11 ms·

This is absolutely getting unwieldy to the point of being fucking ridiculous and unusable. I've been in tech for 25+ years. I'm very familiar with security, an

This is absolutely getting unwieldy to the point of being fucking ridiculous and unusable. I've been in tech for 25+ years. I'm very familiar with security, and I have the internal endurance to sit patiently and work through IT-related issues. However, at this point, there are just too many broken ways and I'm at the point of giving up. I use LastPass and if that somehow gets hacked or phished, I lose absolutely everything. I'm waiting for the next virus or phishing attempt to steal my LastPass password. I use multi-factor authentication on some accounts, but if they use SMS like many sites do, I can get my phone number stolen from me and then I lose access. I use Gmail and Google Authenticator, but if I somehow do something to piss off Google, I can lose my gmail account and access to Google Authenticator and then I'm really fucked. I've lost some gmail accounts because they will ask me for security questions when I log in with the correct password, and I don't remember them so my account gets locked, so they're gone forever. What we need is a single way to do login, MFA and security across every single site. We can't have every company incorporating their own methods. We need standardized customer support, where Tier 1 customer support can't give you access to things like credit card numbers, last 4 digits of SSN, or change passwords. Changing passwords needs to be a higher level, better trained customer support. There needs to be an ISO standard that is well thought out and implemented by all the vendors, or at least all the big vendors. If there's a standard way of doing security but also a standard way of doing customer support and what data is exposed to various levels of customer support, then social hackers can't take partial info from sites A and B, and use that to social engineer site C. This has to be simplified because it's absolutely unwieldy even for a veteran like me. There are too many ways I can get hacked and we are all just sitting ducks. The only thing protecting us is that we aren't high-value targets.

