3 ms·
> 1. They can suppress a new-computer login challenge (they call this "2FA", but this is a risk-based login or anti-ATO feature, not 2FA). 2FA means 2 Factor A
by rasengan 7y ago
> 1. They can suppress a new-computer login challenge (they call this "2FA", but this is a risk-based login or anti-ATO feature, not 2FA).
2FA means 2 Factor Authentication. This works by forcing one to use two different forms of identification to authenticate, such as login/password and, in this case, identification of the computer used.
So, with all respect sir, what I'm saying is while this isn't the best 2FA, it absolutely IS 2FA by definition.
- tptacek 7y agoNo.
- rasengan 7y ago> No. Please explain which parts of my comment are false? Thank you.
- tptacek 7y agoThis feature is not 2FA, and your argument is incoherent even if you fix the terminology, because many anti-ATO systems are heuristic and intriniscally "bypassable" by design, and yet you still want services to have them. ATO is an arms race.
- rasengan 7y ago> This feature is not 2FA > anti-ATO ATO [1] is authentication by definition, but again, depending on how it's implemented, not usually the best form. [1] https://csrc.nist.gov/glossary/term/authorization-to-operate https://csrc.nist.gov/glossary/term/authorization-to-operate
- andrewflnr 7y agoAuthorization is not authentication, by definition. Furthermore, your link is talking about an entirely unrelated meaning of ATO. I believe tptacek meant it to stand for "account take-over".
- tptacek 7y agoYou're right; that's what ATO means here.
- rasengan 7y agoSame difference. Anti account take over and account authentication, because similar methods would be deployed (i.e., multifactor authentication, heuristic, etc.)
- tptacek 7y agoNo, obviously not.
- akerl_ 7y agoAt risk of pointing out the obvious, ATO (as in Authorization To Operate) has nothing to do with logging in, technical authentication, or technical authorization. An ATO is a piece of paper or equivalent that lets your business deploy a product or solution, primarily used in the government space. It’s a contract that a human/organization signs, not a part of the login process for a computer.
- strbean 7y agoThis anti-ATO mechanism is asking for a code delivered via email (something you have) in order to grant access to the account. That is authentication via an additional factor, i.e. 2FA.
- tptacek 7y agoIf you implemented this feature and called it your "2FA system", security engineers would laugh at you. It's clearly not 2FA. And, of course, Paypal has actual 2FA.