21 ms·

That's not how 2FA works

320 points by edent 6y ago

ahmedalsudani 6y ago
> Risk. YubiKeys have no password lock of their own. At least my crumby Android has a fingerprint lock to prevent people getting my 2FA tokens. But if you’ve stolen my laptop and the YubiKey is plugged in, then you’ve got the keys to my kingdom. The key is only the second factor. You need to lose the key *and* have your password stolen in order to have your accounts compromised. At that point, think about what you're doing wrong as a user.
Tomte 6y ago
> A second factor allows a site to better authenticate you. It does not help you identify the site. That's correct. On the first visit (or enrolment). All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before.
- lkbm 6y ago
  With an email link or a Yubikey it might, but with SMS or an Authenticator app it doesn't add any extra way for me to identify the site.
  - gregoriol 6y ago
    Email is not really a 2FA though if it can also be used to reset your password.
    - lkbm 6y ago
      Interesting point. I hadn't thought about that. Helps that access to my email is 2FA, but it does make for a single point of failure.
  - Tomte 6y ago
    That's true, I was talking about a Yubikey.
    - louis-lau 6y ago
      But the tweets this article was written in response to, weren't.
- jrochkind1 6y ago
  > All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before. I don't understand what you mean. Something about 2FA does this? How?
  - brazzy 6y ago
    The U2F protocol (that Yubikey and others use) is based on a cryptographic challenge-response mechanisms, and it includes the domain of the service you're logging into, as supplied by the browser. The details are complicated, but basically: If you register the key at github.com and later get phished to visit githubverification.com, then the authentication will fail no matter what the phisher does.
    - tialaramex 6y ago
      Specifically, the phisherman's options for a typical Security Key (a physical authenticator device you buy and maybe plug into a USB port) are: * Spew random crap claiming it is your githubverification.com key ID, ask you to sign in with this ID. Your authenticator won't recognise this ID and it doesn't work * Proxy your real ID from github.com and present that from githubverification.com asking you to sign in. Your authenticator won't recognise this ID because it's for the wrong site, though it doesn't know that's why. It doesn't work. * Proxy the ID from github.com and insist this is github.com. Your browser says "Er, no? This isn't github.com fool" and the UX doesn't fire. Notice that the attacker not only doesn't get working credentials for signing into GitHub, they don't even get broken failed credentials that don't work, they just get a Javascript error at best.
bombcar 6y ago
2FA prevents harvesting of passwords - but it just means that they have to be actively (or programmatically) attacking I suppose if they AlSO have protections against proxying (forbid more than X login/login attempts from a given IP) it might help - but certainly not against spearphishing. Honestly don’t see how you can protect against even moderate level spearphishing reasonably. Some banks have a “word” or picture you select that they’ll show you durning login - never understood how this can’t just be proxied. Certificate based authentication in theory allows both sides to Authenticate the Other.
- edent 6y ago
  > Some banks have a “word” or picture you select that they’ll show you durning login - never understood how this can’t just be proxied. It can, simple as that. Some make it moderately more difficult by showing you, say, 9 pictures and asking you to pick the one that's yours. But, again, dead easy to proxy.
  - isbvhodnvemrwvn 6y ago
    Others also ask you to put in only some characters of your password, which is even more troubling because at best they hash them in various configurations when you change password, at worst - they keep it in plaintext.
  - jameshart 6y ago
    The original version of this pattern relied on local storage on your device to ensure that only the real site or app could show you the right image.
    - bombcar 6y ago
      That makes a lot more sense - I wonder if any are left that do it.
- PascLeRasc 6y ago
  That’s a really good idea, we should be asking sites to verify themselves with a second factor. Do you know if that’s in use anywhere?
fastball 6y ago
> The top result on Google is invariably an advert for a scam site. Um... no?
- edent 6y ago
  Try browsing the web without an ad blocker. The top results on Google search are always adverts. And, quite often, they link to scam sites. There are loads of copycat websites which appear in the top slot - especially for government site. https://www.which.co.uk/consumer-rights/advice/how-to-spot-a-copycat-website https://www.which.co.uk/consumer-rights/advice/how-to-spot-a... It's particularly prevalent in the UK, where you see companies proxying legitimate services and charging premium rate for phone calls - https://www.theguardian.com/money/2017/feb/04/beware-call-connection-services-charge-09-numbers https://www.theguardian.com/money/2017/feb/04/beware-call-co...
  - fastball 6y ago
    Can you give me an actual example of this with a google search right now?
    - iso1210 6y ago
      I just did an ingonito search for "!g ETA", I got 3 results on the screen CanadianTravel - ETA Ad·www.canadaonlineapplication.org/ CanadianTravel - ETA Ad·www.canadatravelvisa.com/ CanadaETA - for UK citiziens - canadian-etavisas.com Ad·www.canadian-etavisas.com/ Which all look the same, and seem to charge $99 for the 'service' of filling in a form the Canadian government charges $7 for. After that there is a wikipage for the Spanish terrorist group, two more wiki pages, then finally The official site: Electronic Travel Authorization (eTA): How to apply - Canada.ca Searching google for "Canada ETA" gives the above 3 adverts and also a link to https://www.etatocanada.com/ https://www.etatocanada.com/ which charges £69 for the service.
      - fastball 6y ago
        So.... not a scam, in that you get exactly what you pay for. And certainly not phishing, which this article was talking about.
hehehaha 6y ago
Not sure why the author is so negative on Yubikey. His only reason is that an attacker can steal his laptop with the key plugged in. That’s a user error. I much rather have Yubikey over all other forms of security because it simply forces the attacker to be physically present. Why is that important? Because even if your laptop is stolen with your Yubikey at a local Starbucks, you’re more likely to catch that person versus a completely remote attack. Security isn’t just about attacks. You also need to think about mitigation and recovery following the attack.
- signal11 6y ago
  Also, Bluetooth based keys exist that don’t have to be plugged in.
- edent 6y ago
  Author here. I did provide a few other reasons - mostly around usability of YubiKeys. Try observing a non-techie set one up and tell me if you think it is as easy as it could be. Realistically, you're probably not going to catch a mugger. Otherwise robberies like that wouldn't occur. Snatching a laptop with a key physically plugged in it is probably easier than snatching a laptop and a separate phone. Regardless of my opinions on tech, if you think being mugged is "user error" then may I suggest spending a couple of days volunteering for a local Victim Support charity.
  - hehehaha 6y ago
    Hey I understand but didn’t think other reasons were valid. I apologize if my comment came out curt. I know how that feels. However, I think you should reconsider your opinions on Yubikey. They’re significantly better than all other commercially available security solutions at the moment. Edit: your comment also gave me an idea. Perhaps there should be a phone-based service that you can dial that locks out your account for a predetermined time period? Or it could even be tied to someone else that you can trust.
  - lrvick 6y ago
    I have helped literally hundreds of people setup Yubikeys across several companies. Your take is just not my experience at all. Tapping a blinking light it is much easier than fussing with a 2FA app and works when someone's phone is dead. Yubikeys in particular are near indestructible. They even work after you soak them in acetone overnight and melt the plastic off. I tried. When it says "plug in your device" you plug it in. When it says tap you tap. Also the mugger comment is not part of a typical threat profile. Yubikeys and similar devices are meant to protect you from remote attackers which is the class of attack 99.9999% of people need to defend against. If a mugger points a gun at you, no form of 2FA is going to save you. Also my Yubikey has a pin enabled and fingerprint enabled WebAuthn devices exist. I have several. If you are carrying things so valuable you are worried about being mugged, you can probably afford a higher end model with a fingerprint or pin. Edit: yes I know random muggings happen, but a hit and run mugger that knows what a Yubikey is and already has your password is a hiiiiighly targeted attack. -That- pretty much never happens unless you are walking around with a $1,000,000 in Bitcoin in which case it has happened a total of 5 times that are public.