caiobegotti 6y ago
I don't know about it having to be an ISO standard but certainly it MUST be the industry equivalent of "don't roll your own crypto" but for user level authentication. This is indeed ridiculous.
vukk 6y ago
Replace your Google Authenticator TOTP with a pair of YubiKeys and the Yubikey Authenticator app. New YK models have U2F so use that when available on whatever service you're logging on. Disable all SMS auth where possible. Look into Bitwarden.
lstamour 6y ago
This is called FIDO2 and can be used for passwordless authentication as well as two-factor. It’s compatible with Windows Hello or Touch ID (in Chrome, not Safari), and there are a number of dedicated USB tokens available if you want a second factor beyond your device authenticating itself. It’s just not well-known enough on enough sites and services yet, but it exists and WebAuthN makes it easy. Outside of the browser, it has OpenSSH support but not git or pgp/gpg support. GPG (and by extension git) don’t support very many security technologies... Windows Hello and CryptoKit are solutions but rarely implemented yet. Perhaps this will change over the next decade as hardware-based security authentication supplements or replaces soft- or password-based authentication.... Touch ID on phone apps can show how it’s done...
- jjoonathan 6y ago
  Agreed, FIDO2 is the way. It hit a huge maturity milestone last year when the last major browser/OS combination got support for USB keys by default. Now the user story is "insert key, boop button." It's intuitive enough for my parents to understand, it's easy enough to habitually use, and the security is a big step up.
- est31 6y ago
  While I agree that FIDO2 is great, especially far more secure than SMS based 2fA, people will still lose their FIDO2 sticks, they will still get stolen. And there will still be stories of people getting into accounts by pretending to be you to support.
  - lstamour 6y ago
    You should always register more than one, and services should accept or require more than one, ideally. Google Advanced Protection shows how it could be done for extra security-conscious users though it does not, itself, use FIDO2 yet, I believe it’s still on an older iteration, U2F? The best article I’ve found to explain USB security keys has so far been https://paulstamatiou.com/getting-started-with-security-keys/ https://paulstamatiou.com/getting-started-with-security-keys... but it’s ... very long.
calvinmorrison 6y ago
U2F and other hardware devices!
- thephyber 6y ago
  I've had YubiKeys + OTP software apps for years, but the industry of web apps is still too fractured and not enough devices + browsers + websites support it.
judge2020 6y ago
> and access to Google Authenticator and then I'm really fucked Unless it was changed, GA is one of the few apps that doesn't sync with Google nor require a Google account to use.
- thephyber 6y ago
  Inversely, though, many apps like $authenticatorApp are tied to the specific phone (possibly storing a necessary data in the phone's secret enclave), not the account. For example when I upgraded to the newest $smartphone, all of my accounts with only $OTPApp2FA were unable to 2FA. I had to request 2FA resets from my account rep and configure the accounts to work with the new phone. I'm much happier doing this than risking having a phone number hijack due to a $cellCarrier employee maliciously or negligently transferring my phone number to a malicious user, but it's not easy for me to remember to do all of these security steps, let alone someone who doesn't work in the cybersecurity industry. There's no way in hell my parents could do this.
  - jsnell 6y ago
    Google Authenticator got an update a couple of months ago to allow account tranfers to a new phone.
    - thephyber 6y ago
      I was actually talking about the class of apps (Google Authenticator, Authy, Okta Verify, Yubico Authenticator), but good to know!
    - wonderlg 6y ago
      I don’t see any such option on the iPhone. Also it’s a problem if you lose your phone before you make any transfer. The previous answer made me think a bit more seriously about those reset codes that are lying around (maybe?) my computer. I’m a digital native and digital lives are still so hard even for me; no wonder regular people just nope out of it.
rsync 6y ago
"This is absolutely getting unwieldy to the point of being fucking ridiculous and unusable." Agreed. The worst part, in my opinion, is the penchant of sites/providers to demand a phone number any phone number as an identity mechanism. Which is to say, there is no way to tie this number I have just entered to my personal identity in any way, or to verify that it has any relationship with me ... but as long as I successfully enter any mobile number I pass with flying colors.
- jsnell 6y ago
  The value of asking for an arbitrary phone number is as a challenge of last resort. Let's say that you have given the provider no useful second factor, so the account is potentially quite vulnerable to credential stuffing The phone number acts as a mechanism for rate limiting and imposing an economic cost on attackers. To hijack accounts at bulk, you also need to procure phone numbers in similar quantities. The cost of a phone number is low, but so is the value of the average hijacked account.
  - tjoff 6y ago
    It is for marketing reasons.
    - paulryanrogers 6y ago
      It can be for more than one reason
      - tjoff 6y ago
        But the latter disqualifies it for the former.
  - RNCTX 6y ago
    The cost of google voice is free. If you go post something on craigslist and show your phone number as a contact method, I guarantee you that you will soon get spammed by google 2FA notifications. Around me they seem to be primarily set to a Vietnamese language. I live in the same city as the AT&T headquarters. AT&T and Google could also have systems to help prevent these scams, for instance I could specify the languages I speak and if SMS messages arrive in a different language, they could allow me an SMS command to flag a sender as the trigger-er of the phishing attempt. However, AT&T could also make a phone app for billing that loads menus in less than 30 seconds to a minute, and considering they've done neither I suppose I'll take the billing app first since it gets more use than craigslist does. After all, we only pay them 60 dollars a month for a phone and another 60-100 dollars a month for DSL for quite literally decades, so I wouldn't want to strain them by requesting too much in the way of a basic level of service.
saulrh 6y ago
Re: Google Authenticator, I've started grabbing the TOTP secrets and storing those in backups. Download the QR code and decode it to get a string like the following: otpauth://totp/Domain%3Ayour%40email.com?secret=HXDMVJECJJWSRB3H&issuer=Domain That "secret" field is the only thing that TOTP actually cares about, and any app that supports TOTP will happily ingest the secret and provide 2FA codes.
- thephyber 6y ago
  Whoa. TIL https://github.com/google/google-authenticator/wiki/Key-Uri-Format https://github.com/google/google-authenticator/wiki/Key-Uri-...
  - bigiain 6y ago
    Yep - it's really useful to know that structure for services who don't bother properly identifying themselves with the issuer parameter in their QR codes so they end up in apps like Authenticator without enough descriptive context to be easily found (I'm looking at you Dropbox and Github!)
- realusername 6y ago
  that's also what I do, I store in "pass" the the password itself but also the TOTP secret in case my phone will be lost at some point.
- bigiain 6y ago
  Careful with those backups though. You should probably treat your TOTP secrets as password-equivalents. I grab all my QR codes or secrets, but I store them in 1Password so they're strongly encrypted in my backups.
  - saulrh 6y ago
    Agreed. They live in BitWarden right next to the passwords. I lose some security, since compromising my password manager now also compromises my 2FA, but the password manager is itself behind 2FA, a Yubikey, and its backup codes are on paper in my safe.
thephyber 6y ago
I generally agree, but I do see cause to believe there is the possibility of light at the end of the tunnel. Microsoft is starting to push passwordless features for Windows and online accounts. YubiKeys and OTP apps are pretty common (hopefully there will be more standardization and less fracturing of those features). OAUTH2 is mature and Google/Facebook/GitHub/etc all work decently as providers. Although I wish a single government entity would replace those OAUTH providers. I can't get banned by my state like I can get banned by Google for ToS violations, so I'm wary of creating a federated auth account unless I'm certain I can't lose access to the root account without necessarily losing access to the subservient accounts. The obvious downside is that dissidents and criminals are easily identified, but that's an offline problem as well as an online.
