buying hardware. Implementing TOTP: https://www.serverstack.com/blog/2013/02/21/implementing-totp-authentication-into-your-infrastructure/ https://www.serverstack.com/blog/2013/02/21/implementing-tot... My opinion is hardware tokens are a joke for average user security. If I can't even keep my phone around to use TOTP, I'm sure as hell not going to keep track of my U2F token.

tptacek 8y ago
U2F is superior to TOTP because it's much harder to phish, and phishing is one of the two most serious attack vectors most teams face (the other being email attachments). Everyone that does U2F seriously also does TOTP, and doing both is the best option. But yes, TOTP is a good start; the minimum that every serious team should have for its own personnel now.
- peterwwillis 8y ago
  U2F is pretty cool, but it's also a bit over-complicated. Specifically, I don't think we need USB or NFC. A client (or an extension) could generate a QR code which embeds a signed request from the server (SRS) along with a signed request from the client using a key it generates just for this server (CRS). The user scans this QR, the user's phone app recognizes the SRS+CRS, and spits out a token or QR. The phisher might be able to mitm the SRS, but they can't know what the CRS is, so they can't generate a fake QR that will validate on the client app. So with no special hardware, we generate a one-time token that [as long as they can't mess with browser window pop-ups or some other nonsense] can't be phished. (I'm excluding malware because we all know it's game over by that point)
  - tptacek 8y ago
    Or we can just implement U2F, which was designed specifically based on experiences people had with TOTP phishing. There are software U2F tokens if you nerd-fussy about this stuff.