latopedej 6y ago
fido2/webauthn, adds MFA and a anti phishing protection!
- latopedej 6y ago
  more convenient than yubikeys, is simply your phone, which is really often near you
md_ 6y ago
Mostly agree with a lot of this, but it's a little unfortunate to lump all WebAuthn authenticators together. WebAuthn keys--physical dongles you plug into the USB port--are indeed problematic for the reasons the author notes. (A small--but user-visible--cost; the requirement for a spare USB port of the right form factor; loss.) However, authenticators that are built into the client device (e.g. Apple's support for a TouchID-verified WebAuthn authenticator) solve these problems, to varying degrees: the user doesn't see a marginal cost (it's built into the computer!) and doesn't have to worry about loss, USB ports, etc. The principle challenge with using (as an example) Safari's WebAuthn support is what how the relying party should support loss of the device. (If you lose your Safari--or claim to--how does your bank authenticate you?) Ultimately, the lost-device--or new-device bootstrapping--problem is currently what stands in the way of a truly secure ecosystem, but with platform providers increasingly supporting WebAuthn, we can at least reduce phishing risk to "phishing of the platform provider credential." Your iCloud password might get stolen, but at least that's the _only_ thing an attacker can steal to gain access to your other accounts. For most services, delegating authentication (and anti-phishing) to someone like Apple is a big plus.
- edent 6y ago
  I think that's a fair comment. It would be great to see more device come with built in support for this.
  - md_ 6y ago
    Platform support isn't exactly the problem. Apple, Microsoft, and Android all support WebAuth (https://blog.mozilla.org/security/2019/03/19/passwordless-web-authentication-support-via-windows-hello/ https://blog.mozilla.org/security/2019/03/19/passwordless-we..., https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-the-web/ https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-..., https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/webauthnapis https://docs.microsoft.com/en-us/windows/security/identity-p..., https://developers.google.com/identity/fido/android/native-apps https://developers.google.com/identity/fido/android/native-a...), so most (??) users are in fact covered. eBay, for example, offers a passwordless experience using WebAuthn--so it can be done, even on a major consumer site. The problem is really that until relying parties can trust that 1. Platforms will backup and restore key material from authenticators 2. Users will figure out how to use those backups (including if they e.g. switch from Mac to Windows) they will have to provide some fallback. (Realistically, that means "for the foreseeable future.") This relegates WebAuthn, unfortunately, to a "neat trick"--eBay's "passwordless option"--and not a security guarantee. (Phishers can always downgrade the user to passwords or similar.) What's needed in the interregnum is probably a way to make that fallback option more secure by, at minimum, conveying to users that it's not _normal_--so that phishing attempts targeting that phishable backup are less likely to succeed. Unfortunately this requires a lot of good UX design and unilateral action on part of the relying parties, which I think is tough.
sigmar 6y ago
> Buy a device, register it, install the app, What u2f app is this referring to? I've never needed anything more than chrome to use u2f on windows or ubuntu. Also seems weird to complain about setting up an app, when a few sentences before that they recommend installing a password manager...
- edent 6y ago
  YubiKey recommended that I install Yubi Auth https://play.google.com/store/apps/details?id=com.yubico.yubioath https://play.google.com/store/apps/details?id=com.yubico.yub... and YubiClip https://play.google.com/store/apps/details?id=com.yubico.yubiclip https://play.google.com/store/apps/details?id=com.yubico.yub... Should I not have?
  - Ottolay 6y ago
    For U2F specifically you don't need apps except support in the browser. The apps you listed are used for other types of functionality provided by the yubikey, like OTP and TOTP.
  - tytso 6y ago
    If you had used one of the $10 USD Webauthn (aka U2F) tokens, it wouldn't have asked you to install any applications. The "problem" is the expensive Yubikeys that you were whining about has lots of extra functionality that has nothing to do with U2F, and that's what the extra applications are all about. I happen to use a Yubikey because I want that extra functionality, including using it to secure the keys I use for ssh and for digitally signing git tags so I can securely push git pull requests. But that's because I'm a developer, and it's why I'm happy to purchase multiple Yubikeys (one for my desktop, one for laptop, backups including one that is on a keychain, etc.) Perhaps you were reading web sites that was giving advice for developers as opposed to for consumers?
    - wyager 6y ago
      OpenSSH >= 8.something natively supports U2F. No need for extra functionality.
swinglock 6y ago
So almost nothing can be done because > The top result on Google is invariably an advert for a scam site. No, use an adblocker. It's the modern antivirus and you should use one.
- andybak 6y ago
  Except as others have noted this statement is an exaggeration at best.
lrvick 6y ago
The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists. First of all you can get WebAuthn devices for as little as $10 now. Second, there is no app to configure. You plug it in when it says register and tap it. Done. Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Also the vast majority of attacks are remote, not IRL. Fourth: fingerprint or pin authenticated WebAuthn devices exist if your threat model worries about physical access. IRL attacks are a radically different threat profile. I can't even with this article.
- latopedej 6y ago
  most people have a phone that can leverage webauthn, so you don't even need to buy anything. On top of that, webauthn can be configured to prevent phishing as well
- edent 6y ago
  Could you let me know where I can buy a well supported WebAuthn key for that price? Looking at Amazon UK - https://amzn.to/3oWGYe4 https://amzn.to/3oWGYe4 - the cheapest appears to be about £30. Unless I want to risk my security to some no-name brand with zero customer support. When I got my YubiKey, it told me I had to download an Android app to make it work. So, perhaps better documentation is needed? I'm sorry you didn't like my post, I'll try to do better in future.
  - _wldu 6y ago
    Conor sold U2F Zero's for less than 10 dollars (years ago) and has a kick starter now to fund his new Solo keys: https://www.kickstarter.com/projects/conorpatrick/solo-the-first-open-source-fido2-security-key-usb/ https://www.kickstarter.com/projects/conorpatrick/solo-the-f... https://u2fzero.com/ https://u2fzero.com/ I have a few U2F Zeros and they have been working fine for years. These are simple devices. You don't need to overpay for them. Edit: Conor was building the U2F Zero tokens for $2.26 USD per unit. Read more here: https://www.conorpp.com/u2f-zero-year-in-review/ https://www.conorpp.com/u2f-zero-year-in-review/
nyanpasu64 6y ago
"Security Key by Yubico" is significantly cheaper than YubiKey, and supports open-source protocols ("U2F and FIDO2/WebAuthn") but not corporate 2FA protocols. It doesn't address the keychain/password issues though.
_wldu 6y ago
Nice blog post with interesting views. I leave my YubiKey plugged in all the time. It's basically a permanent part of the computer.
- nijave 6y ago
  Same, and many websites have support for multiple keys so enroll a couple of the cheap $10 ones (per device) and then you can use TOTP or just printed codes as a backup. Even if your device is stolen 1) it's unlikely by a technically savvy bad actor (and if you're at risk, you probably have had special data security training anyway) 2) you're still only stealing one factor. Your device should also be encrypted with a password which would protect any passwords [managers] on the device
2Gkashmiri 6y ago
https://www.amazon.in/Auto-ePass-2003-FIPS-Token/dp/B00S7LULYY/ref=mp_s_a_1_4?dchild=1&keywords=epass+token+2003+epass+auto&qid=1610898933&sprefix=epass&sr=8-4 https://www.amazon.in/Auto-ePass-2003-FIPS-Token/dp/B00S7LUL... does anyone know if its posible to reuse these fips pki tokens? they are cheap enough.....
- vaduz 6y ago
  It's essentially a smartcard (certificate storage) in a more convenient form factor for most users, so you could use them to store your RSA keys - though personally I would not trust them - but they are not FIDO/FIDO2 so they are almost useless in the context of the article.
yangwuzrite 6y ago