closeparen 6y ago
Some of the arguments often seen on HN against "solving" identity: - The inconsistent, chaotic patchwork of ID systems is more resilient than a monoculture, and definitely more resilient than a centralized solution. - The gaps provide necessary cover for people who need to hide. - Doubt usually plays in the little guy's favor. The bank eats the loss when it can't prove the debt is yours. Copyright lawsuit fails when it could have been anyone at that IP address. - The difficulty of strong ID verification is what keeps it from being used gratuitously. A PKI or SSO provider that's too good will soon be required for every little thing. - Customer identity is something a business should own, not rent.
- perl4ever 6y ago
  Also: - SSN is great and works well for everything.
  - paranoidrobot 6y ago
    I hope that's sarcasm. It's a very US-Centric view of the world.
    - perl4ever 6y ago
      It is sarcasm.
  - nneonneo 6y ago
    You laugh, but in China, your national ID card is used for nearly everything important, and then your WeChat account or phone number is used for everything else. Almost all logins are done through SMS verification or WeChat login (no passwords in many cases), and your WeChat and phone numbers chain back up to your national ID card. It turns out that you can completely centralize ID and authentication, provided you have a government which is mercilessly willing to violate your privacy...
    - Mirioron 6y ago
      And the downside is as was mentioned above: it's required for everything and there will always be a trail that can be traced back to you.
tgsovlerkhgsel 6y ago
> lose my gmail account and access to Google Authenticator Google Authenticator is not tied to your account. Unless you lose your phone at the same time (or have remote wipe enabled and someone who gets your Google account wipes it), your Gmail account is not tied to access to Authenticator. You should also backup authenticator codes on paper in a safe place. > What we need is a single way to do login, MFA and security across every single site. This. U2F could be it, but even the vendors that implement it often implement it poorly (e.g. not allowing multiple tokens).
pwdisswordfish2 6y ago
It is interesting to me that we do not see the same complaints regarding a single way to do login for every single site for administration. Every site has to be administered, most of them are probably capable of being administered remotely and I would bet almost every single one uses SSH in some capacity to do that. Comparing that to the clusterfxxx of security theatre on the user side, it is quite an interesting contrast. I can login to a server as an administrator via SSH without disclosing any personal details but if I try to login to a server as a user, I am asked to disclose all manner of personal information and yet at the same time the requesting party takes no legal responsibility for what might happen as a result of complying with their requests. (They only try to instill fear of what might happen if we do not comply.)
slaymaker1907 6y ago
KeepassXC supports TOTP and with a nice compatible app for mobile, that is one way to do MFA in a way that is more resilient to data loss as opposed to Google Authenticator which might get shutdown without too much notice. Plus, Keepass let’s you choose how to distribute your vault whether you want to do it manually via email or something or via cloud storage. Even if you do cloud storage, it is very easy to backup in case something happens with the cloud storage.
perl4ever 6y ago
I have lost the ability to log in to my original gmail account, so I advise planning for that to happen some day. What happened to me is that I went to reset my password one day, and they required I confirm my backup email which I no longer had access to. Even though I had access to read messages sent to the gmail account itself, and I had access to the phone number connected to my gmail account, without my backup email as well, I could not get anywhere. The recovery procedure that asks you questions didn't get me anywhere either, because I couldn't possibly answer things like exactly when I started using gmail due to using it for too long. And I even had an archive of a few years of my email, that ought to have enabled me to answer the other questions, but it didn't work and there is no feedback nor escalation procedure. I may well still be logged in due to a certain buggy/obsolete device I have; I think it's probably been five years, but I don't believe I will ever be able to log in or reset my password again. It didn't have a great deal of impact on my life in the sense that I was able to simply switch to a new email account, but I feel a certain sense of loss at not being able to use the one and only address that was my full name. More significantly, it indelibly engraved in my mind, the kafkaesque, diabolical nature of Google, the ingrained lack of customer service, the way in which, while they may mostly be geniuses, when they screw up, they won't admit it and there's no appeal. The thing that I object to on an emotional and logical level, is that adding a backup authentication method removed the ability to use the primary authentication methods. If I just never added the backup email I'd be fine! I can't accept that makes sense, that it adds security. Something the user does to make them safer should not make them less safe.
- toast0 6y ago
  If you can still read the email, you can likely find the first couple emails and use that to guess when you signed up?
  - perl4ever 6y ago
    Do you have ~15 year old emails available in gmail? I don't think my earliest emails are available at all, I may well have deleted them, but even if they were, the device that remained logged in is over a decade old, uses POP or IMAP or something and barely functions. Not the gmail web interface, that's out of reach. I wonder if signing up for Google One, which apparently comes with support, would possibly get access to a real person who could resolve the issue?
chrismarlow9 6y ago
Paper trails is my biggest concern. Far too much PII data gets slung around emails and is sitting in 'Sent' folders waiting for the pillaging. I'm concerned because I can't do anything about this with regards to doctors/employers/gov. I mean how many times have you been left alone in a doctors office with a computer just sitting there with connections/inputs exposed. I am 0% shocked at the large scale retail data theft that gained steam a few years ago.
u801e 6y ago
> What we need is a single way to do login, MFA and security across every single site. The way to do that is to use a client-side certificate in combination with a username/password for authentication. When I create an account on a website, these are the steps I should have to follow: 1. Choose a username and password 2. Upload a CSR 3. Get the client-side certificate 4. Add it to my local certificate store When I log in, I should have to follow these steps 1. My client automatically chooses the correct client certificate to send based on the server certificate 2. If I need a passphrase to decrypt my private key, I enter it at a prompt 3. The server verifies the certificate the client sent against whatever CA they use 4. I enter my username/password 5. My credentials are verified and I'm logged in. I shouldn't have to provide my phone number or email address as a second factor because those factors aren't under my control. The private key associated with the client certificate is under my control.
- quadrifoliate 6y ago
  How do you distinguish an attacker who has compromised your username and password from a hard drive failure on your laptop that made you lose the client certificate? In both cases you (or the attacker) have the username and password, but not the client certificate. They can upload a new CSR just as well as you, but at that point it's theater. This is the main problem any such solution has to solve (IMO) to be better than the hodgepodge of 2FA methods that we currently have. Humans are fallible and will likely not maintain proper backups and such.
  - u801e 6y ago
