5 ms·

If you can talk your way past two factor auth, it is useless. I can see the argument for being forceful about prompting you to write down backup codes or whate

by Latty 7y ago

If you can talk your way past two factor auth, it is useless. I can see the argument for being forceful about prompting you to write down backup codes or whatever, but fixing that after-the-fact is something they should absolutely not been doing. I do think that sites should offer better options for recovery. NearlyFreeSpeech do a really good job of this, offering seven methods of recovery and letting you decide how many you need to fulfil to be given access and which you want to configure. However, things like checking photo ID and more "offline" options are expensive to support, so I get why that is rare.

soheil 7y ago
> If you can talk your way past two factor auth, it is useless. > However, things like checking photo ID and more "offline" options are expensive to support, so I get why that is rare. For you to characterize my efforts with Github support as "talking my way past it" is absurd. I was never once asked to provide a photo ID, etc. something I would have gladly complied with.
- zaarn 7y ago
  Unless Github obtained your photo ID or something similar before you enabled 2FA, that's kind of pointless to ask for.
  - soheil 7y ago
    They can re-activate the keys they automatically purged from my account, I still have their associated private keys. My github profile also has detailed information in its bio section including my past employer and links to my various social media/website. They could simply validate my ownership of one of those accounts etc.
    - calvinmorrison 7y ago
      Yeah seems simple to ask you to sign message with your key to prove its you!
    - zaarn 7y ago
      The social media websites could have been hacked by some attacker, the private keys could have been obtained as well. Or put there by an attacker that is now locked out by 2FA. The entire point of 2FA is that it's a second factor and no way around it without a second factor that is verifiable without doubt.
      - kortilla 7y ago
        Nope. Many 2FA setups have a way to workaround the second factor if it’s missing. Recovery codes, emails to secondary addresses, faxing an ID, etc etc.
        zaarn 7y ago
        If you can social engineer yourself around 2FA it's not a proper 2FA setup.
      - soheil 7y ago
        So they could hack your other social media accounts possibly also with 2fa enabled but not be able to steal your back up codes smfh
- 0xffff2 7y ago
  What good would a photo ID be, really? It's not like they have an existing copy to compare it to, and a photo-copy quality copy of an average ID would be pretty simple to fake.
exolymph 7y ago
Nearly Free Speech is awesome <3 Anyone reading this, if you want a web host with hacker values — not in the blackhat sense, in the old school sense — check 'em out!
- Latty 7y ago
  They are pretty unique and are good, although they are slow to update the service and it's starting to hit some real issues for me. The most relevant issue for me being the lack of U2F (now WebAuthn, I guess) support. It is also really annoying you can't have restricted SSH keys to allow for automation that is locked down to single sites. They have had those issues on their feature voting for years.
closeparen 7y ago
You can talk your way past it at AWS. Need a medallion signature guarantee (more intense form of notary) from a bank. It’s not easy but you can do that. After that experience I switched to Authy, which does an encrypted cloud backup of your TOTP secrets.
godelski 7y ago
> If you can talk your way past two factor auth, it is useless. No, it just means you use a different 2FA. Here's some examples. - Gov ID - Pushing to a private repo - Checking if IP matches historical records (hell, since they're fingerprinting everyone, why not use that?) There's problems with 2FA. Mainly that it is on your phone. Phones are pretty valuable devices and it isn't unlikely that they get stolen. Even if Google backed up Authenticator to Drive, how do you get Authenticator back on your new phone? It isn't hard to come up with a hundred scenarios where things fall apart. This is why there are different levels of security. But my GitHub isn't so sensitive that if I lose access I don't want anyone to ever get access. Yet at the same time it is sensitive enough (and GitHub is attacked enough) that I don't think just a user name and password is sufficient. Where's the middle ground? Even with YubiKeys I have to have multiples (as a backup in case I lose one). There's such a thing as "acceptable security levels." We're trying to make things easier and safer for humans. But that doesn't mean they aren't still going to be human.
- dvcrn 7y ago
  Not if you didn't previously acknowledge using these kinds of documents as 2FA. I set 2FA fully aware that if I lose my recovery codes I'm done. I don't want anyone ever to be able to restore my accounts without the codes. There are so many attack vectors with government documents. Just one service hacked that I had to upload them for verification and that kind of information can become 'public'. Humans and social engineering are one of the biggest attack vectors nowadays because of things like "humans make mistake, let's reset his account because he knew the last digits of the creditcard used and uploaded an ID". Gandi handles this nicely with a checkbox in the settings that explicitly tells support to never ever restore the account if 2FA is lost
- ProZsolt 7y ago
  Gov ID would only work if you show it in person. A lot of people have a photocopy of ID. IP address is easy to fake. The main problem is with targeted attacks. That's why SMS not secure
  - godelski 7y ago

by Latty 7y ago

soheil 7y ago

> If you can talk your way past two factor auth, it is useless. > However, things like checking photo ID and more "offline" options are expensive to support, so I get why that is rare. For you to characterize my efforts with Github support as "talking my way past it" is absurd. I was never once asked to provide a photo ID, etc. something I would have gladly complied with.