The author of this article has no idea how 2FA works or why it's used. 2FA is used to prevent or mitigate the impact of phishing or other attacks where a password is compromised (password reuse, random guessing, keylogger, etc.). The author does bring up one hypothetical attack -- a man-in-the-middle attack -- where someone can trick a user into providing their 2FA or triggering an authorization (like with a Duo push). This requires the ability to execute a real-time attack. FIDO/U2F/Webauthn (I still haven't figured out exactly what you're supposed to call them) security tokens solve that use case by allowing the website to authenticate directly to the token. That can't be phished -- even if you're tricked into a fake website and given a fake webauthn prompt, AFAIK there's no known way to proxy or otherwise intercept that second factor authentication to allow a phishing attack to succeed. His complaint that the token doesn't have a password is largely pointless -- the token is the second factor, the password on the site is the first. If you're using passwordless FIDO2 logins, then it does have a PIN. Long story short, this guy is full of crap.
flas9sd 6y ago
for one, html email is vicious, terminal email clients can help to not fool you with visual alignment. I like the feature `From: <> via <>` in the view, maybe this tipped her off - "palette.cloud" is an unlikely envelope-sender for github mail. Reactivating an old gmail account, I can't see how to enable the feature. In a muttrc, you can get context with showing you more headers. ignore * unignore from: to: cc: date: subject: user-agent: x-mailer: return-path: authentication-results: hdr_order date: from: return-path: to: subject: user-agent: x-mailer: authentication-results: A client could by default show "unverified" and use spf+dkim to get to verified. The "unverified" could be signal enough to enable spidey sense
TACIXAT 6y ago
This is a weird post. Yubikeys are absolutley the solution here, also a password manager. A decent password manager will check the URL for you.
- chungy 6y ago
  There are many legitimate situations in which a login domain is changed and a password manager no longer works. So then you manually open the password manager, look for the password, copy+paste, and save the new entry. How can you be completely confident that this isn't an attacker?
  - TACIXAT 6y ago
    In that rare case you just check the URL. Contact the company if it is a high value login. You can also verify by searching for the site and clicking through to see what their webpage offers as ground truth.
  - tialaramex 6y ago
    Right. One of the good decisions in WebAuthn is that this type of nonsense simply isn't possible. It's designed so that you can't do this. When the big boss absolutely insists that ourcorp.example must rename to xp4ifis.example because of whatever nonsense, there's nothing to argue about, it won't technically work, it can't be done. Like if they decided it would be better branding if up was down, too bad. In almost all cases these were just about vanity (e.g. the university where I studied and had some of my first jobs renamed itself and gave every web site new URLs, purely out of vanity, at considerable cost with no benefit) and so when they discover it can't be done technically they just give up and continue to use the old name for authentication, meaning your security posture is intact. In the few other cases you're now going to have to have a conversation with your users about why you broke everything and need to begin over. I sure hope the gain to your organisation was worth it.
    - guenthert 6y ago
      Not too long Scottrade (2 or 3 't'?) got bought by Ameritrade. All Scottrade accounts are now accessed exclusively under the new domain name. Recently Ameritrade and Charles Schwab Corp. merged ...
tommywg7 6y ago
What about certificates? The fake GitHub almost certainly does not have a valid certificate. Isn’t that our one defense against these things?
- tialaramex 6y ago
  The problem that a certificate just assures us this is indeed https://githubverification.com/ https://githubverification.com/ which it is This leaves a human to try to make deductions about whether githubverification.com is github.com which is something humans are terrible at, so game over. If you have WebAuthn then your browser also takes responsibility for only letting you use your github.com credentials on github.com and not even bothering you with any other possibilities that you might think could be safe and are not. That's why WebAuthn prevents phishing.
ajross 6y ago
The linked article is correct, but uncharitable. It correctly states the behavior of two-factor auth systems but incorrectly understands their value. Yes, 2FA won't protect you from being phished by a site if you aren't careful. 2FA absolutely will protect you from a phishing site using the password it stole. So no, when someone says "Use 2FA if you might be phished" you shouldn't be replying "That's not how 2FA works", you should reply "That's right! But let me explain why you are still at risk of password theft and should still be careful."
- shawnz 6y ago
  The attacker could proxy the 2FA request from the real site using the password you enter and therefore you wouldn't be protected.
  - Spivak 6y ago
    Yes, that’s basically the author’s point. But it does protect you against someone trying to use your password on another site.
  - FeepingCreature 6y ago
    Yes, you can MITM 2FA, but you can't timeshift 2FA.
  - cortesoft 6y ago
    Right, they could have access to your account, but not full access. A good website will ask for 2FA again if a user tries to do something destructive (like change password, email, or disable 2FA). They wouldn’t be able to do those things.
    - deleted 6y ago
      [deleted]
    - TacticalCoder 6y ago
      > A good website will ask for 2FA again if a user tries to do something destructive (like change password, email, or disable 2FA). They wouldn’t be able to do those things. The page mocking the login page where you need to answer the 2FA will simply phish your 2FA then, after a little delay pretending there's some lag, would say "wrong code, please try again". Now the person enters a second 2FA (which, due to the delay, would be different than the first one). As I've just commented in a top-level comment: I've seen sites using a 72 hours delay before any destructive change can be made, coupled with the sending of an email containing a link allowing to unilaterally prevent the change. I've also seen sites using two 2FA (TOTP style), one for login, one for any setup/destructive change. And there are sites using both techniques. It's not 100% foolproof but it's better than "one 2FA phished and it's game over".
cordite 6y ago
I recently experimented with the Yubikey OTP feature. Like TOTP, it can be proxied through as there's no challenge that includes signing the website name like FIDO. Also.. The Yubico OTP feature types using QWERTY with letters and no numbers. As I use dvorak, this resulted in considerable confusion as two yubikeys behaved the same. Interestingly, copying the credentials between Yubikeys will not result in an accepted yubikey OTP. The serial seems to be used somewhere in the calculation. A yubikey, using the CLI tool, can have TOTP credentials stored inside. This can be used in conjunction with grep and sed for any CLI scripts that may interactively request a TOTP.
underdeserver 6y ago
The author recommends BitWarden, but it seems like it's run by one guy. How do I know he doesn't go away? Get hit by a bus?
- yumraj 6y ago
  run your own instance of Bitwarden.. there's a nice dockerized server available written in Rust
- t0astbread 6y ago
  You don't but any good password manager should have an option to migrate away from it quickly.
GolDDranks 6y ago
Let's say I've got 2FA enabled. I get a confirmation link to my e-mail. I click the link. Because the e-mail is sent by the real site, the link leads to the non-phishing site. The scammer has my password, but is still unable to access the site. How does that not help? Of course if it's a 6-digit code or something, then they are able to stole my it like they did with the password.
- jakelazaroff 6y ago
  I wouldn’t call sending codes by email “true” 2FA, though, since your email address can also be used to reset your password.
dathinab 6y ago
I think password managers are the first step you should take and FIDO/U2F hardware keys are the second similar important step. With that even if your password manager get hacked you still have a secure account as they didn't got the U2F at the same time a password manager is a must have as it's prevents a lot of phishing attacks from even getting any chance and is quite convenient, too. The problem with hardware keys is that for many people they are not so easy: - You MUST generate and safely store recovery keys, storing them in your password manager is suboptimal, but better then not having them. (Not having them means potentially losing account access permanently.) - You often need to enable it. - You should store it with your keys, which dependent on habit might not be around your PC (in my case they always are in my pocket so :=) ). - If your site doesn't support U2F/FIDO you might need an additional phone + app, or laptop app to get the numbers out of your key. So while I think it's a must have for every developer to have a hardware security token lie a Yubikey it's not something I could convince e.g. my Dad or Sisters to use.
yumraj 6y ago