    After creating the account, you should be able to get more client certificates associated with your account (while logged in on the first device) by sending more CSRs generated from other devices and then add them to the respective device's certificate store. If you don't do that and lose the certificate and private key, then you lose access to the account. You should not be able to log into the account without both the client certificate and the username/password. The procedure I described earlier would be for accounts like HN or reddit. If this was an account with a government agency, bank, or credit card company, then the part where you generate a CSR and get a certificate would be done at an office where they verify your identity (drivers license, passport, etc). In the latter case, if you lose your certificate, then you need to go back and repeat the procedure to get a new one. > Humans are fallible and will likely not maintain proper backups and such. While that's true, we really ought to sacrifice some convenience for better security. If a user fails to maintain proper backups or register multiple devices for an account, then the inconvenience of losing their account and going to the arduous process of creating a new one is on them. They shouldn't put the lack of security burden on us by having companies engage in security theater like MFA (i.e., SMS or email based second factor) because they want convenience over actual security. That said, those users could opt out of MFA and just rely on their username/password for authentication. Those of us who want MFA could use the client-side TLS certificate in combination with the username/password and keep our account secure.
jimmaswell 6y ago
> I've lost some gmail accounts because they will ask me for security questions when I log in with the correct password, and I don't remember them so my account gets locked, so they're gone forever. Oddly for me it seemed like as time went by I had a better chance of recovering old gmail accounts with spurious remembered information, like the algorithm thinks the longer nobody's in it the more likely you're the owner trying to get in. This was ~10 years ago though.
MrBuddyCasino 6y ago
This sounds like something your ID card would be suited for, German ones already support NFC and can used to authenticate against government websites. Of course that would eliminate anonymity, which would be horrible, but maybe ok for Gmail where people use their real names anyway. But in the event of loss of ID card or identity theft, there is a trusted instance (the government) that can block old ones and issue new ones. This could be used as a reliable way to rotate a 2FA key, because some unique number attached to a citizen won’t change.
- Mirioron 6y ago
  The worry is that if systems like this become widespread enough then they'll simply be required just like phone numbers are. The website will pinky promise you that they won't sell your data. Not to mention that now the government can just request access to all of your accounts on all of these services, because they know you had to use your ID.
MrStonedOne 6y ago
authy is basically the only sane way to do 2fa. Clonable, backupable, encrypted on disk and in cloud sync. I have it on my phone, laptop, and desktop.
artistsvoid 6y ago
I doubt a 'standard' how to do it can be independently developed and implemented. I use a non web-based password manager, a backup strategy that makes sense, and have a secure setup with regard to my threat level. And with regards to your fear from Google: Short from full-on identify theft I have a controversial solution: E-Mail is something one should pay for. E-Mail is essential ; the one thing you can use to pretty much sign up for everything, the one thing to use to reset passwords ; the one form of communication which is open, readily accessible to almost everyone, crosses borders, doesn't ask for fees, doesn't need a specific app, et cetera I once lost my complete password database (if you sense irony here, it was a long time ago, and I was being stupid), including my E-Mail password, no 2FA set up, nothing. I was completely locked out, but: since I paid for the service: I could open a ticket, I could get a human(!) within a short time frame who actively assisted and I could proof my identify via easy means. I was greeted with empathy, we could work with whatever I knew about the account and related information. There was no ridiculous meaningless questionnaire, no support ticket answered by some volunteer moderators. I was dealing with someone from staff who knew what they were doing, and we worked it out quickly. Not saying it would have been impossible to restore access to a Gmail Account, but at the very least it would have been incredibly more painful, I am sure of that much.
soupsranjan 6y ago
Account recovery is a completely underserved problem today and many companies don't have a well thought through solution. Many rely on Knowledge Based Authentication questions that can be found easily by an attacker who has access to your email. To solve for cases where someone has lost all factors (forgot password, lost access to email, lost phone number), we need a brand new way of thinking about solutions. Hit me up if anyone's interested in brainstorming on the same!
yangwuzrite 6y ago
I'm an oldtimer like you. It's worse than you're even alluding to. I recently purchased a Yubikey with the intention of securing as many accounts as I could with FIDO2 and U2F. Literally the only service I could secure fully with the key was Google. Google was the ONLY service that supports FIDO2 on both the desktop and mobile (using the Yubikey 5Ci with the lightning connector). Everything else was a hodgepodge mess of two factor options: Twitter: FIDO2 on desktop only, needs TOTP fallback for mobile. Recovery keys for backup. Facebook: FIDO2 on desktop only, need TOTP fallback for mobile. Recovery keys for backup. LastPass: TOTP or YubiOTP only, email to recover. ProtonMail: TOTP only, recovery keys as backup. US Bank 1: TOTP via their app only, email and SMS as backup. Recovery by customer service US Bank 2: Email only, recovery by customer service. DE Bank: PhotoTAN only, recovery by customer service & postal mail. US Investment Firm 1: Symantec VIP only, email as backup US Investment Firm 2: Email only Reddit: TOTP only, recovery codes as backup. Amazon: TOTP only, SMS as backup Duo: FIDO2 on desktop and mobile, but lack of support for embedded browsers means I need to have HTOP or push as a fallback for some applications on both platforms. For the services that have recovery keys, I have them in an envelope I keep in my gun safe as well as a PGP-encrypted text file on my computer. I didn't store the TOTP secrets separately, although I probably will next time I re-enroll everything because my Yubikey physically fell apart a month after using it (a common thing with the first batch of 5Cis from what I gather) and I had to move everything back over to TOTP codes. It's not just the standard for 2FA, it's everything from the bottom up. The 2FA tool, how backups work, how recovery works. It's a complete hodge-podge mess and and, like you mentioned, if it's this big of a pain in the ass for an experienced tech guy, how am I supposed to, in good conscience, recommend this stuff to my non-techie friends?
- berdario 6y ago
  FWIW, Facebook, Dropbox and Github use Fido2 just fine on mobile (Chrome browser). You don't need the TOTP fallback for Facebook on mobile browser (though annoyingly they'll still always send you the code via SMS, if you haven't disabled). I suppose it's possible that their app has issues with FIDO2, and maybe that's why you had to fallback to TOTP. But yeah, 4 services (including Google), out of all the ones that I use... The track record for supporting FIDO2 is underwhelming. It's especially annoying that you cannot set up backup FIDO2 keys in AWS, which means that I won't rely on it.
som33 6y ago
>There needs to be an ISO standard that is well thought out and implemented by all the vendors We don't need any more standards, we need to fix copyright law and get property rights for software. You don't have security risks or the attack surface with local applications. Corporations have done their damnedest to try to kill local apps and move them onto their servers. If we want real security we need to go after microsoft and software companies for trying to force applications online. You won't have a security crisis if apps aren't constantly opening ports and communicating with remote machines to begin with. The whole idea of having our PC's constantly shuffling data back and forth just so software companies can "prevent piracy" is bullshit, our basic right to privacy and owning the things we buy are being infringed on, on a mass scale.

