4 ms·

I would immediately switch to a mobile phone provider and a financial institution--even if they cost more and have fewer features--if these features were implem

I would immediately switch to a mobile phone provider and a financial institution--even if they cost more and have fewer features--if these features were implemented in one or both of those markets. Same for a domain registrar (Gandi comes close but will still reset the password via support while leaving 2FA enabled, which I suppose is OK), but they have to be willing to deal with someone with under 100 domains and under $5k/year in spend, which most registrars who have this level of security (reasonably) don't. Basically, I love that "do not let a password reset happen ever, ever" button. I want to take full responsibility for the security of my access credentials and NOT have to rely on a single-party app (I'm up to Microsoft, Entrust, Symantec, Authy, and Steam standalone authentication apps on my phone; it's annoying, just use OATH for them all, please).

StavrosK 8y ago
Exactly, I have a password database that is backed up in three places, including offsite, a backed-up hardware security key where I keep my TOTP credentials/U2F, and I take good care of them. At this point, it's more likely that your support will get socially engineered than that I will lose all my credentials. This is a minority of users, certainly, but users should have the option. The "recovery key" option is a very easy way to prove you own an account and get it reset, even if you're a less-savvy user.
- lbriner 8y ago
  This doesn't fix the problem because it only works for a small number of people who understand how to do this. The OP is about the difficulty for the provider to have a system that is secure but that doesn't confuse users. In many cases, asking a user, "do you want to disable all password resets ever on this account?" you might as well ask, "blah, blah, blah" because a load of people won't know what it means and the semi-technical folk will not understand it well enough - basically goodbye registrations.
waldfee 8y ago
Blizzard also has their own stuff. OATH for everything would make things so much easier. I cannot understand why they wont simply do that. What i hava a problem with in regards to account recovery options is that some services require you to also have enabled sms based 2FA in addition to TOTP or similiar as a fallback. That defeats the whole purpose of non-gsm based 2FA. The whole construct is as insecure as sms based alone, the TOTP part is entirely useless. at least make it optional if you think some users need it.
- scrollaway 8y ago
  FWIW Blizzard is 8-digit TOTP, they just don't make it obvious/easy to use your own stuff. Here's a command line tool I wrote that will generate a TOTP authenticator for you, with QR, base32 secret, etc: https://github.com/jleclanche/python-bna https://github.com/jleclanche/python-bna You can use it with andOTP, KeepassXC, 1Password etc.
  - StavrosK 8y ago
    Hey Jerome! Nice utility, but you may want to point people to andOTP (at least for Android devices), it's maintained (FreeOTP is unmaintained, I think) and much more featureful: https://play.google.com/store/apps/details?id=org.shadowice.flocke.andotp&hl=en_US https://play.google.com/store/apps/details?id=org.shadowice....
    - scrollaway 8y ago
      Updated. :)
    - robotdan 8y ago
      If anyone is looking to test out their own impl or a third party, this web based JS impl allow you to set up and test with a secret and a 6 digit OTP. https://github.com/inversoft/prime-two-factor/tree/master/web https://github.com/inversoft/prime-two-factor/tree/master/we...
  - waldfee 8y ago
cal5k 8y ago
This. Most people don’t appreciate that banks are responsible for most of the attack vectors that cause their customers to lose money. No 2FA options. Passwords are used directly to connect your bank account to third party apps rather than OAUTH. For merchants, it’s worse. It’s 2018 and banks still allow Catch Me If You Can-style NSF fraud, even for ACH/EFT payments. Poor KYC practices that allow people to open accounts with fake identities. The list goes on.
- dalore 8y ago
  A few banks in the UK send you a device which they use to challenge you with a code, you put you card in and type the pin and then their code, and it gives you back another code which you put into the website.
  - cal5k 8y ago
    Probably an RSA token. They're common for business banking but not for retail banking, or at least not in North America.

StavrosK 8y ago

Exactly, I have a password database that is backed up in three places, including offsite, a backed-up hardware security key where I keep my TOTP credentials/U2F, and I take good care of them. At this point, it's more likely that your support will get socially engineered than that I will lose all my credentials. This is a minority of users, certainly, but users should have the option. The "recovery key" option is a very easy way to prove you own an account and get it reset, even if you're a less-savvy user.

lbriner 8y ago
This doesn't fix the problem because it only works for a small number of people who understand how to do this. The OP is about the difficulty for the provider to have a system that is secure but that doesn't confuse users. In many cases, asking a user, "do you want to disable all password resets ever on this account?" you might as well ask, "blah, blah, blah" because a load of people won't know what it means and the semi-technical folk will not understand it well enough - basically goodbye registrations.

waldfee 8y ago

Blizzard also has their own stuff. OATH for everything would make things so much easier. I cannot understand why they wont simply do that. What i hava a problem with in regards to account recovery options is that some services require you to also have enabled sms based 2FA in addition to TOTP or similiar as a fallback. That defeats the whole purpose of non-gsm based 2FA. The whole construct is as insecure as sms based alone, the TOTP part is entirely useless. at least make it optional if you think some users need it.

scrollaway 8y ago
FWIW Blizzard is 8-digit TOTP, they just don't make it obvious/easy to use your own stuff. Here's a command line tool I wrote that will generate a TOTP authenticator for you, with QR, base32 secret, etc: https://github.com/jleclanche/python-bna https://github.com/jleclanche/python-bna You can use it with andOTP, KeepassXC, 1Password etc.
- StavrosK 8y ago
  Hey Jerome! Nice utility, but you may want to point people to andOTP (at least for Android devices), it's maintained (FreeOTP is unmaintained, I think) and much more featureful: https://play.google.com/store/apps/details?id=org.shadowice.flocke.andotp&hl=en_US https://play.google.com/store/apps/details?id=org.shadowice....
  - scrollaway 8y ago
    Updated. :)
  - robotdan 8y ago
    If anyone is looking to test out their own impl or a third party, this web based JS impl allow you to set up and test with a secret and a 6 digit OTP. https://github.com/inversoft/prime-two-factor/tree/master/web https://github.com/inversoft/prime-two-factor/tree/master/we...
- waldfee 8y ago

cal5k 8y ago

This. Most people don’t appreciate that banks are responsible for most of the attack vectors that cause their customers to lose money. No 2FA options. Passwords are used directly to connect your bank account to third party apps rather than OAUTH. For merchants, it’s worse. It’s 2018 and banks still allow Catch Me If You Can-style NSF fraud, even for ACH/EFT payments. Poor KYC practices that allow people to open accounts with fake identities. The list goes on.

dalore 8y ago
A few banks in the UK send you a device which they use to challenge you with a code, you put you card in and type the pin and then their code, and it gives you back another code which you put into the website.
- cal5k 8y ago
  Probably an RSA token. They're common for business banking but not for retail banking, or at least not in North America.