There is another issue, I think, with Cloudflare serving in the middle. For many websites the Cert is owned by Cloudflare and shows Cloudflare as the Organization and not the website owner. In that case there is no way for me to figure out whether I'm on the actual site or a phished site. For example see this (it is the Visa opt-out website that was posted a few days ago on HN): https://marketingreportoptout.visa.com/OPTOUT/request.do https://marketingreportoptout.visa.com/OPTOUT/request.do Supposedly the above it authentic, but the Cert is showing Cloudflare as the Organization. Now unless the claim is that Cloudflare will never serve phished websites, which I doubt unless Cloudflare is doing a human validation for each client, this is a problem.
- invokestatic 6y ago
  This is an issue with any domain-verified TLS certificate, which make up the overwhelming majority of certificates in use. Only CAs which offer organization-verified (OV) or extended-verified (EV) certificates, typically at exorbitant prices, does the TLS certificate attest the publisher of the website.
  - yumraj 6y ago
    > Only CAs which offer organization-verified (OV) or extended-verified (EV) certificate, typically at exhorbitant prices, does the TLS certificate attest the publisher of the website. Even so, I’ll expect financial institutions to have that. Note: I’m not saying the above is a Cloudflare issue, perhaps someone at Visa was being stingy - I’m just saying it’s an issue and would be bad if that becomes the mainstream.
nrvn 6y ago
I have a question: if a website is clearly involved in phishing how does one report such a website and what is the process of blocking the domain name and chasing the owner?
lifeisstillgood 6y ago
>>> The top result on Google is invariably an advert for a scam site. Wait what now?
m4tthumphrey 6y ago
Slightly OT: Odd timing but one of my services sent me a push notification earlier about setting up a "personalised code" which would be included in all emails. I thought this to be a novel way that could _help_ with the email phishing problem, if adopted and implemented properly.
- unilynx 6y ago
  The user still has to notice that the personal code is missing in the phishing emails. If you could trust users with "always check for this personal code in the emails, ignore emails without it" we could also trust them with "your bank will never email you a login link"
jfrunyon 6y ago
> The average YubiKey is £50. There are a few around the £30 price point. That’s a huge expense given the small number of sites that support them. A wide variety of sites support them. I'd estimate around 1/3rd of the services I use daily (both personally and for work) support them. (That said, I got mine for $30 by signing up for a magazine subscription, and wouldn't have paid significantly more. And, of course, some of my services have been chosen because they differentiated themelves from the competition by Yubikey support.) > Buy a device, register it, install the app, configure it, find the setting in the website, enable it, hope your machine has the right sort of USB ports, press the button at the right time. Except, with U2F, that's not true. It's just "buy a device, plug it in, find the place on the website, wait for a prompt, press a button". > Convenience. My YubiKey is on my keyring. My keys are in my coat. That's a pretty personal problem. For me, my keys are either on my belt loop or on my desk, which means it's always handy. Of course, you can also get one of the models which is designed to stay plugged in, if that is compliant with your threat model. > Risk. YubiKeys have no password lock of their own. ... if you’ve stolen my laptop and the YubiKey is plugged in True, which is why they're not generally suitable for standalone use; only as a second credential. Also, if your threat model has you worried about them being stolen together, simply don't leave them plugged in together. > Support. WebAuthn is a great standard – but only a few sites support it. That's still as false it was when it was your first point. > If fake-github.com said “Hmmm we’re having problems with our WebAuthn backend – please use a one-time code from your authenticator app for added security” would you be fooled? At the very least, it would probably cause me to double-check that I was on a legit site. Overall: I don't think you give enough credence to the fact that it's real, secure, convenient 2FA. No more digging your phone out of your pocket, unlocking it, navigating to the app, and then setting your phone down so you can type in the code. And then locking your phone and putting it back away. Personally, my Yubikey goes into my laptop at the start of the work day (the first time I use it), and it doesn't come out until I'm done working (well, or if I need to use my keys). All I have to do is tap the button after I put my password in.
smokey_circles 6y ago
No. 2FA is designed to authenticate that this is you logging in. Wrong off the bat. The "they just use your login token" is akin to "they just hacked the CIA's database". Just. I also don't see how the author thinks that the same users who struggle with yubikey won't simply search for the github.com login on githud.com in their password manager. Bitwarden and co are great but the default domain creates a problem where login.signup.domain.com does not match login.domain.com and so users are used to searching. The bit that completely lost me was the lamenting of convenience with the YubiKey. Security and convenience are polar opposites. Coupled with the "tech bros" comment, I am not sure this is in good faith at all
- paraknight 6y ago
  > The "they just use your login token" is akin to "they just hacked the CIA's database". Just. He's saying that they can basically MITM you, which is true. GitHub asks attacker for token, attacker asks you, attacker gives token to GitHub on the spot, presto.
  - smokey_circles 6y ago
    Ah, I did overlook that one. That said: I remain unconvinced that 2FA is a trivial thing to beat. Now we're talking about an active attempt to impersonate you, as opposed to a general catch-all-the-2fa-less-logins Put another way: If you ran this phishing site, would you focus your time on the logins with 2FA enabled (which if I've understood correctly means you'd have to catch them in the window the token is valid for) or the logins without?
    - TheGeminon 6y ago
      If you use your phished credentials immediately (e.g. inline with it being phished), then it doesn't make a difference if they are using 2FA. You use the credentials they entered to login from a backend system automatically, and then if that ends up with a 2FA prompt, you show the victim the 2FA phishing page next, instead of redirecting them to the real app/whatever. This obviously does have its own downsides (you have to maintain a login infrastructure, as well as your phishing infrastructure), but this was even seen before 2FA became common to detect if an incorrect password was entered into the phishing site. It is definitely an improvement, but TOTP doesn't provide much protection from phishing, and as it becomes more popular more phishers will need to accomodate for them in their campaigns, further reducing their effectiveness here.
goodpoint 6y ago
Another aspect that people always forget is that 2FA protects only the login process. Any successful attack against your browser (or any other application on your workstation) allows the attacker use existing and future browsing sessions. The attacker can simply wait until you log onto your bank account and remotely control your browser.
as300 6y ago
Correct me if I'm wrong but I've seen oauth implementations that require you to be redirected to the site you're giving credentials for to finish the flow of authentication. Wouldn't this make it a lot easier to determine that you're being phished, if you have to go to a whole different web site that warns you that you are giving external parties access to your credentials?
- anticristi 6y ago
  Indeed, using OAuth everywhere would make the success of such an attack less likely. However, I feel strongly about not letting a single organization act as my identity provider. I don't like putting all eggs in the same basket.
anticristi 6y ago
Time to implement Password Authenticated Key Exchange, e.g. Secure Remote Password, in the browser? Here is what I suggest. Let there be a field <input type=pake challenge=blah />. Whatever is typed into that field is unavailable to the front-end code. Instead, the browser computes a one-way function of the password, challenge and origin, and makes that available to the front-end. The devil is in the details, but I'm pretty sure that a robust security analysis could eventually produce a solution that allows any user to type any password in a "super-password" field, and rest assured that the phishers are out. The next issues would be: - How to prevent "downgrade" attacks, i.e., the user should immediately notice if a legacy password field is used. - How to convince the Internet to adopt this.
janwillemb 6y ago
+1 for bitwarden as password manager. It did indeed save me a few weeks ago from a phishing attempt. After reporting it to my employer and warning all my colleagues it turned out to be the tech department doing a white hat test to educate the employees :)
scottmcdot 6y ago
Is there potential for a simple popup in, say, 1Passwordx Chrome extension that, if the base url doesn't exist in any key chains, that reminds us to watch for phishing sites?