caiobegotti 6y ago

I don't know about it having to be an ISO standard but certainly it MUST be the industry equivalent of "don't roll your own crypto" but for user level authentication. This is indeed ridiculous.

vukk 6y ago

Replace your Google Authenticator TOTP with a pair of YubiKeys and the Yubikey Authenticator app. New YK models have U2F so use that when available on whatever service you're logging on. Disable all SMS auth where possible. Look into Bitwarden.

lstamour 6y ago

This is called FIDO2 and can be used for passwordless authentication as well as two-factor. It’s compatible with Windows Hello or Touch ID (in Chrome, not Safari), and there are a number of dedicated USB tokens available if you want a second factor beyond your device authenticating itself. It’s just not well-known enough on enough sites and services yet, but it exists and WebAuthN makes it easy. Outside of the browser, it has OpenSSH support but not git or pgp/gpg support. GPG (and by extension git) don’t support very many security technologies... Windows Hello and CryptoKit are solutions but rarely implemented yet. Perhaps this will change over the next decade as hardware-based security authentication supplements or replaces soft- or password-based authentication.... Touch ID on phone apps can show how it’s done...

jjoonathan 6y ago
Agreed, FIDO2 is the way. It hit a huge maturity milestone last year when the last major browser/OS combination got support for USB keys by default. Now the user story is "insert key, boop button." It's intuitive enough for my parents to understand, it's easy enough to habitually use, and the security is a big step up.
est31 6y ago
While I agree that FIDO2 is great, especially far more secure than SMS based 2fA, people will still lose their FIDO2 sticks, they will still get stolen. And there will still be stories of people getting into accounts by pretending to be you to support.
- lstamour 6y ago
  You should always register more than one, and services should accept or require more than one, ideally. Google Advanced Protection shows how it could be done for extra security-conscious users though it does not, itself, use FIDO2 yet, I believe it’s still on an older iteration, U2F? The best article I’ve found to explain USB security keys has so far been https://paulstamatiou.com/getting-started-with-security-keys/ https://paulstamatiou.com/getting-started-with-security-keys... but it’s ... very long.

calvinmorrison 6y ago

U2F and other hardware devices!

thephyber 6y ago
I've had YubiKeys + OTP software apps for years, but the industry of web apps is still too fractured and not enough devices + browsers + websites support it.

judge2020 6y ago

> and access to Google Authenticator and then I'm really fucked Unless it was changed, GA is one of the few apps that doesn't sync with Google nor require a Google account to use.

thephyber 6y ago
Inversely, though, many apps like $authenticatorApp are tied to the specific phone (possibly storing a necessary data in the phone's secret enclave), not the account. For example when I upgraded to the newest $smartphone, all of my accounts with only $OTPApp2FA were unable to 2FA. I had to request 2FA resets from my account rep and configure the accounts to work with the new phone. I'm much happier doing this than risking having a phone number hijack due to a $cellCarrier employee maliciously or negligently transferring my phone number to a malicious user, but it's not easy for me to remember to do all of these security steps, let alone someone who doesn't work in the cybersecurity industry. There's no way in hell my parents could do this.
- jsnell 6y ago
  Google Authenticator got an update a couple of months ago to allow account tranfers to a new phone.
  - thephyber 6y ago
    I was actually talking about the class of apps (Google Authenticator, Authy, Okta Verify, Yubico Authenticator), but good to know!
  - wonderlg 6y ago
    I don’t see any such option on the iPhone. Also it’s a problem if you lose your phone before you make any transfer. The previous answer made me think a bit more seriously about those reset codes that are lying around (maybe?) my computer. I’m a digital native and digital lives are still so hard even for me; no wonder regular people just nope out of it.

rsync 6y ago

"This is absolutely getting unwieldy to the point of being fucking ridiculous and unusable." Agreed. The worst part, in my opinion, is the penchant of sites/providers to demand a phone number any phone number as an identity mechanism. Which is to say, there is no way to tie this number I have just entered to my personal identity in any way, or to verify that it has any relationship with me ... but as long as I successfully enter any mobile number I pass with flying colors.

