8 ms·

Or just don't reuse passwords. Two-factor authentication is largely an annoying band-aid over an easily-solvable problem. It either relies on devices and proto

by branon 6y ago

Or just don't reuse passwords. Two-factor authentication is largely an annoying band-aid over an easily-solvable problem. It either relies on devices and protocols like smartphones and SMS (which are fundamentally insecure to begin with) or requires expensive proprietary solutions like Duo. I do like hardware (U2F) keys a lot though.

majormajor 6y ago
How do you accomplish "don't reuse passwords" in practice without relying on those same devices like smartphones or computers to store your passwords?
- gruez 6y ago
  if you can't trust your computing device: pen&paper, or airgapped computer. otherwise use a password manager.
- pmiller2 6y ago
  This is a very valid question, and I'm not sure why people downvoted. The answer is that services like LastPass and OnePassword have recovery codes that you're supposed to download and save somewhere (possibly even on paper). These codes can get you into your account if you are somehow locked out of your account.
- UweSchmidt 6y ago
  Use a mnemonic that includes the name of the service or website in an algorithm. With that you never reuse passwords. Someone with other passwords of yours is likely just trying these automatically, people who would target you usually don't have your passwords from a breach elsewhere and can't figure out your password rule. It is not easy though and I find myself having to reset my passwords occasionally...
  - gruez 6y ago
    >Use a mnemonic that includes the name of the service or website in an algorithm. I'm not sure what the point of this when there are password managers available. Sure, it prevents simple credential stuffing attacks, but you're still open to sophisticated attackers deducing your passwords based on a leak. For instance, if your bank password is "correct horse battery staple chase", an sophisticated attacker might try "correct horse battery staple paypal" for your paypal account. Attackers already bruteforce common variations of passwords (eg. password -> (Password, password1, etc.), so this isn't too far fetched. Password managers with randomly generated passwords have none of these issues, and you still only need to remember one password.
    - jjnoakes 6y ago
      I'm not advocating for or against, but one big difference is that with a mnemonic you don't need access to your password manager to be able to log in somewhere.
    - hinkley 6y ago
      You'll want better mnemonics than this, but for a start: correct horse apple stable eat (c.h.a.s.e) is, I suspect, closer to the spirit of the original suggestion. Just tacking the name of the company onto the end instead of weaving it in is, as you say, pretty weak.
      - gruez 6y ago
        >correct horse apple stable eat (c.h.a.s.e) is, I suspect, closer to the spirit of the original suggestion. The nice thing about password breaches is that they're all from the same source, so you can come up with a few variations and they'll be valid for all the passwords in the breach.
    - UweSchmidt 6y ago
      Of course, that's a major weakness; if the password trick is simple to remember it is likely simple to figure out for a motivated attacker! But when there are millions of password leaked and your mnemonic-password doesn't contain "chase" or "paypal" but "chicken5" and "pony6" and has otherwise enough entropy, will the attackers stand around a whiteboard and crack your code or just run their scripts and take what they can get automatically? A password manager is probably very good, but it's a single point of failure and a huge target for the black hats; it's a program on a computer or on a smartphone that (potentially) sends data back and forth as it pleases. So maybe the idea is to use a password manager for single-use entropy and then add some mnemonic manually before submitting the password. Then it's down to keyloggers and other sophisticated attack vectors?