niftich 6y ago
This is a good article about the weaknesses of the trust models of navigation on the web. The author uses a password manager that also fulfills the role of a personal 'have I seen this site before?' database, which helps them associate a URL to its conceptual entity, in their quest to determine if the site they visited was the site they intended to visit. In this exact form, this is a feature that's absent from mainstream browsers today. Because browsers do not have this, people instead turn to all sorts of other signals to judge the site's identity, but each one of those signals is designed for another purpose, and ought to not to be used directly by the user to make such determination. But no other signals are available, so they get used nonetheless. Some people look at the URL before clicking it, or the URL bar in the browser after they've already navigated to the site, and try to judge from the URL whether the site belongs to the entity they intended to visit. This is fallible for a bunch of reasons, including: (1) people often read visually instead of comparing codepoint-by-codepoint, so reading errors or homoglyph attacks are possible, and browsers can only meaningfully mitigate against the latter; (2) very few people keep a computerized allow-list, so they check against expectations in their head; and (3) some organizations will make use of domain names that greatly differ from their own name, which works contrary to the instinct of a URL-judging user who consider themselves 'cautious', and it's difficult to stay aware of all this. Some people look at the TLS certificate, and try to judge from the information displayed by the browser about the cert whether the site belongs to the entity they intended to visit. This is fallible for a bunch of reasons, including (1) DV certs only prove that someone (i.e. anyone) had control of the domain at the time near the cert's issuance, so its value as a trust signal to the user ought to be zero and immediately reduce to the prior case of mentally validating the URL by its character content; (2) EV certs validate against a legal entity in some jurisdiction, but as the 'stripe.ian.sh' stunt has demonstrated, jurisdiction-by-juristiction registries of legal entities are a tool for a different use-case and were never intended to collectively ensure globally unique Organization names; and (3) in their rush to ensure widespread TLS deployment on all sites, and their involvement with efforts to bring short-lived cost-free DV certs to everyone, browser-makers began de-emphasizing the UI distinctions between DV certs and EV certs some time before the true shortcomings of EV as a user-facing trust signal were widely demonstrated. Some people look for the visual design of the website. This is trivial to fake. Some people will rely on browser-resident bookmarks, browser history, or 'top sites' tiles to navigate to common sites they've visited before (or to sites the browser-maker pre-loaded into the listing). This is a great way to preserve the trust chain and reduce the likelihood that the user arrives at an unintended site by mistake. But these features do not directly address the case of a person navigating to a URL they were linked or provided from an arbitrary source, such as the example raised in the article. Building blocks exist today that could be used by publishers and browser-makers to aid users in judging URLs. Some of these will require past UX decisions to be undone. For example, top sites could become their own Root Certificate Authorities [1] and be listed in browser trust stores; these companies would be expected to issue certs for sites associated to themselves. This would eventually reshape the cert landscape so that a parent-child relationship between issuer and subject could be meaningfully distinguished from a 'provider and customer' relationship. Companies that provide services to others, such as payment processors, could also become root CAs and sign for their customers. These changes, and a browser UX that once again shows the cert issuer, would go a long way towards reducing the likelihood that users are fooled by sites trying to impersonate top sites. If this were to come to pass, other CAs would be expected to pivot to minting certs that play the role of a trustmark, by conferring a degree of ongoing assurance that's useful to the user (which, in fairness, was the original point behind EV certs). They would do this by establishing strong brands around their trustmark, issue certs for a short lifetime, and monitor the site on an ongoing basis to see if it's still deserving of their trustmark. This would result in a business model similar to those of EV certs, but a trust model that's based on the user's trust in the CA's exercise of good judgment befitting their brand. [1] https://news.ycombinator.com/item?id=13495262 https://news.ycombinator.com/item?id=13495262
dgudkov 6y ago
They author makes a few good points, but I find the author's critique of Yubikey weak: >Cost. The average YubiKey is £50... If that's too expensive for ensuring your internet security, then either you underestimate the risks, or undervalue your information. If a Yubikey cost 10 times more it would still be a bargain. >Usability. Buy a device, register it, install the app, configure it, find the setting in the website, enable it, hope your machine has the right sort of USB ports, press the button at the right time. Pressing the button at the right tight was a joke, right? Although, I admit it may be challenging for people with disabilities. Websites making it hard to find 2FA settings is not a Yubikey's problem, it's a website problem. Setting up a Yubikey is rather straight forward too. The main issue is the inability to clone a Yubikey programmatically, but that's the price of security. >Convenience. My YubiKey is on my keyring. My keys are in my coat... That's can't be serious too. I won't even elaborate on this. >Risk. YubiKeys have no password lock of their own. At least my crumby Android has a fingerprint lock to prevent people getting my 2FA tokens. But if you’ve stolen my laptop and the YubiKey is plugged in, then you’ve got the keys to my kingdom. That's actually the only valid point I somewhat agree with. Again, this is largely mitigated by developing the right habits. You don't leave your car keys hanging in your car's lock after leaving the car in a parking lot, right? Then why do it with Yubikey? If developing a new minor habit represents a problem, then either you underestimate the risks, or undervalue your information. An additional password/fingerprint protection would be nice though. I agree on that. >Support. WebAuthn is a great standard – but only a few sites support it... Again, this is not a Yubikey's problem. It's a website problem.
- acupofnope 6y ago
  > YubiKeys have no password lock of their own I don't know if the author of the blog post means something else but if you're using 2FA tokens (i.e. Yubikey Authenticator) you can put password protection for additional security.
  - mynameisvlad 6y ago
    In some scenarios, Windows 10 will also require a PIN to use a key: https://docs.microsoft.com/en-us/azure/active-directory/user-help/security-info-setup-security-key https://docs.microsoft.com/en-us/azure/active-directory/user...
sneak 6y ago
You don't need a $50 Yubikey token to do U2F, there are ones in the $10-15 range. Most sites that support U2F support enrolling multiple tokens, so just have one in each machine. Theft of a machine still needs your password to access the accounts, so it's not "keys to the kingdom" as the article suggests. I feel that this article is... wrong.
slaymaker1907 6y ago
2FA can actually prevent phishing, though it requires close integration with the app and the authenticator. It's actually quite similar to CSRF prevention. On the site itself, display a random nonce to the user for confirmation then send an request for authentication to the authenticator with said nonce which the user can confirm. The battle.net authenticator does this. For added protection, you can prompt the user to select which nonce is correct to force them to verify it is correct. The Microsoft authenticator does this sometimes. The downside of this approach is that it requires a constant connection between the second factor the service. It also relies on the fact that the service authenticates itself via TLS or some other means, though that is a relatively minor issue.
howlgarnish 6y ago
Fake 2FA works if it's stateless, eg entering a code from Authy or a physical token. However, stateful 2FA like sending an SMS to your phone, or popping up a notification on your banking app is much harder to spoof, and would have protected the user here.
mapgrep 6y ago
All the complaints made about yubikey and webauthn could be made about 2fa 5-10 years ago. Hardware tokens gated by software (ala yubikey + webauthn) are clearly the next step in auth. It’s an accident of circumstance you even need to buy a yubikey - your iPhone, iPad, laptop, android whatever can do everything a yubikey does. There just needs to be enough demand and time for OS and hardware vendors to come around to shipping and integrating this stuff by default. Suddenly you’ll own 3 or 4 yubikey equivalents without buying any special auth devices. 25 years into the web and our login tools remain pretty barbaric. Maybe in 25 years we’ll have it sorted out. But change is coming. Call it 2fa, webauthn, whatever - regardless of the details username/password auth (on its own) is dead.