jsnell 6y ago
The value of asking for an arbitrary phone number is as a challenge of last resort. Let's say that you have given the provider no useful second factor, so the account is potentially quite vulnerable to credential stuffing The phone number acts as a mechanism for rate limiting and imposing an economic cost on attackers. To hijack accounts at bulk, you also need to procure phone numbers in similar quantities. The cost of a phone number is low, but so is the value of the average hijacked account.
- tjoff 6y ago
  It is for marketing reasons.
  - paulryanrogers 6y ago
    It can be for more than one reason
    - tjoff 6y ago
      But the latter disqualifies it for the former.
- RNCTX 6y ago
  The cost of google voice is free. If you go post something on craigslist and show your phone number as a contact method, I guarantee you that you will soon get spammed by google 2FA notifications. Around me they seem to be primarily set to a Vietnamese language. I live in the same city as the AT&T headquarters. AT&T and Google could also have systems to help prevent these scams, for instance I could specify the languages I speak and if SMS messages arrive in a different language, they could allow me an SMS command to flag a sender as the trigger-er of the phishing attempt. However, AT&T could also make a phone app for billing that loads menus in less than 30 seconds to a minute, and considering they've done neither I suppose I'll take the billing app first since it gets more use than craigslist does. After all, we only pay them 60 dollars a month for a phone and another 60-100 dollars a month for DSL for quite literally decades, so I wouldn't want to strain them by requesting too much in the way of a basic level of service.

saulrh 6y ago

Re: Google Authenticator, I've started grabbing the TOTP secrets and storing those in backups. Download the QR code and decode it to get a string like the following: otpauth://totp/Domain%3Ayour%40email.com?secret=HXDMVJECJJWSRB3H&issuer=Domain That "secret" field is the only thing that TOTP actually cares about, and any app that supports TOTP will happily ingest the secret and provide 2FA codes.

thephyber 6y ago
Whoa. TIL https://github.com/google/google-authenticator/wiki/Key-Uri-Format https://github.com/google/google-authenticator/wiki/Key-Uri-...
- bigiain 6y ago
  Yep - it's really useful to know that structure for services who don't bother properly identifying themselves with the issuer parameter in their QR codes so they end up in apps like Authenticator without enough descriptive context to be easily found (I'm looking at you Dropbox and Github!)
realusername 6y ago
that's also what I do, I store in "pass" the the password itself but also the TOTP secret in case my phone will be lost at some point.
bigiain 6y ago
Careful with those backups though. You should probably treat your TOTP secrets as password-equivalents. I grab all my QR codes or secrets, but I store them in 1Password so they're strongly encrypted in my backups.
- saulrh 6y ago
  Agreed. They live in BitWarden right next to the passwords. I lose some security, since compromising my password manager now also compromises my 2FA, but the password manager is itself behind 2FA, a Yubikey, and its backup codes are on paper in my safe.

thephyber 6y ago

I generally agree, but I do see cause to believe there is the possibility of light at the end of the tunnel. Microsoft is starting to push passwordless features for Windows and online accounts. YubiKeys and OTP apps are pretty common (hopefully there will be more standardization and less fracturing of those features). OAUTH2 is mature and Google/Facebook/GitHub/etc all work decently as providers. Although I wish a single government entity would replace those OAUTH providers. I can't get banned by my state like I can get banned by Google for ToS violations, so I'm wary of creating a federated auth account unless I'm certain I can't lose access to the root account without necessarily losing access to the subservient accounts. The obvious downside is that dissidents and criminals are easily identified, but that's an offline problem as well as an online.

closeparen 6y ago

Some of the arguments often seen on HN against "solving" identity: - The inconsistent, chaotic patchwork of ID systems is more resilient than a monoculture, and definitely more resilient than a centralized solution. - The gaps provide necessary cover for people who need to hide. - Doubt usually plays in the little guy's favor. The bank eats the loss when it can't prove the debt is yours. Copyright lawsuit fails when it could have been anyone at that IP address. - The difficulty of strong ID verification is what keeps it from being used gratuitously. A PKI or SSO provider that's too good will soon be required for every little thing. - Customer identity is something a business should own, not rent.

perl4ever 6y ago
Also: - SSN is great and works well for everything.
- paranoidrobot 6y ago
  I hope that's sarcasm. It's a very US-Centric view of the world.
  - perl4ever 6y ago
    It is sarcasm.
- nneonneo 6y ago
  You laugh, but in China, your national ID card is used for nearly everything important, and then your WeChat account or phone number is used for everything else. Almost all logins are done through SMS verification or WeChat login (no passwords in many cases), and your WeChat and phone numbers chain back up to your national ID card. It turns out that you can completely centralize ID and authentication, provided you have a government which is mercilessly willing to violate your privacy...
  - Mirioron 6y ago
    And the downside is as was mentioned above: it's required for everything and there will always be a trail that can be traced back to you.

tgsovlerkhgsel 6y ago

> lose my gmail account and access to Google Authenticator Google Authenticator is not tied to your account. Unless you lose your phone at the same time (or have remote wipe enabled and someone who gets your Google account wipes it), your Gmail account is not tied to access to Authenticator. You should also backup authenticator codes on paper in a safe place. > What we need is a single way to do login, MFA and security across every single site. This. U2F could be it, but even the vendors that implement it often implement it poorly (e.g. not allowing multiple tokens).

pwdisswordfish2 6y ago

It is interesting to me that we do not see the same complaints regarding a single way to do login for every single site for administration. Every site has to be administered, most of them are probably capable of being administered remotely and I would bet almost every single one uses SSH in some capacity to do that. Comparing that to the clusterfxxx of security theatre on the user side, it is quite an interesting contrast. I can login to a server as an administrator via SSH without disclosing any personal details but if I try to login to a server as a user, I am asked to disclose all manner of personal information and yet at the same time the requesting party takes no legal responsibility for what might happen as a result of complying with their requests. (They only try to instill fear of what might happen if we do not comply.)

