3 ms·

I see where you are coming from but sometimes you have to enforce some things. If you don't have 2FA, you can't login into this site is a completely rational co

by bhaak 8y ago

I see where you are coming from but sometimes you have to enforce some things. If you don't have 2FA, you can't login into this site is a completely rational consequence if for example this site is handling financial assets of yours. But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself).

acdha 8y ago
There’s also room for nuance even with financial sites: e.g. do MFA for everything which causes money to change hands but don’t require it every time someone checks their balance or confirms that their rent check went through, especially from a frequently-used client. Similarly, if you’re not a financial site question whether you’re doing anything of value. The Netflix example is great: a huge password really doesn’t matter unless the site allows you to see stored credit card information since the worst thing someone can do is load your viewing history up with high ratings for Iron Fist. Continuing to cargo cult DoD policies from the 1970s has caused more problems than it’s stopped.
- AstralStorm 8y ago
  Indeed, the best policy is to not store any data. Even easier to comply with GDPR this way. No account is best account. This requires that the site supports automatic completion and pasting. Quite a few sites explicitly prevent it for stupid reasons like assuming user browser is compromised. (If it is, you shouldn't be using the webpage for authentication.)
  - acdha 8y ago
    I really value the GDPR for getting companies to see stored data as a potential risk rather than just something which can potentially be sold later.
- beatgammit 8y ago
  They could also: - increase your subscription and watch using your account for free - send DVDs to their house and sell them - use your same email/password combo on other sites If you use 2FA for most things, it's much harder exploit anything. However, you need to use good 2FA, not that SMS crap.
  - acdha 8y ago
    Everything you mentioned was covered in my original comment: > - increase your subscriptio This should force a confirmation and notifications as I noted. Simply checking the credit card CVV is way more useful than traditional MFA. > and watch using your account for free Not your problem and Netflix must monitor that to catch friends and family sharing anyway. > - send DVDs to their house and sell them Also a financial change which should trigger checks. Again, CVV does the job perfectly fine. > use your same email/password combo on other sites This is only true if they utterly botch the design by storing passwords insecurely and displaying them to the user. If either of those are true, it’s virtually certain that they’ve made equally bad mistakes elsewhere which MFA won’t help with.
cyborgx7 8y ago
I would never claim there is no legitimacy to enforcing 2FA. At my last job we ran into a situation like that. I always lacked things other people and services took for granted for financial and political reasons (like a smartphone). When we were required to use 2FA for some services at work it caused some friction for me. We found a workable solution, but it was less than ideal. They were right to turn on 2FA but it does come at a cost, and that cost isn't always worth it. >But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself). I'm actually going to make the opposite counter-argument. I do think https is a great achievement but I also think we lost something with the additional complexity introduced in, what used to be, a fairly simple protocol with wide adoption. I don't think those were silly arguments to have had.
- beatgammit 8y ago
  For your telnet example, you can still use ncat, opens, or gnutls-cli to enter HTTP commands directly over a TLS transport. Yes it's more complicated, but it's still doable.
  - cyborgx7 8y ago
    Of course I feel a lot better using ssh than using telnet. I just don't want people to discount that this added complexity is the price we pay for the security.

by bhaak 8y ago

acdha 8y ago

There’s also room for nuance even with financial sites: e.g. do MFA for everything which causes money to change hands but don’t require it every time someone checks their balance or confirms that their rent check went through, especially from a frequently-used client. Similarly, if you’re not a financial site question whether you’re doing anything of value. The Netflix example is great: a huge password really doesn’t matter unless the site allows you to see stored credit card information since the worst thing someone can do is load your viewing history up with high ratings for Iron Fist. Continuing to cargo cult DoD policies from the 1970s has caused more problems than it’s stopped.

AstralStorm 8y ago
Indeed, the best policy is to not store any data. Even easier to comply with GDPR this way. No account is best account. This requires that the site supports automatic completion and pasting. Quite a few sites explicitly prevent it for stupid reasons like assuming user browser is compromised. (If it is, you shouldn't be using the webpage for authentication.)
- acdha 8y ago
  I really value the GDPR for getting companies to see stored data as a potential risk rather than just something which can potentially be sold later.
beatgammit 8y ago
They could also: - increase your subscription and watch using your account for free - send DVDs to their house and sell them - use your same email/password combo on other sites If you use 2FA for most things, it's much harder exploit anything. However, you need to use good 2FA, not that SMS crap.
- acdha 8y ago
  Everything you mentioned was covered in my original comment: > - increase your subscriptio This should force a confirmation and notifications as I noted. Simply checking the credit card CVV is way more useful than traditional MFA. > and watch using your account for free Not your problem and Netflix must monitor that to catch friends and family sharing anyway. > - send DVDs to their house and sell them Also a financial change which should trigger checks. Again, CVV does the job perfectly fine. > use your same email/password combo on other sites This is only true if they utterly botch the design by storing passwords insecurely and displaying them to the user. If either of those are true, it’s virtually certain that they’ve made equally bad mistakes elsewhere which MFA won’t help with.

cyborgx7 8y ago

I would never claim there is no legitimacy to enforcing 2FA. At my last job we ran into a situation like that. I always lacked things other people and services took for granted for financial and political reasons (like a smartphone). When we were required to use 2FA for some services at work it caused some friction for me. We found a workable solution, but it was less than ideal. They were right to turn on 2FA but it does come at a cost, and that cost isn't always worth it. >But it's possible that in the future we will put the bar higher. Then these arguments might be considered as silly as "with HTTPS I can no longer telnet into a web site and issue HTTP commands by hand!" (and don't tell me people didn't do that, I did it myself). I'm actually going to make the opposite counter-argument. I do think https is a great achievement but I also think we lost something with the additional complexity introduced in, what used to be, a fairly simple protocol with wide adoption. I don't think those were silly arguments to have had.

beatgammit 8y ago
For your telnet example, you can still use ncat, opens, or gnutls-cli to enter HTTP commands directly over a TLS transport. Yes it's more complicated, but it's still doable.
- cyborgx7 8y ago
  Of course I feel a lot better using ssh than using telnet. I just don't want people to discount that this added complexity is the price we pay for the security.