5 ms·

2FA is a user interface disaster, exporting the failures of software security as a huge annoyance on to users. I would rather be hacked than deal with 2FA.

u801e 8y ago
The right way to do it is to use client-side TLS certificates in combination with the username and password. Add in a passphrase for the private key and you could have 3FA. All that's really needed is for browser vendors to improve their UI for generating certificate signing requests and importing certificates.
- blfr 8y ago
  No, the right way is U2F. You touch a dongle and you're in. And there's no way to steal your key without physically getting the dongle.
  - u801e 8y ago
    Yes, but one has to buy another device, and only a limited number of companies support it at the moment [1]. It doesn't look like any of the banks I use, any of the credit cards I use, or the tax filing service I use support it. Not to mention that this website and other forums I log into aren't mentioned there either. Some of those companies offer SMS or email based 2FA as an option. In any case, every single one of those services allows me to connect using TLS where my browser verifies the server's identity via the CA bundle I have installed on my machine. I simply don't see why companies don't make the investment to support client-side TLS authentication or start supporting U2F. > And there's no way to steal your key without physically getting the dongle. I would contend that it's probably easier to steal the dongle as opposed to my machine at home. [1] https://www.yubico.com/works-with-yubikey/catalog/ https://www.yubico.com/works-with-yubikey/catalog/
    - blfr 8y ago
      There are others which aren't listed there, like OVH (the largest European hosting company). The dearth of banks is real though. And sad. I have only seen client-side certificates used twice. Once at now infamous StartSSL and second at a bank but for vendor access, not regular customers. Its huge downside is that it's a second factor which doesn't protect against a compromised device.
      - dcbadacd 8y ago
        Client-side certificates are widely used among the Estonian population btw. It's basically the rest of the world that has caused the need for U2F/TOTP because they can't deploy smartcards with certs to users.
        u801e 8y ago
        There's a wiki page that describes the authentication process in Estonia: https://eid.eesti.ee/index.php/Authenticating_in_web_applications https://eid.eesti.ee/index.php/Authenticating_in_web_applica...
      - u801e 8y ago
        > Its huge downside is that it's a second factor which doesn't protect against a compromised device. That's true, but I think that if people used an encrypted private key (protected by a passphrase), then that would be less of an issue.
- sedatk 8y ago
  Meanwhile usability cries in a corner.
  - u801e 8y ago
    It could be said that having my identity "stolen" and having to deal with the fall out is a far bigger real-life usability issue as compared to having to deal with a one time set up to use client-side TLS certificate with a service like my bank.
  - dcbadacd 8y ago
    Estonian ID cards or Estonian Mobile ID is not hard to use. The currently working system is proof that TLS client certs can be easily used if provider just supported it.
zbentley 8y ago
> 2FA is a user interface disaster, exporting the failures of software security as a huge annoyance on to users I'd argue that it's exporting the failures of human psychology, not software security. Sure, there are some pretty egregiously bad technologies underlying a lot of industry standard encrypted-communication/authentication/identity-management systems (including HTTPS). No argument that the tools and practices on the technical side could be way better. But even if technical security was executed 100% perfectly, if the inputs to those systems remain usernames and passwords, people will be incredibly vulnerable. It's just too easy to [re]use weak usernames/passwords, too easy to write them down, and too easy to forget them (requiring "forgot password" attack vectors). I agree with you that MFA is much more inconvenient than traditional U/P authentication. But I don't think it's inconvenient because of a failure in software security; it's inconvenient because it's extra work, and it has to be extra work because, well, people suck at diligence and security.

u801e 8y ago

The right way to do it is to use client-side TLS certificates in combination with the username and password. Add in a passphrase for the private key and you could have 3FA. All that's really needed is for browser vendors to improve their UI for generating certificate signing requests and importing certificates.

blfr 8y ago
No, the right way is U2F. You touch a dongle and you're in. And there's no way to steal your key without physically getting the dongle.
- u801e 8y ago
  Yes, but one has to buy another device, and only a limited number of companies support it at the moment [1]. It doesn't look like any of the banks I use, any of the credit cards I use, or the tax filing service I use support it. Not to mention that this website and other forums I log into aren't mentioned there either. Some of those companies offer SMS or email based 2FA as an option. In any case, every single one of those services allows me to connect using TLS where my browser verifies the server's identity via the CA bundle I have installed on my machine. I simply don't see why companies don't make the investment to support client-side TLS authentication or start supporting U2F. > And there's no way to steal your key without physically getting the dongle. I would contend that it's probably easier to steal the dongle as opposed to my machine at home. [1] https://www.yubico.com/works-with-yubikey/catalog/ https://www.yubico.com/works-with-yubikey/catalog/
  - blfr 8y ago
    There are others which aren't listed there, like OVH (the largest European hosting company). The dearth of banks is real though. And sad. I have only seen client-side certificates used twice. Once at now infamous StartSSL and second at a bank but for vendor access, not regular customers. Its huge downside is that it's a second factor which doesn't protect against a compromised device.
    - dcbadacd 8y ago
      Client-side certificates are widely used among the Estonian population btw. It's basically the rest of the world that has caused the need for U2F/TOTP because they can't deploy smartcards with certs to users.
      - u801e 8y ago
        There's a wiki page that describes the authentication process in Estonia: https://eid.eesti.ee/index.php/Authenticating_in_web_applications https://eid.eesti.ee/index.php/Authenticating_in_web_applica...
    - u801e 8y ago
      > Its huge downside is that it's a second factor which doesn't protect against a compromised device. That's true, but I think that if people used an encrypted private key (protected by a passphrase), then that would be less of an issue.
sedatk 8y ago
Meanwhile usability cries in a corner.
- u801e 8y ago
  It could be said that having my identity "stolen" and having to deal with the fall out is a far bigger real-life usability issue as compared to having to deal with a one time set up to use client-side TLS certificate with a service like my bank.
- dcbadacd 8y ago
  Estonian ID cards or Estonian Mobile ID is not hard to use. The currently working system is proof that TLS client certs can be easily used if provider just supported it.

zbentley 8y ago

> 2FA is a user interface disaster, exporting the failures of software security as a huge annoyance on to users I'd argue that it's exporting the failures of human psychology, not software security. Sure, there are some pretty egregiously bad technologies underlying a lot of industry standard encrypted-communication/authentication/identity-management systems (including HTTPS). No argument that the tools and practices on the technical side could be way better. But even if technical security was executed 100% perfectly, if the inputs to those systems remain usernames and passwords, people will be incredibly vulnerable. It's just too easy to [re]use weak usernames/passwords, too easy to write them down, and too easy to forget them (requiring "forgot password" attack vectors). I agree with you that MFA is much more inconvenient than traditional U/P authentication. But I don't think it's inconvenient because of a failure in software security; it's inconvenient because it's extra work, and it has to be extra work because, well, people suck at diligence and security.