5 ms·

> unknowingly divulge your password What's to keep you from unknowingly divulging your MFA token's current generated code? You're right that being phished/key

> unknowingly divulge your password What's to keep you from unknowingly divulging your MFA token's current generated code? You're right that being phished/keylogged pwns a password-only account no matter how strong the password, but MFA isn't immune to phishing/keylogging/clipboard stealing either. Yes, the generated code will only give them access for 30 seconds (or whatever the algorithm's time window), but that's more than enough time for an attacker to get substantial work done. I maintain that strong passwords in a password manager are probably good enough for security-conscious/appropriately skeptical people. For folks like that, MFA likely isn't worth the trouble - at least not quite yet.

jarfil 7y ago
My main gripe with MFA, is that once you have 20+ services each one with a different token, it becomes tedious to sift through them to find the right one. I'd much rather have some MFA app capable of detecting where you're logging in, and a "click to authorize" option. That wouldn't completely stop someone from being able to steal the token, but it would thwart most simple keyloggers.
- TimTheTinker 7y ago
  1Password has that :-) So if you auto-fill on a login page, it will place your username, password, and 2FA codegen into the site's authentication fields. It will not auto-suggest a login if you're not on the site it originated from - which is often enough to cause people to take a second look at the URL (which really helps thwart phishing). Plus, it sends your authentication info to the browser via a secure connection to the 1Password browser extension, so (a) your credentials can't be keylogged, and (b) they never touch the clipboard, so they can't be stolen from there either. But all of that is also true of non-MFA logins from 1Password. So again, I don't see the added benefit of MFA if you're already using 1Password with long random passwords.
tialaramex 7y ago
WebAuthn/ U2F are, in fact, immmune to phishing, keylogging, clipboard stealing etcetera. Google reports attacks on their employees are 0% effective for systems where they were able to deploy U2F. If you try to phish it, you get credentials that are useless, because the credentials are bound to the FQDN, it will cheerfully hand over credentials for https://fakebank.example/ https://fakebank.example/ but they aren't the goodbank.example credentials, so it's futile for breaking into your goodbank account. There is no keyboard entry, so nothing for a keyboard logger or clipboard thief. If you've completely taken over the user's hardware I guess all bets are off, but that's a big step up from what you're talking about.

jarfil 7y ago

My main gripe with MFA, is that once you have 20+ services each one with a different token, it becomes tedious to sift through them to find the right one. I'd much rather have some MFA app capable of detecting where you're logging in, and a "click to authorize" option. That wouldn't completely stop someone from being able to steal the token, but it would thwart most simple keyloggers.

TimTheTinker 7y ago
1Password has that :-) So if you auto-fill on a login page, it will place your username, password, and 2FA codegen into the site's authentication fields. It will not auto-suggest a login if you're not on the site it originated from - which is often enough to cause people to take a second look at the URL (which really helps thwart phishing). Plus, it sends your authentication info to the browser via a secure connection to the 1Password browser extension, so (a) your credentials can't be keylogged, and (b) they never touch the clipboard, so they can't be stolen from there either. But all of that is also true of non-MFA logins from 1Password. So again, I don't see the added benefit of MFA if you're already using 1Password with long random passwords.

tialaramex 7y ago

WebAuthn/ U2F are, in fact, immmune to phishing, keylogging, clipboard stealing etcetera. Google reports attacks on their employees are 0% effective for systems where they were able to deploy U2F. If you try to phish it, you get credentials that are useless, because the credentials are bound to the FQDN, it will cheerfully hand over credentials for https://fakebank.example/ https://fakebank.example/ but they aren't the goodbank.example credentials, so it's futile for breaking into your goodbank account. There is no keyboard entry, so nothing for a keyboard logger or clipboard thief. If you've completely taken over the user's hardware I guess all bets are off, but that's a big step up from what you're talking about.