4 ms·

Passwords don't work these days for sophisticated attacks. Phishing is too easy. I repeat, they don't work. No 2FA means you'll experience many successful acco

Passwords don't work these days for sophisticated attacks. Phishing is too easy. I repeat, they don't work. No 2FA means you'll experience many successful account takeover attacks on your customers. 2FA does not mean you won't, though. Coinbase had a great talk about account takeover attacks on the recent DefCon. They receive some of the most sophisticated attacks, sometimes when attackers already have control of every other account that the target has. Email, Facebook, Apple Cloud - you name it, now they come for the coins, to cash out.

ojosilva 7y ago
Phishing, as in entering your password into a field pwnd by a hacker, seems like the problem to solve: how can we avoid giving out our password to a rogue player? There are simple and complex solutions out there, we should keep taking small steps in the direction of safer password authentication, like how browsers showing the users the certificate validity, or things requiring a secret, individualized secret question so that you know the the host is not phishing. I agree passwords are far, far from ideal and that 2FA is probably just adding complexity for the hackers, hence making it appear to be a better option, but this is just for the time being. Phone-based 2FA is flawed at the root (of how SIM cards work), so we should keep working on improving password security [1] instead of throwing ourselves into the arms of a flawed phone 2FA. [1] https://a16z.com/2019/07/25/passwords-are-dead-again/ https://a16z.com/2019/07/25/passwords-are-dead-again/
- dublinben 7y ago
  U2F and it's successors like FIDO2 were specifically designed to prevent phishing.[0] Google claims that it has entirely eliminated phishing of their employees who have been issued U2F keys.[1]. The solutions to these problems are out available. [0] https://fidoalliance.org/fido2/ https://fidoalliance.org/fido2/ [1] https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu...
miketery 7y ago
Link to talk?
danShumway 7y ago
It's not clear to me how 2FA would help against a phishing attack. Is there something I'm missing? My understanding is that 2FA helps protect against weak passwords and password leaks. That's it. If you give me your password via a phished site, then you'll also just as readily give me your 2FA code. Then I can log into your account and turn off 2FA, generate new login codes, or just keep the login session running indefinitely. How does 2FA help prevent any of that?
- henryfjordan 7y ago
  Maybe if you set up a site that looks like a login form phishing for the PW then immediately forwarding it to the target site, then do the same for a 2FA token you have a point. But in any other case where the victim isn't in the loop, that 2FA protects them (hopefully). If you haven't been to target.com in a week, you're not going to click the pop-up on your phone to log in out of the blue (hopefully). Ideally your 2FA methods are not as simple as just sending a code and having the user parrot it back though. There might be some cryptography going on that would make it even harder for the attacker to interfere.

ojosilva 7y ago

Phishing, as in entering your password into a field pwnd by a hacker, seems like the problem to solve: how can we avoid giving out our password to a rogue player? There are simple and complex solutions out there, we should keep taking small steps in the direction of safer password authentication, like how browsers showing the users the certificate validity, or things requiring a secret, individualized secret question so that you know the the host is not phishing. I agree passwords are far, far from ideal and that 2FA is probably just adding complexity for the hackers, hence making it appear to be a better option, but this is just for the time being. Phone-based 2FA is flawed at the root (of how SIM cards work), so we should keep working on improving password security [1] instead of throwing ourselves into the arms of a flawed phone 2FA. [1] https://a16z.com/2019/07/25/passwords-are-dead-again/ https://a16z.com/2019/07/25/passwords-are-dead-again/

dublinben 7y ago
U2F and it's successors like FIDO2 were specifically designed to prevent phishing.[0] Google claims that it has entirely eliminated phishing of their employees who have been issued U2F keys.[1]. The solutions to these problems are out available. [0] https://fidoalliance.org/fido2/ https://fidoalliance.org/fido2/ [1] https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu...

miketery 7y ago

Link to talk?

danShumway 7y ago

It's not clear to me how 2FA would help against a phishing attack. Is there something I'm missing? My understanding is that 2FA helps protect against weak passwords and password leaks. That's it. If you give me your password via a phished site, then you'll also just as readily give me your 2FA code. Then I can log into your account and turn off 2FA, generate new login codes, or just keep the login session running indefinitely. How does 2FA help prevent any of that?

henryfjordan 7y ago
Maybe if you set up a site that looks like a login form phishing for the PW then immediately forwarding it to the target site, then do the same for a 2FA token you have a point. But in any other case where the victim isn't in the loop, that 2FA protects them (hopefully). If you haven't been to target.com in a week, you're not going to click the pop-up on your phone to log in out of the blue (hopefully). Ideally your 2FA methods are not as simple as just sending a code and having the user parrot it back though. There might be some cryptography going on that would make it even harder for the attacker to interfere.