- branon 6y ago
  Personally? https://masterpassword.app/ https://masterpassword.app/ It's like an anti-password manager. Doesn't depend on any specific device. Essentially it's a sane implementation of what others have already discussed below, in the other child comments -- using the name of the site to derive a secure, non-reusable password.
  - linsomniac 6y ago
    I used to do this in the distant past, but gave it up because it didn't cope well with: - Sites that have different password requirements (some require special characters, some don't allow them, for example). - Changing my password on a site. I took a peek at masterpassword.app, but couldn't see that it solved these. Does it?
    - branon 6y ago
      Barely. In order with your requirements, Master Password offers: - A choice between a few different password types (numerical, short, long, complex, phrase) for picky sites. It relies on you to remember which password type you used for which site. - A counter you can increment arbitrarily to generate new passwords for a given site. Again, relies on you to remember that you're on password #3 for site X, password #5 for site Y, ... I haven't reached a point where I've had to make heavy use of these features (yet) but if you use lots of picky sites, or change passwords very often, certain limitations will become apparent. If it's any consolation, passwords generated by Master Password tend to have a unique phonetic cadence -- that is to say, once you're familiar with the first or second syllable of your password for a given site, you'll know pretty much instantly if you're looking at the right one, despite not being able to reproduce the entire string from memory. This might make it easier to increment the counter several times in quick succession while being able to conclusively discard passwords that don't "sound right". YMMV of course. If this sounds like something you'd hate to do, Master Password may not be a viable solution. The Java-based desktop app somewhat solves these issues by (optionally) caching encrypted data about your passwords (site names, password types, and counters) on disk. However this could possibly end up defeating the point of "doesn't rely on any specific device", if the user grows to become reliant on the cached data.
resfirestar 6y ago
Mitigating password reuse is far from the only purpose of MFA. If you are using any sort of SSO or account that signs in to multiple services (I think Xbox falls into this category as a Microsoft account), then it can also protect you from an attacker who steals the login info from one place and uses it to sign in to a different service. In the case of a Microsoft account, all it would take is one decent enough phish, one app storing your email credentials improperly and accidentally leaking them, or a quickly blocked malware infection that nevertheless manages to steal your password manager’s contents, and without MFA the attacker can then log in to email, Xbox, and so on.
deleted 6y ago
[deleted]
drivebycomment 6y ago
You're wrong that two-factor authentication is a band-aid or that it's trying to solve an easily solvable problem. Not reusing password doesn't provide any protection against phishing, which is as big of a threat as the server-side leaks, and for high-value targets, it's even a bigger threat. That said, 2nd factor that's not U2F are not worth it at this point with lots of issues, so indeed U2F is about the only no-compromise (security wise) 2nd factor. All other 2nd factor have serious security or availability downsides.

