5 ms·
Hence why 2FA tokens and reset links should have a short window of validity, and why shallow information such as knowing account name, or address, or mothers ma
by retSava 7y ago
Hence why 2FA tokens and reset links should have a short window of validity, and why shallow information such as knowing account name, or address, or mothers maiden name, should not be used for sensitive purposes.
- faeyanpiraat 7y agoIt is considered a security best practice to use a 2fa app (like Authy), or a physical token instead of SMS. This way when the token generator is lost you at least notice it in a reasonable timeframe. For critical systems where 2fa is enabled I also do a "simulated" device loss, where I go trough all the steps at least once that I would have to do in case of a real device loss (fetching backup codes, revoking token, resetting password, adding new token). This way I do not have to constantly worry about losing critical items, because I'm prepared for the worst and I can be calm. It also helps to have all your data encrypted at rest with Bitlocker or Veracrypt (hard to enforce this rule on yourself for pendrives, but oh well..).
- teel 7y agoThanks! That (simulated device loss followed by all the steps you mentioned) is something I plan to do every now and then but so far I've never gotten around to actually doing it. Encouraged by your post think I'll finally do it (some day, hopefully sooner rather than later).
- threatofrain 7y agoThis brings up some interesting technical questions: how long is too long and what is a deep question for identity?
- a3n 7y agoYour imaginary friend's mother's maiden name.
- blowski 7y agoWhich also happens to be an extremely rare maiden name - i.e. not Smith but "Vortangula" or "Brinderbass".
- pavel_lishin 7y ago> Vortangula Brinderbass Thank you for the new D&D character name.
- theshadowknows 7y agoOne time I did a "forgot password" reset on an old email account. Apparently young me thought it was a good idea to choose the 'pick your own question' thing and the question I chose was "What?" ...to this day I still don't remember what the answer was.
- dpeck 7y agoDepending on how young, there’s a decent chance the answer was some variation of “chicken butt”
- wkearney99 7y agoI have an 11 year old. You're sooo right about the chance that's it...
- theshadowknows 7y agoHah!
- criddell 7y agoI always give non-sense answers to security questions and store the question and answer in my password manager.
- chucksmash 7y agoThe dangers of being clever. Briefly used a given LastPass, used another setup for several years, then wanted to go back to that old LastPass for something. The LastPass password hint I'd set: > Don't forget your LastPass password. It wasn't some oblique hint. It was an FU from 20-something me to 30-something me that I distinctly remembered sending as soon as it saw it.
- theshadowknows 7y agoThat made me smile :)
- crayaz 7y ago
- Groxx 7y agoSomething like a minute or two is probably the upper bound. Look at TOTP timers for a sane default (often like 30 seconds), and add a bit more for SMS delivery delays. You can always try to send a new code when the old one expires. But also: basically the entire security world has been recommending against SMS 2-factor for years, because it's so incredibly easy to steal access. Don't use SMS if at all possible, don't have it as a backup (because "a backup option" == "an option" == "you are only as strong as your weakest link"), etc. Avoid it entirely.
- tinus_hn 7y agoHence why SMS is not a valid part of any authentication system that should be secure.