slaymaker1907 6y ago

KeepassXC supports TOTP and with a nice compatible app for mobile, that is one way to do MFA in a way that is more resilient to data loss as opposed to Google Authenticator which might get shutdown without too much notice. Plus, Keepass let’s you choose how to distribute your vault whether you want to do it manually via email or something or via cloud storage. Even if you do cloud storage, it is very easy to backup in case something happens with the cloud storage.

perl4ever 6y ago

I have lost the ability to log in to my original gmail account, so I advise planning for that to happen some day. What happened to me is that I went to reset my password one day, and they required I confirm my backup email which I no longer had access to. Even though I had access to read messages sent to the gmail account itself, and I had access to the phone number connected to my gmail account, without my backup email as well, I could not get anywhere. The recovery procedure that asks you questions didn't get me anywhere either, because I couldn't possibly answer things like exactly when I started using gmail due to using it for too long. And I even had an archive of a few years of my email, that ought to have enabled me to answer the other questions, but it didn't work and there is no feedback nor escalation procedure. I may well still be logged in due to a certain buggy/obsolete device I have; I think it's probably been five years, but I don't believe I will ever be able to log in or reset my password again. It didn't have a great deal of impact on my life in the sense that I was able to simply switch to a new email account, but I feel a certain sense of loss at not being able to use the one and only address that was my full name. More significantly, it indelibly engraved in my mind, the kafkaesque, diabolical nature of Google, the ingrained lack of customer service, the way in which, while they may mostly be geniuses, when they screw up, they won't admit it and there's no appeal. The thing that I object to on an emotional and logical level, is that adding a backup authentication method removed the ability to use the primary authentication methods. If I just never added the backup email I'd be fine! I can't accept that makes sense, that it adds security. Something the user does to make them safer should not make them less safe.

toast0 6y ago
If you can still read the email, you can likely find the first couple emails and use that to guess when you signed up?
- perl4ever 6y ago
  Do you have ~15 year old emails available in gmail? I don't think my earliest emails are available at all, I may well have deleted them, but even if they were, the device that remained logged in is over a decade old, uses POP or IMAP or something and barely functions. Not the gmail web interface, that's out of reach. I wonder if signing up for Google One, which apparently comes with support, would possibly get access to a real person who could resolve the issue?

chrismarlow9 6y ago

Paper trails is my biggest concern. Far too much PII data gets slung around emails and is sitting in 'Sent' folders waiting for the pillaging. I'm concerned because I can't do anything about this with regards to doctors/employers/gov. I mean how many times have you been left alone in a doctors office with a computer just sitting there with connections/inputs exposed. I am 0% shocked at the large scale retail data theft that gained steam a few years ago.

u801e 6y ago

> What we need is a single way to do login, MFA and security across every single site. The way to do that is to use a client-side certificate in combination with a username/password for authentication. When I create an account on a website, these are the steps I should have to follow: 1. Choose a username and password 2. Upload a CSR 3. Get the client-side certificate 4. Add it to my local certificate store When I log in, I should have to follow these steps 1. My client automatically chooses the correct client certificate to send based on the server certificate 2. If I need a passphrase to decrypt my private key, I enter it at a prompt 3. The server verifies the certificate the client sent against whatever CA they use 4. I enter my username/password 5. My credentials are verified and I'm logged in. I shouldn't have to provide my phone number or email address as a second factor because those factors aren't under my control. The private key associated with the client certificate is under my control.

quadrifoliate 6y ago
How do you distinguish an attacker who has compromised your username and password from a hard drive failure on your laptop that made you lose the client certificate? In both cases you (or the attacker) have the username and password, but not the client certificate. They can upload a new CSR just as well as you, but at that point it's theater. This is the main problem any such solution has to solve (IMO) to be better than the hodgepodge of 2FA methods that we currently have. Humans are fallible and will likely not maintain proper backups and such.
- u801e 6y ago
  After creating the account, you should be able to get more client certificates associated with your account (while logged in on the first device) by sending more CSRs generated from other devices and then add them to the respective device's certificate store. If you don't do that and lose the certificate and private key, then you lose access to the account. You should not be able to log into the account without both the client certificate and the username/password. The procedure I described earlier would be for accounts like HN or reddit. If this was an account with a government agency, bank, or credit card company, then the part where you generate a CSR and get a certificate would be done at an office where they verify your identity (drivers license, passport, etc). In the latter case, if you lose your certificate, then you need to go back and repeat the procedure to get a new one. > Humans are fallible and will likely not maintain proper backups and such. While that's true, we really ought to sacrifice some convenience for better security. If a user fails to maintain proper backups or register multiple devices for an account, then the inconvenience of losing their account and going to the arduous process of creating a new one is on them. They shouldn't put the lack of security burden on us by having companies engage in security theater like MFA (i.e., SMS or email based second factor) because they want convenience over actual security. That said, those users could opt out of MFA and just rely on their username/password for authentication. Those of us who want MFA could use the client-side TLS certificate in combination with the username/password and keep our account secure.

jimmaswell 6y ago

> I've lost some gmail accounts because they will ask me for security questions when I log in with the correct password, and I don't remember them so my account gets locked, so they're gone forever. Oddly for me it seemed like as time went by I had a better chance of recovering old gmail accounts with spurious remembered information, like the algorithm thinks the longer nobody's in it the more likely you're the owner trying to get in. This was ~10 years ago though.