zaarn 7y ago
Unless Github obtained your photo ID or something similar before you enabled 2FA, that's kind of pointless to ask for.
- soheil 7y ago
  They can re-activate the keys they automatically purged from my account, I still have their associated private keys. My github profile also has detailed information in its bio section including my past employer and links to my various social media/website. They could simply validate my ownership of one of those accounts etc.
  - calvinmorrison 7y ago
    Yeah seems simple to ask you to sign message with your key to prove its you!
  - zaarn 7y ago
    The social media websites could have been hacked by some attacker, the private keys could have been obtained as well. Or put there by an attacker that is now locked out by 2FA. The entire point of 2FA is that it's a second factor and no way around it without a second factor that is verifiable without doubt.
    - kortilla 7y ago
      Nope. Many 2FA setups have a way to workaround the second factor if it’s missing. Recovery codes, emails to secondary addresses, faxing an ID, etc etc.
      - zaarn 7y ago
        If you can social engineer yourself around 2FA it's not a proper 2FA setup.
    - soheil 7y ago
      So they could hack your other social media accounts possibly also with 2fa enabled but not be able to steal your back up codes smfh
0xffff2 7y ago
What good would a photo ID be, really? It's not like they have an existing copy to compare it to, and a photo-copy quality copy of an average ID would be pretty simple to fake.

exolymph 7y ago

Nearly Free Speech is awesome <3 Anyone reading this, if you want a web host with hacker values — not in the blackhat sense, in the old school sense — check 'em out!

Latty 7y ago
They are pretty unique and are good, although they are slow to update the service and it's starting to hit some real issues for me. The most relevant issue for me being the lack of U2F (now WebAuthn, I guess) support. It is also really annoying you can't have restricted SSH keys to allow for automation that is locked down to single sites. They have had those issues on their feature voting for years.

closeparen 7y ago

You can talk your way past it at AWS. Need a medallion signature guarantee (more intense form of notary) from a bank. It’s not easy but you can do that. After that experience I switched to Authy, which does an encrypted cloud backup of your TOTP secrets.

godelski 7y ago

> If you can talk your way past two factor auth, it is useless. No, it just means you use a different 2FA. Here's some examples. - Gov ID - Pushing to a private repo - Checking if IP matches historical records (hell, since they're fingerprinting everyone, why not use that?) There's problems with 2FA. Mainly that it is on your phone. Phones are pretty valuable devices and it isn't unlikely that they get stolen. Even if Google backed up Authenticator to Drive, how do you get Authenticator back on your new phone? It isn't hard to come up with a hundred scenarios where things fall apart. This is why there are different levels of security. But my GitHub isn't so sensitive that if I lose access I don't want anyone to ever get access. Yet at the same time it is sensitive enough (and GitHub is attacked enough) that I don't think just a user name and password is sufficient. Where's the middle ground? Even with YubiKeys I have to have multiples (as a backup in case I lose one). There's such a thing as "acceptable security levels." We're trying to make things easier and safer for humans. But that doesn't mean they aren't still going to be human.

dvcrn 7y ago
Not if you didn't previously acknowledge using these kinds of documents as 2FA. I set 2FA fully aware that if I lose my recovery codes I'm done. I don't want anyone ever to be able to restore my accounts without the codes. There are so many attack vectors with government documents. Just one service hacked that I had to upload them for verification and that kind of information can become 'public'. Humans and social engineering are one of the biggest attack vectors nowadays because of things like "humans make mistake, let's reset his account because he knew the last digits of the creditcard used and uploaded an ID". Gandi handles this nicely with a checkbox in the settings that explicitly tells support to never ever restore the account if 2FA is lost
ProZsolt 7y ago
Gov ID would only work if you show it in person. A lot of people have a photocopy of ID. IP address is easy to fake. The main problem is with targeted attacks. That's why SMS not secure
- godelski 7y ago