3 ms·

If we start thinking passwords don't matter, we go back to single-factor authentication. What makes the "second" factor in 2FA more secure than the first? Is t

If we start thinking passwords don't matter, we go back to single-factor authentication. What makes the "second" factor in 2FA more secure than the first? Is that it's usually a time-based generated key? Or is it that users usually use a physical device for this second key, hence removing a lot of internet-only attack vectors?

Latty 7y ago
Definitely your second point, although it's worth noting that mobile authentication apps are still weak (although not as weak as just a password) to remote phishing attacks where security keys aren't. Mobile authentication apps rely on the user only typing that code into the right website—and people suck at noticing if they are on the wrong site. Right now, this is mostly only a problem with spear-phishing as most don't bother, but if 2FA becomes too popular, they'll start to adapt. Security keys, on the other hand, get the host directly from the browser. This means they should be safe even if you fall for a phishing attack.
closeparen 7y ago
TOTP and U2F both perform a single authentication from a captive secret, rather than revealing a reusable secret. U2F does even better, and ensures you are authenticating to the right website, not an intermediary. If we eliminated passwords in favor of onboard U2F chips, we'd be much better off than today, though not as amazing as U2F + passwords.
- tialaramex 7y ago
  Arguably what's inside a U2F/ FIDO token isn't a secret but a private value. The TOTP secret is known to the authenticator, they calculate the same TOTP value as you to verify that yours is correct. In U2F / WebAuthn the device just proves it still knows a private asymmetric key that it can use to sign messages, the authenticator learns the _public_ key, but not the private one, it can authenticate these signatures but not produce its own. To deliver pseudonymity the device doesn't use a single public/private pair for everything but instead generates them randomly from a seed or key it knows and _this_ private value is what makes your FIDO Security Key different from my FIDO Security Key so that you can be authenticated, whilst not making it possible to fingerprint you and see where else you use these credentials. Single Factor FIDO is a thing, Microsoft offers it. The device takes a PIN (something you know) and incorporates that into the results, so that anyone who doesn't know the PIN now can't authenticate even if they've stolen your Security Key. You need a suitable device, the Yubikey Security Keys with a "2" emblazened are suitable.
tialaramex 7y ago
Quantity has a quality all of its own. For example in TOTP the secret is 160 bits. A whole swathe of those attacks vanish when "guessing" ceases to be a viable element of any strategy. Bad guys can plausibly guess a "password" but they can't guess a 160-bit value. Beyond that, U2F / FIDO doesn't have a secret at all, a typical device uses symmetric ("secret key") crypto but it never actually tells anybody else that key, it's a baked-in private value for the device. This gets rid of all the attack vectors in which someone else learns your secret which you will see were many of the items in Microsoft's list.

Latty 7y ago

Definitely your second point, although it's worth noting that mobile authentication apps are still weak (although not as weak as just a password) to remote phishing attacks where security keys aren't. Mobile authentication apps rely on the user only typing that code into the right website—and people suck at noticing if they are on the wrong site. Right now, this is mostly only a problem with spear-phishing as most don't bother, but if 2FA becomes too popular, they'll start to adapt. Security keys, on the other hand, get the host directly from the browser. This means they should be safe even if you fall for a phishing attack.

closeparen 7y ago

TOTP and U2F both perform a single authentication from a captive secret, rather than revealing a reusable secret. U2F does even better, and ensures you are authenticating to the right website, not an intermediary. If we eliminated passwords in favor of onboard U2F chips, we'd be much better off than today, though not as amazing as U2F + passwords.

tialaramex 7y ago
Arguably what's inside a U2F/ FIDO token isn't a secret but a private value. The TOTP secret is known to the authenticator, they calculate the same TOTP value as you to verify that yours is correct. In U2F / WebAuthn the device just proves it still knows a private asymmetric key that it can use to sign messages, the authenticator learns the _public_ key, but not the private one, it can authenticate these signatures but not produce its own. To deliver pseudonymity the device doesn't use a single public/private pair for everything but instead generates them randomly from a seed or key it knows and _this_ private value is what makes your FIDO Security Key different from my FIDO Security Key so that you can be authenticated, whilst not making it possible to fingerprint you and see where else you use these credentials. Single Factor FIDO is a thing, Microsoft offers it. The device takes a PIN (something you know) and incorporates that into the results, so that anyone who doesn't know the PIN now can't authenticate even if they've stolen your Security Key. You need a suitable device, the Yubikey Security Keys with a "2" emblazened are suitable.

tialaramex 7y ago

Quantity has a quality all of its own. For example in TOTP the secret is 160 bits. A whole swathe of those attacks vanish when "guessing" ceases to be a viable element of any strategy. Bad guys can plausibly guess a "password" but they can't guess a 160-bit value. Beyond that, U2F / FIDO doesn't have a secret at all, a typical device uses symmetric ("secret key") crypto but it never actually tells anybody else that key, it's a baked-in private value for the device. This gets rid of all the attack vectors in which someone else learns your secret which you will see were many of the items in Microsoft's list.