by branon 6y ago

majormajor 6y ago

How do you accomplish "don't reuse passwords" in practice without relying on those same devices like smartphones or computers to store your passwords?

gruez 6y ago
if you can't trust your computing device: pen&paper, or airgapped computer. otherwise use a password manager.
pmiller2 6y ago
This is a very valid question, and I'm not sure why people downvoted. The answer is that services like LastPass and OnePassword have recovery codes that you're supposed to download and save somewhere (possibly even on paper). These codes can get you into your account if you are somehow locked out of your account.
UweSchmidt 6y ago
Use a mnemonic that includes the name of the service or website in an algorithm. With that you never reuse passwords. Someone with other passwords of yours is likely just trying these automatically, people who would target you usually don't have your passwords from a breach elsewhere and can't figure out your password rule. It is not easy though and I find myself having to reset my passwords occasionally...
- gruez 6y ago
  >Use a mnemonic that includes the name of the service or website in an algorithm. I'm not sure what the point of this when there are password managers available. Sure, it prevents simple credential stuffing attacks, but you're still open to sophisticated attackers deducing your passwords based on a leak. For instance, if your bank password is "correct horse battery staple chase", an sophisticated attacker might try "correct horse battery staple paypal" for your paypal account. Attackers already bruteforce common variations of passwords (eg. password -> (Password, password1, etc.), so this isn't too far fetched. Password managers with randomly generated passwords have none of these issues, and you still only need to remember one password.
  - jjnoakes 6y ago
    I'm not advocating for or against, but one big difference is that with a mnemonic you don't need access to your password manager to be able to log in somewhere.
  - hinkley 6y ago
    You'll want better mnemonics than this, but for a start: correct horse apple stable eat (c.h.a.s.e) is, I suspect, closer to the spirit of the original suggestion. Just tacking the name of the company onto the end instead of weaving it in is, as you say, pretty weak.
    - gruez 6y ago
      >correct horse apple stable eat (c.h.a.s.e) is, I suspect, closer to the spirit of the original suggestion. The nice thing about password breaches is that they're all from the same source, so you can come up with a few variations and they'll be valid for all the passwords in the breach.
  - UweSchmidt 6y ago
    Of course, that's a major weakness; if the password trick is simple to remember it is likely simple to figure out for a motivated attacker! But when there are millions of password leaked and your mnemonic-password doesn't contain "chase" or "paypal" but "chicken5" and "pony6" and has otherwise enough entropy, will the attackers stand around a whiteboard and crack your code or just run their scripts and take what they can get automatically? A password manager is probably very good, but it's a single point of failure and a huge target for the black hats; it's a program on a computer or on a smartphone that (potentially) sends data back and forth as it pleases. So maybe the idea is to use a password manager for single-use entropy and then add some mnemonic manually before submitting the password. Then it's down to keyloggers and other sophisticated attack vectors?
branon 6y ago
Personally? https://masterpassword.app/ https://masterpassword.app/ It's like an anti-password manager. Doesn't depend on any specific device. Essentially it's a sane implementation of what others have already discussed below, in the other child comments -- using the name of the site to derive a secure, non-reusable password.
- linsomniac 6y ago
  I used to do this in the distant past, but gave it up because it didn't cope well with: - Sites that have different password requirements (some require special characters, some don't allow them, for example). - Changing my password on a site. I took a peek at masterpassword.app, but couldn't see that it solved these. Does it?
  - branon 6y ago
    Barely. In order with your requirements, Master Password offers: - A choice between a few different password types (numerical, short, long, complex, phrase) for picky sites. It relies on you to remember which password type you used for which site. - A counter you can increment arbitrarily to generate new passwords for a given site. Again, relies on you to remember that you're on password #3 for site X, password #5 for site Y, ... I haven't reached a point where I've had to make heavy use of these features (yet) but if you use lots of picky sites, or change passwords very often, certain limitations will become apparent. If it's any consolation, passwords generated by Master Password tend to have a unique phonetic cadence -- that is to say, once you're familiar with the first or second syllable of your password for a given site, you'll know pretty much instantly if you're looking at the right one, despite not being able to reproduce the entire string from memory. This might make it easier to increment the counter several times in quick succession while being able to conclusively discard passwords that don't "sound right". YMMV of course. If this sounds like something you'd hate to do, Master Password may not be a viable solution. The Java-based desktop app somewhat solves these issues by (optionally) caching encrypted data about your passwords (site names, password types, and counters) on disk. However this could possibly end up defeating the point of "doesn't rely on any specific device", if the user grows to become reliant on the cached data.

resfirestar 6y ago

Mitigating password reuse is far from the only purpose of MFA. If you are using any sort of SSO or account that signs in to multiple services (I think Xbox falls into this category as a Microsoft account), then it can also protect you from an attacker who steals the login info from one place and uses it to sign in to a different service. In the case of a Microsoft account, all it would take is one decent enough phish, one app storing your email credentials improperly and accidentally leaking them, or a quickly blocked malware infection that nevertheless manages to steal your password manager’s contents, and without MFA the attacker can then log in to email, Xbox, and so on.

deleted 6y ago

[deleted]

drivebycomment 6y ago

You're wrong that two-factor authentication is a band-aid or that it's trying to solve an easily solvable problem. Not reusing password doesn't provide any protection against phishing, which is as big of a threat as the server-side leaks, and for high-value targets, it's even a bigger threat. That said, 2nd factor that's not U2F are not worth it at this point with lots of issues, so indeed U2F is about the only no-compromise (security wise) 2nd factor. All other 2nd factor have serious security or availability downsides.