4 ms·

Personally I dislike nearly all kind of 2FA for a very simple reason: they add a dependency tie with something big, powerful and outside my control. For instan

by xte 8y ago

Personally I dislike nearly all kind of 2FA for a very simple reason: they add a dependency tie with something big, powerful and outside my control. For instance I perfectly agree to have an extra, branded, physical token, to log in to my bank, I totally refuse to use a mobile app on my phone to do the same.

quanticle 8y ago
What is the difference between an extra branded physical token and a 2FA app, such as Authy, on your phone?
- bdibs 8y ago
  One requires a mobile phone to function (and continue functioning), whereas the physical token only needs itself.
  - xte 8y ago
    +1
  - Freak_NL 8y ago
    It's disturbing how many developers simply gloss over the fact that requiring a smartphone with one of two non-free OSes installed (Android and IOS) is severely limiting the user's freedom in their use of digital services. In the Netherlands the ING bank was testing the waters this year by holding back on announcing a non-smartphone alternative to their ageing authentication methods (either SMS or a list of pre-generated codes received by mail). All of their communication was bent on nudging customers to use their banking smartphone app, and only at the end of this year did they announce a separate hardware solution for customers who don't want to, or cannot, use a smartphone for their banking. Every other bank in the Netherlands already had such hardware devices (TOTP usually, although newer generations use more complex methods) for a decade. U2F and its successors are the way forward if we want to maintain some semblance of digital freedom, not tying your whole identity to a smartphone.
    - em-bee 8y ago
      could you give some exapmples on how it limits the use of your device? while i agree with you, i seem to lack the imagination to come up with realistic examples that i can present as arguments. i am afraid anything i think of would get a response like "yeah, sure, but noone uses their phone like that" or they'll simply accuse me of being paranoid.
      - xte 8y ago
        I do not want proprietary software nor I want to depend on black boxes to use a service. So if a bank, a public administration etc demand using proprietary stuff that does not came from them they force their customers to buy such black boxes and suffer all their limitations. For instance I hate in the same way countries that ask users to install proprietary crappy software's to pay taxes instead simple pdfs/standard WebUI.
      - Freak_NL 8y ago
        > could you give some exapmples on how it limits the use of your device? Forcing me to use a smartphone app means I can't use a normal desktop or laptop computer, or even a non-Android, non-IOS smartphone. It means that institutions that provide a semi-public utility (e.g., banks) force people to support and agree with the terms of use supplied by a (foreign) megacorporation to function as a citizen in the digital realm. That is inherently undemocratic and a threat to our freedoms. Expecting the vast majority of citizens to have access to a computing device with a modern web browser is somewhat reasonable (as long as those who can't are supported by other means). You can at least choose what software you run, and there are free software options available. With smartphone apps (well-built web applications excluded) that freedom does not exist.
  - quanticle 8y ago
    So I need a physical token for each of my bank accounts (3 bank accounts), each of my investment accounts (2 investment accounts), each of my e-mail providers (2 e-mail providers) and one for every other service which might want to offer 2FA. Or, instead of that, I can have one smartphone, which has an app which handles all of those 2FA codes for me. Can you understand why I would prefer the smartphone option?
    - xte 8y ago
      So you also can possibly enjoy having 2FA demolish by a simple smartphones vulnerabilities that perhaps grab both passwords and token in a single action... We can't trust smartphones/connected devices in general, that's why IMO is better, for safe auth only, use offline stuff.
      - quanticle 8y ago
        So you also can possibly enjoy having 2FA demolish by a simple smartphones vulnerabilities that perhaps grab both passwords and token in a single action... Can you point to any instances where that's actually happened? Yes, sure, it's theoretically possible for someone to break into my fully patched phone and steal my 2FA secrets. But it's also theoretically possible for a mobster to break into my house, hold a gun to my head, and force me to log in to all of my banks accounts so that he or she can drain the money from them. There is no such thing as perfect security, and I would much rather have people using a 2FA app on their phone than just username/password. Is it perfect? No, of course not. But insisting that the existence of phone vulnerabilities makes 2FA apps on phone unacceptable, and that the only form of acceptable security is for people to juggle dozens of authenticator tokens is making the perfect the enemy of the good. It's because of "advice" like this that people ignore armchair security experts.
        xte 8y ago
        Does you credit card ever lock you out? For most people no it's not happen, for Julian Assange we know it happen. Does we have an nuclear warhead explode by accident? A dangerous thing remain dangerous even before accidents happen.
- xte 8y ago
  branded physical token is "a thing from my bank", so something they are responsible for, that for my POV came from them, created and maintained by them, it's not connected to anything and it's a standalone object. My phone is a connected device, monitoring me constantly outside my control, controlled by the most powerful data mining companies in the planet. I simply can't trust my phone. I can trust enough my physical offline devices and if it will be cracked sometime I'm completely not responsible for it, my bank is. While with my phone it's really easy to say "it's because of this or that, not our faults" where this or that can be anything from unupdated fw (by the vendor, of course), unsafe apps installed, ...
sigi45 8y ago
Strange argument. What is this 'big powerful Outside of your control'?
- xte 8y ago
  Google, RSA, ...
  - stonewareslord 8y ago
    Why not just use an open source app like FreeOTP (android only)? The TOTP/HTOP spec requires no network as well so you can firewall the apps and they’ll still work fine.
slezyr 8y ago
Use TOTP with andOTP or make your own generator, it's easy. https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP

by xte 8y ago

quanticle 8y ago

What is the difference between an extra branded physical token and a 2FA app, such as Authy, on your phone?

