5 ms·
And don't forget to tell him that 2fa is pretty useless...no better than a random password
by thefounder 7y ago
And don't forget to tell him that 2fa is pretty useless...no better than a random password
- leowoo91 7y agoIsn't 2FA short lived and related to an additional device? What makes you think it's not effective?
- thefounder 7y ago2FA is already mandatory on Amazon. How well did that work? What you need is U2F.
- latchkey 7y agoIt is only mandatory for sellers.
- thefounder 7y agoYeah, and what's the subject of this post?
- point78 7y agoCan you explain further
- thefounder 7y ago2FA is just another password(albeit temporary). What you need is U2F
- latchkey 7y agoIf you are referring to SMS based 2FA, then that is definitely an issue. If someone is able to hijack your phone number to receive the notifications, then you are going to be in trouble. Token based 2FA is another story though... it definitely adds another layer of security to your passwords and amazon supports this format. In the case of the OP's partner, my guess is that either they were phished into revealing their Amazon password or their password for Amazon was the same password used elsewhere and that source was hacked.
- thefounder 7y agoI'm not talking about SMS. What you need is U2F not 2FA.
- latchkey 7y agoDoing a bit more reading and now I can clarify terminology... 2FA is a general term. U2F is a type of 2FA. The other type, which is what I was referring to, is TOTP (Time-based one time password). You are right that U2F is more secure. The primary security advantage is that there is no longer a shared secret that needs to be stored on each end. But saying 2FA is useless would be like also saying that U2F is useless since 2FA is a general term. That said, in this case, TOTP would have likely prevented anyone from accessing the OP's partners account. Therefore, TOTP is not useless per your original comment.
- thefounder 7y agoCheck this[] starting at 18:55. It explains the issue and the fix for OTP/TOTP. What you need is a u2f device/key/app and web auth. It takes the responsibility to identify if the website is fake or not from you which is really the core issue. The secret is negotiated directly with the u2F device/sec key. https://m.youtube.com/watch?v=kGGMgEfSzMw&time_continue=1271 https://m.youtube.com/watch?v=kGGMgEfSzMw&time_continue=1271