6 ms·

Yup. The target for MFA is not perfect security, but security better than passwords alone — the bar is quite low to start with. And all of the above techniques

Yup. The target for MFA is not perfect security, but security better than passwords alone — the bar is quite low to start with. And all of the above techniques offer that to varying degrees. I use strong passwords on all sensitive accounts, stored in a local password manager, with an authenticator app for those that don't accept my Fido2 Yubkey. Seems good enough to me.

eeZah7Ux 7y ago
If a workstation is compromised, having multi-factor authentication is useless for most services: The real targets become the HTTPS session cookies and files on disk.
- robcohen 7y ago
  This is correct, which is why I am a big fan of FIDO U2F software like https://Krypt.co https://Krypt.co . This requires your phone which is essentially a second workstation to authenticate. So now you need to exploit two workstations.
  - eeZah7Ux 7y ago
    No. Once you authenticated your sessions are the target.
- scient 7y ago
  Even then the external services will still require first and second factors of authentication. If your workstation is compromised on an ongoing basis, then nothing matters. If its an one-time even, 2FA will protect the external services still.
- acdha 7y ago
  Note that responsible sites do variations on IP / location fixation to reduce the value of exfiltrated session cookies and, of course, they're only valid for as long as you go between verifications. One really nice thing about FIDO is that it affords a low-pain “tap the button to confirm it's you” verification instead of a full password challenge.
  - eeZah7Ux 7y ago
    The attacker can very easily use your workstation as a vantage point. Even used directly your browser and your SSH sessions. It's makes it even more difficult to detect and trace.
    - acdha 7y ago
      Yes, which is a different threat than what was under discussion. Don't argue that we don't need seatbelts because they don't help when the driver is a kidnapper.

eeZah7Ux 7y ago

If a workstation is compromised, having multi-factor authentication is useless for most services: The real targets become the HTTPS session cookies and files on disk.

robcohen 7y ago
This is correct, which is why I am a big fan of FIDO U2F software like https://Krypt.co https://Krypt.co . This requires your phone which is essentially a second workstation to authenticate. So now you need to exploit two workstations.
- eeZah7Ux 7y ago
  No. Once you authenticated your sessions are the target.
scient 7y ago
Even then the external services will still require first and second factors of authentication. If your workstation is compromised on an ongoing basis, then nothing matters. If its an one-time even, 2FA will protect the external services still.
acdha 7y ago
Note that responsible sites do variations on IP / location fixation to reduce the value of exfiltrated session cookies and, of course, they're only valid for as long as you go between verifications. One really nice thing about FIDO is that it affords a low-pain “tap the button to confirm it's you” verification instead of a full password challenge.
- eeZah7Ux 7y ago
  The attacker can very easily use your workstation as a vantage point. Even used directly your browser and your SSH sessions. It's makes it even more difficult to detect and trace.
  - acdha 7y ago
    Yes, which is a different threat than what was under discussion. Don't argue that we don't need seatbelts because they don't help when the driver is a kidnapper.