10 ms·
The bleak picture of two-factor authentication adoption in the wild
- reconbot 8y agoI was having an argument over 1password's 2fa support not being a second factor. (I don't think it is.) However, it is so much safer than not using 2fa. In similar terms U2F is amazing and keeps you from being phished and has a great challenge/response protocol, if that was implemented in 1password (or browsers themselves thank you!) we'd all be a lot safer than not using it at all. In 2018 I'm using an app to take screenshots of QR codes to generate one time codes. It's a sad state of the art, we need to do better.
- seppin 8y ago> (I don't think it is.) If your master password is someone exposed, then nothing really protects you.
- dev_dull 8y agoWouldn’t an 2fa device (such as an otp token) actually protect you in this case? They have your password but not your otp generator.
- seppin 8y agoYes but to have your MP they'd most likely have rooted your device, they could surely do the same to your mobile. If they could do one, they can do the other. Just a matter of efforts I guess
- matwood 8y agoThis is not true. 1Password could have a breach which exposes your master password. A hacker would then have access to your passwords, but not your 2fa. Even if you do not keep these items physically separated like a hardware token, it makes complete sense to have them be in different applications. For example, passwords in 1Password and tokens stored in Authy.
- aasasd 8y agoAfaiu 2fa primarily protects from password leaks on the part of the service and coincidentally some other kinds of leaks such as keylogging. Not so much from data theft on the user's side. A different question, though, is whether a password keeper web service could leak passwords like any other service.
- chimeracoder 8y ago> Afaiu 2fa primarily protects from password leaks on the part of the service and coincidentally some other kinds of leaks such as keylogging. Not so much from data theft on the user's side. 2FA is meant to protect primarily against phishing. It happens to protect against some other attacks as well, but phishing is the primary motivation. That's why physical U2F devices are considered the gold standard of authentication today - it's possible to phish a TOTP code, but it's very difficult to phish a U2F signature, and impossible to do so through a scalable, automated attack.
- schaefer 8y agoIt completely blows my mind that blizzard got it right over a decade ago with a dedicated physical device that would generate a one-time, time sensitive key for second factor authentication (to protect my video game account). Where as I feel I'm still waiting for my bank (actual money) to catch up. they took the easy way out by sms-ing me a second factor authentication key. Even though phone number theft is a known attack vector.
- untog 8y agoMy bank did that, maybe a decade ago. It was pretty inconvenient any time I wanted to access my bank account away from home. SMS is a godsend by comparison.
- village-idiot 8y agoU2F keys are ideal in this regard. You typically have your keys with you. The only weakness is that not enough apps incorporate u2f over nfc.
- spydum 8y agoThe thing that is nutty is.. they PAY MONEY for the SMS method! I do not understand why more sites don't support TOTP like Google Authenticator.
- spiritcat 8y agoGoogle authentication is great, until it's time to get a new phone.
- XorNot 8y agoI store my totp secrets in keepass with everything else and synchronise it to my other devices. This probably undermines the idea - but phones get lost/destroyed/wiped regularly.
- sethhochberg 8y ago
- interfixus 8y agoFor those among us who can handle our passwords and general security, 2FA is just a penalty we have to pay for those who can't. As far as possible, I ditch any company that wants to force it upon me. I've done my homework, I don't want to consult my telephone, my mailbox, or even worse, some pesky dongle to complicate my life and add to my expenses.
- XorNot 8y ago2FA is nice when you're working across devices - I.e. using a public PC but have your phone on you.
- interfixus 8y agoOh yes,just please don't force me into it. I actually use it in a few essntial places, but only as an opt-in.
- u801e 8y agoIdeally, I would not want to use a public computer to access an important account. People can forget to use an incognito session, forget to log out, or even forget to close the browser.
- jaxn 8y agoI recently started using a Titan key where I can and am in the process of requiring it for my team. We can handle good passwords. But our customers deserve for our database, admin tools, etc to require the more comprehensive authentication. I'm not going to make our customers use 2FA, but we do require it internally now. We can handle it.
- u801e 8y agoIn contrast, I wouldn't hesitate to enable 2FA if the company supported doing so via client-side TLS certificates (such that I can import it into my browser and use it in combination with my existing credentials).
- knorker 8y agoUntil a zero day exploit takes your browser, your VM you run your browser in (with confidence like yours you'd better run Qubes OS style) and just sniffs everything. The "I know what I'm doing" doesn't hold up very well, statistically.
- paraditedc 8y agoSo here's how I use 2FA apps: I have my primary phone with Authy and all the accounts. I also have a secondary (old) phone in my drawer, which also has Authy installed. Both of them automatically sync the 2FA accounts in my Authy account, which is linked to my email and phone number. In the event that my primary phone is not available, I can switch to my secondary phone quickly. Is that a good practice? I also plan to get physical keys and do the same when they become more popular.
- Kalium 8y agoYour heavy use of 2FA is a good practice. That said, linking SMS often allows for SMS to be used to reset passwords. As sim swapping and phone cloning become more common attacks, the level of protection you gain from having SMS available drops. These attacks essentially let someone else receive your texts or calls. I have at least one friend who has been attacked this way.
- laretluval 8y ago2FA is a user interface disaster, exporting the failures of software security as a huge annoyance on to users. I would rather be hacked than deal with 2FA.
- u801e 8y agoThe right way to do it is to use client-side TLS certificates in combination with the username and password. Add in a passphrase for the private key and you could have 3FA. All that's really needed is for browser vendors to improve their UI for generating certificate signing requests and importing certificates.
- blfr 8y agoNo, the right way is U2F. You touch a dongle and you're in. And there's no way to steal your key without physically getting the dongle.