bdibs 8y ago
One requires a mobile phone to function (and continue functioning), whereas the physical token only needs itself.
- xte 8y ago
  +1
- Freak_NL 8y ago
  It's disturbing how many developers simply gloss over the fact that requiring a smartphone with one of two non-free OSes installed (Android and IOS) is severely limiting the user's freedom in their use of digital services. In the Netherlands the ING bank was testing the waters this year by holding back on announcing a non-smartphone alternative to their ageing authentication methods (either SMS or a list of pre-generated codes received by mail). All of their communication was bent on nudging customers to use their banking smartphone app, and only at the end of this year did they announce a separate hardware solution for customers who don't want to, or cannot, use a smartphone for their banking. Every other bank in the Netherlands already had such hardware devices (TOTP usually, although newer generations use more complex methods) for a decade. U2F and its successors are the way forward if we want to maintain some semblance of digital freedom, not tying your whole identity to a smartphone.
  - em-bee 8y ago
    could you give some exapmples on how it limits the use of your device? while i agree with you, i seem to lack the imagination to come up with realistic examples that i can present as arguments. i am afraid anything i think of would get a response like "yeah, sure, but noone uses their phone like that" or they'll simply accuse me of being paranoid.
    - xte 8y ago
      I do not want proprietary software nor I want to depend on black boxes to use a service. So if a bank, a public administration etc demand using proprietary stuff that does not came from them they force their customers to buy such black boxes and suffer all their limitations. For instance I hate in the same way countries that ask users to install proprietary crappy software's to pay taxes instead simple pdfs/standard WebUI.
    - Freak_NL 8y ago
      > could you give some exapmples on how it limits the use of your device? Forcing me to use a smartphone app means I can't use a normal desktop or laptop computer, or even a non-Android, non-IOS smartphone. It means that institutions that provide a semi-public utility (e.g., banks) force people to support and agree with the terms of use supplied by a (foreign) megacorporation to function as a citizen in the digital realm. That is inherently undemocratic and a threat to our freedoms. Expecting the vast majority of citizens to have access to a computing device with a modern web browser is somewhat reasonable (as long as those who can't are supported by other means). You can at least choose what software you run, and there are free software options available. With smartphone apps (well-built web applications excluded) that freedom does not exist.
- quanticle 8y ago
  So I need a physical token for each of my bank accounts (3 bank accounts), each of my investment accounts (2 investment accounts), each of my e-mail providers (2 e-mail providers) and one for every other service which might want to offer 2FA. Or, instead of that, I can have one smartphone, which has an app which handles all of those 2FA codes for me. Can you understand why I would prefer the smartphone option?
  - xte 8y ago
    So you also can possibly enjoy having 2FA demolish by a simple smartphones vulnerabilities that perhaps grab both passwords and token in a single action... We can't trust smartphones/connected devices in general, that's why IMO is better, for safe auth only, use offline stuff.
    - quanticle 8y ago
      So you also can possibly enjoy having 2FA demolish by a simple smartphones vulnerabilities that perhaps grab both passwords and token in a single action... Can you point to any instances where that's actually happened? Yes, sure, it's theoretically possible for someone to break into my fully patched phone and steal my 2FA secrets. But it's also theoretically possible for a mobster to break into my house, hold a gun to my head, and force me to log in to all of my banks accounts so that he or she can drain the money from them. There is no such thing as perfect security, and I would much rather have people using a 2FA app on their phone than just username/password. Is it perfect? No, of course not. But insisting that the existence of phone vulnerabilities makes 2FA apps on phone unacceptable, and that the only form of acceptable security is for people to juggle dozens of authenticator tokens is making the perfect the enemy of the good. It's because of "advice" like this that people ignore armchair security experts.
      - xte 8y ago
        Does you credit card ever lock you out? For most people no it's not happen, for Julian Assange we know it happen. Does we have an nuclear warhead explode by accident? A dangerous thing remain dangerous even before accidents happen.
xte 8y ago
branded physical token is "a thing from my bank", so something they are responsible for, that for my POV came from them, created and maintained by them, it's not connected to anything and it's a standalone object. My phone is a connected device, monitoring me constantly outside my control, controlled by the most powerful data mining companies in the planet. I simply can't trust my phone. I can trust enough my physical offline devices and if it will be cracked sometime I'm completely not responsible for it, my bank is. While with my phone it's really easy to say "it's because of this or that, not our faults" where this or that can be anything from unupdated fw (by the vendor, of course), unsafe apps installed, ...

sigi45 8y ago

Strange argument. What is this 'big powerful Outside of your control'?

xte 8y ago
Google, RSA, ...
- stonewareslord 8y ago
  Why not just use an open source app like FreeOTP (android only)? The TOTP/HTOP spec requires no network as well so you can firewall the apps and they’ll still work fine.

slezyr 8y ago

Use TOTP with andOTP or make your own generator, it's easy. https://github.com/andOTP/andOTP https://github.com/andOTP/andOTP