- snarf21 6y ago
  Yeah. It is mostly about integrating and standards. Private keys in the secure enclave already does everything Yubikey does. All phones already have it. The OSes just need to support FIDO and then we don't need passwords anymore (assuming a passcode lock on device). Essentially everyone would have 3FA (something you know, something you have and something you are)
  - BlackFly 6y ago
    Secure enclaves as a second factor break the assumptions of 2FA threat models. If I compromise a single factor (your device) then I can gain both your password and your second factor. The best second factors are separate devices with their own screens that indicate what you are authenticating to/for before you provide your authentication. Of course, nothing ever stops a user from deputizing malware.
    - snarf21 6y ago
      I guess I'm not seeing the difference between the secure enclave in a phone and the secure chip in a Yubikey in regards to threat models.
- deleted 6y ago
  [deleted]
staticassertion 6y ago
The criticism of YubiKey seems kind of unfair. For one thing, it doesn't actually explicitly state that they totally address the major issues in the article. Instead it's "in theory" and "can help". No, it totally addresses the issue of phishing your 2FA token and it does so in practice. The pricepoint mentioned is over twice what the cheapest Yubikey is - $24.99 [0]. The author states the "average" cost is £50 and "there are a few around £30". Again, 24.99USD for USB + NFC yubikeys that support U2F/webauthn. 'usability' and 'convenience' are the same thing but split into two points, which give the impression that there's a whole other issue, but it's really the same thing. > Buy a device, register it, install the app, configure it, find the setting in the website, enable it, hope your machine has the right sort of USB ports, press the button at the right time So for TOTP it's install the app, configure it, find the setting on the website, enable it. So Yubikey adds the one additional step of "buy it", all of the others are the same for all other forms of 2FA. "Press the button at the right time" come on... as opposed to "find the TOTP and type it in on time" ? The 24.99 USB Yubikey also supports NFC, so like, "has USB or NFC" is the requirement - I'm seriously struggling to think of a device that doesn't meet this requirement. The author states that leaving the yubikey in the laptop increases risk. I find this to be a mixing of threat models personally - we've solved credential phishing with the 2FA token, but now you're talking about a threat where the attacker has unfettered physical access? I just don't see why that's relevant, sorry. And for support, I think it's important to note that most sites are not sensitive. But a couple of important sites are. The most important is probably email, since email is effectively an auth mechanism for most other sites via account recovery. So just by protecting email you're protecting every other site. That's really important. IMO, Yes, Yubikeys should get cheaper. I certainly hope they do. At my company I give every employee 2 Yubikeys and they are theirs to keep - they're free to use them for personal accounts. I hope more companies do this in the future, essentially distributed U2F to the workforce. But, otherwise, I really think that the benefits are being drastically undersold and I think that the criticisms are really not particularly fair. [0] https://www.yubico.com/product/security-key-nfc-by-yubico/ https://www.yubico.com/product/security-key-nfc-by-yubico/
TacticalCoder 6y ago
Although I agree that 2FA like Google Auth/Authy/etc. doesn't authentify the site, I'd like to comment on this: > Then the fake site uses your real token and logs in as you. > > Game Over. Depending on how the site's security work, it's not totally game over. I've seen sites, optionally (you still have to turn the feature on), requiring a 72 hours delay before any setup change is taken into account (like, say, a password change). During this time a warning is sent by email and you can at any time during these 72 hours, unilaterally, prevent the change from happening. So it may be "game over" in that the attacker can login and see all you account/activity/data (which, yes, is really bad) but it's not totally "game over" as in it doesn't mean "logged out of your account" (unless the attacker also compromised your email ofc, but now we're talking about something else).
cratermoon 6y ago
Something people here are missing is that unless the phishing site uses your credentials right then and there within the existing session, they can't do much even if they do capture your 2nd factor. But if the site just captures your credentials and puts them in a database of site/username/passwords, they are useless later, even if they also store your 2nd factor of the moment. The next time someone tries to authenticate with your stolen username and password, and the MFA challenge comes up, they will be stuck. The factor they captured phishing has long expired, and the site has no ability to provide the correct value for your 2nd factor at a later time. So in other words, 2FA does provide additional protection in this scenario, unless the malicious party has programmed the system to also hijack your session. I honestly can't say for sure how often the phishing sites use session hijacking vs. just collecting for later use. If the first scenario is most common then no, 2FA doesn't help much. If the second scenario is typical, then 2FA provides significant additional protection over just username/password.
- ecesena 6y ago
  This is true for all 2FA methods but not for FIDO security keys. With FIDO, the hostname of the site you're browsing is signed in the assertion, therefore the attacker -even with automation- can't reuse it on the target site. This is why FIDO claims protection against phishing. What the author says is that the attacker, when you're using a FIDO security key, can simply say it's not working and force the user to switch to a different 2FA method, therefore in the end phishing the user.
- paulryanrogers 6y ago
  Session jacking can also allow disabling MFA unless sites are careful to re-verify the MFA before doing so. Or before changing the password or adding additional tokens / generating backup codes. Security is hard. And features make it porous.
  - cratermoon 6y ago
    Yeah, a site needs to issue an MFA challenge to any MFA change attempt.
anotheraccount9 6y ago
I think the negative aspects stated by the "hardware authentication device" is overkill. It's really easy to use and cost is relative (gets cheaper with use). May be real issue is that we're not using these new solutions and are still relying on unnecessarily complex passwords to save with master passwords. In some cases, 2FA can be a pain in the butt to manage when you have hundreds of them. A couple hardware keys and voila.
Fazel94 6y ago
Is GPG Auth the answer? It is tied to the site keys and not the address nor even the CAs. It forces you to check and think before doing your thing. And It is easier to use than 2FA, since it is one factor, open your key one time, the key auths you as long as you want.
WhyNotHugo 6y ago
This is why password managers are so important. A password manager won't offer to auto-complete if the protocol/domain does not match with what you've saved. This is an immediate red-flag that something fishy is up.
red_admiral 6y ago
FIDO is a subset of 2FA, and it's one of the protocols that yubikeys etc. implement. While it won't protect you from all attacks, it does make the standard MITM harder. To take the OP's example, if by mistake you are tricked into visting githud.com or something, they can get your password (bad!) but if they try and MITM the FIDO, they'll send a digitally signed message for githud.com on to github.com. This will not work as intended (except for the user, because their github account isn't compromised yet.) Indeed the point of FIDO as I see it is that it's less security critical for the end user to validate the identity of the site, which optimistically speaking about 95% of users will fail at anyway.
als0 6y ago
> WebAuthn and hardware tokens are probably the future. And they’re probably the best way we have to verify site legitimacy. But they’re also currently a poorly supported usability disaster. I was looking for the punchline but it seems like there isn't one. Complaining about hardware tokens and then saying they are the future doesn't contribute much...
GaryStu100 6y ago
I was able to recover over $17,000 I lost to fraud. All thanks to this pro hacker Arthur Vitali who helped me track funds and eventually wired all the money back to my account within 3days. I am more than grateful. If you need help please contact Arthur on EMAIL- Quickarturhack @ Gmail,com WHATSAPP +17025301177 He also does phone hacking, credit fix/score boost, all social media accounts hack, website hack and a lot others

