3 ms·

> Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. An important thing to remember here is that MFA works wit

> Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA. An important thing to remember here is that MFA works with a password. Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. This article isn't suggesting that we get rid of passwords. It's suggesting that the energy we spend making sure that passwords are good would be better spent encouraging users to enable MFA. In other words, having two relatively weak authentication mechanisms that must be used in tandem is still better than having one strong authentication mechanism.

Spivak 7y ago
> Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. If this were true your car would probably get stolen a lot more often. You're less secure from targeted attacks from people who know you IRL but that's a lot rarer than the attacks you'll actually encounter.
- danShumway 7y ago
  Eh... cars are really big. A better way of phrasing this is, "if this were true, your wallet/phone would get stolen a lot more often." But aren't wallet/phone thefts relatively common? > You're less secure from targeted attacks from people who know you IRL I'm also not completely certain this is true. If a YubiKey is the only thing securing most people's accounts, I don't need to target you. I can walk into a coffee shop, or locker room, or office and steal as many YubiKeys as I can find. And then I can check later whether or not any of them are linked to bank accounts. I don't know the stats; are most petty wallet/phone thefts targeted?
  - kortilla 7y ago
    A wallet is useful to a thief, a yubikey is not. There is little overlap between petty thieves and people trying to get into a particular target’s account.
    - danShumway 7y ago
      > There is little overlap between petty thieves and people trying to get into a particular target’s account. But isn't that the point? There's little overlap because right now we have a multi-factor system where stealing one part of the authentication mechanism from a random person in the street isn't enough to get into their account. If everyone's account is secured with just a YubiKey, then you don't have to target a specific person. What's to prevent any petty thief from grabbing a bunch of wallets and/or YubiKeys, walking into a library, and just checking a few of the most common banks to see if any of them log in? Maybe I'm missing something? It's not clear to me why an MFA attack would ever need to be targeted in a world without passwords. I guess maybe you're hoping that petty thieves can't figure out your username? But that's just treating your username like a password. For a lot of bank accounts, your username will be some variant of your first and last name, which is helpfully printed on the drivers license in the wallet I just stole. I don't need to know who you are beforehand.
- jarfil 7y ago
  It's less about "how do I steal this partícular guy's phone", and more about "how do I use this random stolen phone to access any accounts it was used with".
snowwrestler 7y ago
Microsoft does intend to get rid of passwords altogether: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Announcing-the-public-preview-of-Azure-AD-support-for-FIDO2/ba-p/746362 https://techcommunity.microsoft.com/t5/Azure-Active-Director...
Falkon1313 7y ago
'Better' if you consider dramatically increasing the chances of getting locked out of your own account to be 'better'. If you're logging in from your phone anyway, then it's not really a second factor, so it's meaningless. If you're not, then your phone might be unavailable or charging or something, so you're locked out. And if someone else gets hold of your phone, they can now easily log in, so it increases the attack area. MFA is a bad idea. Biometrics are a bad idea (for similar reasons). Unique passwords (handled with a password manager) are still by far the best solution that we have. Adding epicycles is not the answer. Improving the UX and handling of passwords is the way forward.

Spivak 7y ago

> Otherwise, that 99% goes down dramatically because I can just steal your phone/Yubikey/whatever. If this were true your car would probably get stolen a lot more often. You're less secure from targeted attacks from people who know you IRL but that's a lot rarer than the attacks you'll actually encounter.

danShumway 7y ago
Eh... cars are really big. A better way of phrasing this is, "if this were true, your wallet/phone would get stolen a lot more often." But aren't wallet/phone thefts relatively common? > You're less secure from targeted attacks from people who know you IRL I'm also not completely certain this is true. If a YubiKey is the only thing securing most people's accounts, I don't need to target you. I can walk into a coffee shop, or locker room, or office and steal as many YubiKeys as I can find. And then I can check later whether or not any of them are linked to bank accounts. I don't know the stats; are most petty wallet/phone thefts targeted?
- kortilla 7y ago
  A wallet is useful to a thief, a yubikey is not. There is little overlap between petty thieves and people trying to get into a particular target’s account.
  - danShumway 7y ago
    > There is little overlap between petty thieves and people trying to get into a particular target’s account. But isn't that the point? There's little overlap because right now we have a multi-factor system where stealing one part of the authentication mechanism from a random person in the street isn't enough to get into their account. If everyone's account is secured with just a YubiKey, then you don't have to target a specific person. What's to prevent any petty thief from grabbing a bunch of wallets and/or YubiKeys, walking into a library, and just checking a few of the most common banks to see if any of them log in? Maybe I'm missing something? It's not clear to me why an MFA attack would ever need to be targeted in a world without passwords. I guess maybe you're hoping that petty thieves can't figure out your username? But that's just treating your username like a password. For a lot of bank accounts, your username will be some variant of your first and last name, which is helpfully printed on the drivers license in the wallet I just stole. I don't need to know who you are beforehand.
jarfil 7y ago
It's less about "how do I steal this partícular guy's phone", and more about "how do I use this random stolen phone to access any accounts it was used with".

snowwrestler 7y ago

Microsoft does intend to get rid of passwords altogether: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Announcing-the-public-preview-of-Azure-AD-support-for-FIDO2/ba-p/746362 https://techcommunity.microsoft.com/t5/Azure-Active-Director...

Falkon1313 7y ago

'Better' if you consider dramatically increasing the chances of getting locked out of your own account to be 'better'. If you're logging in from your phone anyway, then it's not really a second factor, so it's meaningless. If you're not, then your phone might be unavailable or charging or something, so you're locked out. And if someone else gets hold of your phone, they can now easily log in, so it increases the attack area. MFA is a bad idea. Biometrics are a bad idea (for similar reasons). Unique passwords (handled with a password manager) are still by far the best solution that we have. Adding epicycles is not the answer. Improving the UX and handling of passwords is the way forward.