- u801e 8y agoYes, but one has to buy another device, and only a limited number of companies support it at the moment [1]. It doesn't look like any of the banks I use, any of the credit cards I use, or the tax filing service I use support it. Not to mention that this website and other forums I log into aren't mentioned there either. Some of those companies offer SMS or email based 2FA as an option. In any case, every single one of those services allows me to connect using TLS where my browser verifies the server's identity via the CA bundle I have installed on my machine. I simply don't see why companies don't make the investment to support client-side TLS authentication or start supporting U2F. > And there's no way to steal your key without physically getting the dongle. I would contend that it's probably easier to steal the dongle as opposed to my machine at home. [1] https://www.yubico.com/works-with-yubikey/catalog/ https://www.yubico.com/works-with-yubikey/catalog/
- blfr 8y agoThere are others which aren't listed there, like OVH (the largest European hosting company). The dearth of banks is real though. And sad. I have only seen client-side certificates used twice. Once at now infamous StartSSL and second at a bank but for vendor access, not regular customers. Its huge downside is that it's a second factor which doesn't protect against a compromised device.
- kerng 8y agoPass the Cookie attacks bypass most 2FA solutions. So be aware of malware. Interesting write up here: https://wunderwuzzi23.github.io/blog/passthecookie.html https://wunderwuzzi23.github.io/blog/passthecookie.html I have seen this being used by red teams, not sure about real malware.
- lemoncucumber 8y agoI got a new phone recently and was dismayed at how easy it was to reset the 2FA on various accounts. Some fall back to SMS in that case (which has well-documented insecurities), while others allow you to call customer support and reset it without providing too much to prove that you’re the account owner. There has to be a path for people who lose or break their phones with their Authenticator apps, but I’d feel better if it was a little more difficult than it seems to be in most cases.
- xte 8y agoPersonally I dislike nearly all kind of 2FA for a very simple reason: they add a dependency tie with something big, powerful and outside my control. For instance I perfectly agree to have an extra, branded, physical token, to log in to my bank, I totally refuse to use a mobile app on my phone to do the same.
- quanticle 8y agoWhat is the difference between an extra branded physical token and a 2FA app, such as Authy, on your phone?
- bdibs 8y agoOne requires a mobile phone to function (and continue functioning), whereas the physical token only needs itself.
- xte 8y ago+1
- Freak_NL 8y agoIt's disturbing how many developers simply gloss over the fact that requiring a smartphone with one of two non-free OSes installed (Android and IOS) is severely limiting the user's freedom in their use of digital services. In the Netherlands the ING bank was testing the waters this year by holding back on announcing a non-smartphone alternative to their ageing authentication methods (either SMS or a list of pre-generated codes received by mail). All of their communication was bent on nudging customers to use their banking smartphone app, and only at the end of this year did they announce a separate hardware solution for customers who don't want to, or cannot, use a smartphone for their banking. Every other bank in the Netherlands already had such hardware devices (TOTP usually, although newer generations use more complex methods) for a decade. U2F and its successors are the way forward if we want to maintain some semblance of digital freedom, not tying your whole identity to a smartphone.
- 8y ago
- sigi45 8y agoMost annoying: AWS doesn't support two devices... How to fix it? Create two accounts -_-. LastPass and bitcoin.de also don't support multiple devices.
- GuidoW 8y agoThe failure mode of TOTP, SMS is that the user needs to be sure to be connected to the correct site. The hidden assumption is that the use is able to distinguish the fake from the correct site. For any authentication system to work in the face of adversaries trying to confuse a user, the system needs to be robust against that. https://eccentric-authentication.nl/blog/2014/11/30/spot-the-differences/ https://eccentric-authentication.nl/blog/2014/11/30/spot-the... https://eccentric-authentication.nl/blog/2016/11/18/on-the-internet-there-is-only-alice/ https://eccentric-authentication.nl/blog/2016/11/18/on-the-i...
- em-bee 8y agotrue, 2FA prevents against people pretending to be you trying to log into the site, but not against sites pretending to be the site you want to access.
- rkho 8y agoIt just irritates me how many financial institutions either don't support 2FA (I'm looking at you, Amex) or only offer either SMS or (yes, really) email as the only way(s) to protect your account. Vanguard recently required that all accounts be "secured" via SMS, and I was dismayed to learn that Nest (of all companies) didn't even support Google Authenticator -- the only option with Nest was to use SMS as well. It just seems like a losing battle at this point.
- mikestew 8y agoFor all you PNW Microsofties, I saw that First Tech credit union finally got their shit together after the system change and reimplemented 2FA using a hardware key. Great, sign me up! First I get a message asking if I really want a hardware key? Well, I’d rather use the U2F keys I’ve already got, but yeah, send me one. The fact that it showed up in a hand-addressed envelope tells you how many of these they’re sending out. No matter, I’ll use the phone authenticator for day-to-day, and the HW key as a backup. Not optimal, but until they support U2F it’ll have to do. Nope, you get to pick one key. So the HW key goes in the safe, and I use SMS for day-to-day. Or IOW, might as well have saved the plastic and postage for that HW key. EDIT: someone else suggested directing email codes to an account that is protected by a HW key. Firing up GMail on my phone I less convenient than reading the SMS code off my watch, but I’ll probably do that.
- bubblethink 8y agoI feel that most forms of 2FA have too much friction for average users. SMS is bad, but better than nothing. I really can't imagine average users figuring out TOTP apps, U2F or other hardware tokens and dealing with backups and lost keys etc. Perhaps fingerprint based solutions based on WebAuthn will get more mainstream.
- ajdhsjakafjt 8y agoI'd be happy if we stop calling it 2FA and instead say "2of3" or something. So many providers require you to use 2FA, but almost no one forces you to include fallback authentication.