320 points by edent 6y ago

> Risk. YubiKeys have no password lock of their own. At least my crumby Android has a fingerprint lock to prevent people getting my 2FA tokens. But if you’ve stolen my laptop and the YubiKey is plugged in, then you’ve got the keys to my kingdom. The key is only the second factor. You need to lose the key *and* have your password stolen in order to have your accounts compromised. At that point, think about what you're doing wrong as a user.

Tomte 6y ago

> A second factor allows a site to better authenticate you. It does not help you identify the site. That's correct. On the first visit (or enrolment). All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before.

lkbm 6y ago
With an email link or a Yubikey it might, but with SMS or an Authenticator app it doesn't add any extra way for me to identify the site.
- gregoriol 6y ago
  Email is not really a 2FA though if it can also be used to reset your password.
  - lkbm 6y ago
    Interesting point. I hadn't thought about that. Helps that access to my email is 2FA, but it does make for a single point of failure.
- Tomte 6y ago
  That's true, I was talking about a Yubikey.
  - louis-lau 6y ago
    But the tweets this article was written in response to, weren't.
jrochkind1 6y ago
> All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before. I don't understand what you mean. Something about 2FA does this? How?
- brazzy 6y ago
  The U2F protocol (that Yubikey and others use) is based on a cryptographic challenge-response mechanisms, and it includes the domain of the service you're logging into, as supplied by the browser. The details are complicated, but basically: If you register the key at github.com and later get phished to visit githubverification.com, then the authentication will fail no matter what the phisher does.
  - tialaramex 6y ago
    Specifically, the phisherman's options for a typical Security Key (a physical authenticator device you buy and maybe plug into a USB port) are: * Spew random crap claiming it is your githubverification.com key ID, ask you to sign in with this ID. Your authenticator won't recognise this ID and it doesn't work * Proxy your real ID from github.com and present that from githubverification.com asking you to sign in. Your authenticator won't recognise this ID because it's for the wrong site, though it doesn't know that's why. It doesn't work. * Proxy the ID from github.com and insist this is github.com. Your browser says "Er, no? This isn't github.com fool" and the UX doesn't fire. Notice that the attacker not only doesn't get working credentials for signing into GitHub, they don't even get broken failed credentials that don't work, they just get a Javascript error at best.