MrBuddyCasino 6y ago

This sounds like something your ID card would be suited for, German ones already support NFC and can used to authenticate against government websites. Of course that would eliminate anonymity, which would be horrible, but maybe ok for Gmail where people use their real names anyway. But in the event of loss of ID card or identity theft, there is a trusted instance (the government) that can block old ones and issue new ones. This could be used as a reliable way to rotate a 2FA key, because some unique number attached to a citizen won’t change.

Mirioron 6y ago
The worry is that if systems like this become widespread enough then they'll simply be required just like phone numbers are. The website will pinky promise you that they won't sell your data. Not to mention that now the government can just request access to all of your accounts on all of these services, because they know you had to use your ID.

MrStonedOne 6y ago

authy is basically the only sane way to do 2fa. Clonable, backupable, encrypted on disk and in cloud sync. I have it on my phone, laptop, and desktop.

artistsvoid 6y ago

I doubt a 'standard' how to do it can be independently developed and implemented. I use a non web-based password manager, a backup strategy that makes sense, and have a secure setup with regard to my threat level. And with regards to your fear from Google: Short from full-on identify theft I have a controversial solution: E-Mail is something one should pay for. E-Mail is essential ; the one thing you can use to pretty much sign up for everything, the one thing to use to reset passwords ; the one form of communication which is open, readily accessible to almost everyone, crosses borders, doesn't ask for fees, doesn't need a specific app, et cetera I once lost my complete password database (if you sense irony here, it was a long time ago, and I was being stupid), including my E-Mail password, no 2FA set up, nothing. I was completely locked out, but: since I paid for the service: I could open a ticket, I could get a human(!) within a short time frame who actively assisted and I could proof my identify via easy means. I was greeted with empathy, we could work with whatever I knew about the account and related information. There was no ridiculous meaningless questionnaire, no support ticket answered by some volunteer moderators. I was dealing with someone from staff who knew what they were doing, and we worked it out quickly. Not saying it would have been impossible to restore access to a Gmail Account, but at the very least it would have been incredibly more painful, I am sure of that much.

soupsranjan 6y ago

Account recovery is a completely underserved problem today and many companies don't have a well thought through solution. Many rely on Knowledge Based Authentication questions that can be found easily by an attacker who has access to your email. To solve for cases where someone has lost all factors (forgot password, lost access to email, lost phone number), we need a brand new way of thinking about solutions. Hit me up if anyone's interested in brainstorming on the same!

yangwuzrite 6y ago

I'm an oldtimer like you. It's worse than you're even alluding to. I recently purchased a Yubikey with the intention of securing as many accounts as I could with FIDO2 and U2F. Literally the only service I could secure fully with the key was Google. Google was the ONLY service that supports FIDO2 on both the desktop and mobile (using the Yubikey 5Ci with the lightning connector). Everything else was a hodgepodge mess of two factor options: Twitter: FIDO2 on desktop only, needs TOTP fallback for mobile. Recovery keys for backup. Facebook: FIDO2 on desktop only, need TOTP fallback for mobile. Recovery keys for backup. LastPass: TOTP or YubiOTP only, email to recover. ProtonMail: TOTP only, recovery keys as backup. US Bank 1: TOTP via their app only, email and SMS as backup. Recovery by customer service US Bank 2: Email only, recovery by customer service. DE Bank: PhotoTAN only, recovery by customer service & postal mail. US Investment Firm 1: Symantec VIP only, email as backup US Investment Firm 2: Email only Reddit: TOTP only, recovery codes as backup. Amazon: TOTP only, SMS as backup Duo: FIDO2 on desktop and mobile, but lack of support for embedded browsers means I need to have HTOP or push as a fallback for some applications on both platforms. For the services that have recovery keys, I have them in an envelope I keep in my gun safe as well as a PGP-encrypted text file on my computer. I didn't store the TOTP secrets separately, although I probably will next time I re-enroll everything because my Yubikey physically fell apart a month after using it (a common thing with the first batch of 5Cis from what I gather) and I had to move everything back over to TOTP codes. It's not just the standard for 2FA, it's everything from the bottom up. The 2FA tool, how backups work, how recovery works. It's a complete hodge-podge mess and and, like you mentioned, if it's this big of a pain in the ass for an experienced tech guy, how am I supposed to, in good conscience, recommend this stuff to my non-techie friends?

berdario 6y ago
FWIW, Facebook, Dropbox and Github use Fido2 just fine on mobile (Chrome browser). You don't need the TOTP fallback for Facebook on mobile browser (though annoyingly they'll still always send you the code via SMS, if you haven't disabled). I suppose it's possible that their app has issues with FIDO2, and maybe that's why you had to fallback to TOTP. But yeah, 4 services (including Google), out of all the ones that I use... The track record for supporting FIDO2 is underwhelming. It's especially annoying that you cannot set up backup FIDO2 keys in AWS, which means that I won't rely on it.

som33 6y ago

>There needs to be an ISO standard that is well thought out and implemented by all the vendors We don't need any more standards, we need to fix copyright law and get property rights for software. You don't have security risks or the attack surface with local applications. Corporations have done their damnedest to try to kill local apps and move them onto their servers. If we want real security we need to go after microsoft and software companies for trying to force applications online. You won't have a security crisis if apps aren't constantly opening ports and communicating with remote machines to begin with. The whole idea of having our PC's constantly shuffling data back and forth just so software companies can "prevent piracy" is bullshit, our basic right to privacy and owning the things we buy are being infringed on, on a mass scale.