bombcar 6y ago

2FA prevents harvesting of passwords - but it just means that they have to be actively (or programmatically) attacking I suppose if they AlSO have protections against proxying (forbid more than X login/login attempts from a given IP) it might help - but certainly not against spearphishing. Honestly don’t see how you can protect against even moderate level spearphishing reasonably. Some banks have a “word” or picture you select that they’ll show you durning login - never understood how this can’t just be proxied. Certificate based authentication in theory allows both sides to Authenticate the Other.

edent 6y ago
> Some banks have a “word” or picture you select that they’ll show you durning login - never understood how this can’t just be proxied. It can, simple as that. Some make it moderately more difficult by showing you, say, 9 pictures and asking you to pick the one that's yours. But, again, dead easy to proxy.
- isbvhodnvemrwvn 6y ago
  Others also ask you to put in only some characters of your password, which is even more troubling because at best they hash them in various configurations when you change password, at worst - they keep it in plaintext.
- jameshart 6y ago
  The original version of this pattern relied on local storage on your device to ensure that only the real site or app could show you the right image.
  - bombcar 6y ago
    That makes a lot more sense - I wonder if any are left that do it.
PascLeRasc 6y ago
That’s a really good idea, we should be asking sites to verify themselves with a second factor. Do you know if that’s in use anywhere?

fastball 6y ago

> The top result on Google is invariably an advert for a scam site. Um... no?

edent 6y ago
Try browsing the web without an ad blocker. The top results on Google search are always adverts. And, quite often, they link to scam sites. There are loads of copycat websites which appear in the top slot - especially for government site. https://www.which.co.uk/consumer-rights/advice/how-to-spot-a-copycat-website https://www.which.co.uk/consumer-rights/advice/how-to-spot-a... It's particularly prevalent in the UK, where you see companies proxying legitimate services and charging premium rate for phone calls - https://www.theguardian.com/money/2017/feb/04/beware-call-connection-services-charge-09-numbers https://www.theguardian.com/money/2017/feb/04/beware-call-co...
- fastball 6y ago
  Can you give me an actual example of this with a google search right now?
  - iso1210 6y ago
    I just did an ingonito search for "!g ETA", I got 3 results on the screen CanadianTravel - ETA Ad·www.canadaonlineapplication.org/ CanadianTravel - ETA Ad·www.canadatravelvisa.com/ CanadaETA - for UK citiziens - canadian-etavisas.com Ad·www.canadian-etavisas.com/ Which all look the same, and seem to charge $99 for the 'service' of filling in a form the Canadian government charges $7 for. After that there is a wikipage for the Spanish terrorist group, two more wiki pages, then finally The official site: Electronic Travel Authorization (eTA): How to apply - Canada.ca Searching google for "Canada ETA" gives the above 3 adverts and also a link to https://www.etatocanada.com/ https://www.etatocanada.com/ which charges £69 for the service.
    - fastball 6y ago
      So.... not a scam, in that you get exactly what you pay for. And certainly not phishing, which this article was talking about.

hehehaha 6y ago

Not sure why the author is so negative on Yubikey. His only reason is that an attacker can steal his laptop with the key plugged in. That’s a user error. I much rather have Yubikey over all other forms of security because it simply forces the attacker to be physically present. Why is that important? Because even if your laptop is stolen with your Yubikey at a local Starbucks, you’re more likely to catch that person versus a completely remote attack. Security isn’t just about attacks. You also need to think about mitigation and recovery following the attack.

signal11 6y ago
Also, Bluetooth based keys exist that don’t have to be plugged in.
edent 6y ago
Author here. I did provide a few other reasons - mostly around usability of YubiKeys. Try observing a non-techie set one up and tell me if you think it is as easy as it could be. Realistically, you're probably not going to catch a mugger. Otherwise robberies like that wouldn't occur. Snatching a laptop with a key physically plugged in it is probably easier than snatching a laptop and a separate phone. Regardless of my opinions on tech, if you think being mugged is "user error" then may I suggest spending a couple of days volunteering for a local Victim Support charity.
- hehehaha 6y ago
  Hey I understand but didn’t think other reasons were valid. I apologize if my comment came out curt. I know how that feels. However, I think you should reconsider your opinions on Yubikey. They’re significantly better than all other commercially available security solutions at the moment. Edit: your comment also gave me an idea. Perhaps there should be a phone-based service that you can dial that locks out your account for a predetermined time period? Or it could even be tied to someone else that you can trust.
- lrvick 6y ago
  I have helped literally hundreds of people setup Yubikeys across several companies. Your take is just not my experience at all. Tapping a blinking light it is much easier than fussing with a 2FA app and works when someone's phone is dead. Yubikeys in particular are near indestructible. They even work after you soak them in acetone overnight and melt the plastic off. I tried. When it says "plug in your device" you plug it in. When it says tap you tap. Also the mugger comment is not part of a typical threat profile. Yubikeys and similar devices are meant to protect you from remote attackers which is the class of attack 99.9999% of people need to defend against. If a mugger points a gun at you, no form of 2FA is going to save you. Also my Yubikey has a pin enabled and fingerprint enabled WebAuthn devices exist. I have several. If you are carrying things so valuable you are worried about being mugged, you can probably afford a higher end model with a fingerprint or pin. Edit: yes I know random muggings happen, but a hit and run mugger that knows what a Yubikey is and already has your password is a hiiiiighly targeted attack. -That- pretty much never happens unless you are walking around with a $1,000,000 in Bitcoin in which case it has happened a total of 5 times that are public.

latopedej 6y ago

fido2/webauthn, adds MFA and a anti phishing protection!

latopedej 6y ago
more convenient than yubikeys, is simply your phone, which is really often near you

md_ 6y ago

Mostly agree with a lot of this, but it's a little unfortunate to lump all WebAuthn authenticators together. WebAuthn keys--physical dongles you plug into the USB port--are indeed problematic for the reasons the author notes. (A small--but user-visible--cost; the requirement for a spare USB port of the right form factor; loss.) However, authenticators that are built into the client device (e.g. Apple's support for a TouchID-verified WebAuthn authenticator) solve these problems, to varying degrees: the user doesn't see a marginal cost (it's built into the computer!) and doesn't have to worry about loss, USB ports, etc. The principle challenge with using (as an example) Safari's WebAuthn support is what how the relying party should support loss of the device. (If you lose your Safari--or claim to--how does your bank authenticate you?) Ultimately, the lost-device--or new-device bootstrapping--problem is currently what stands in the way of a truly secure ecosystem, but with platform providers increasingly supporting WebAuthn, we can at least reduce phishing risk to "phishing of the platform provider credential." Your iCloud password might get stolen, but at least that's the _only_ thing an attacker can steal to gain access to your other accounts. For most services, delegating authentication (and anti-phishing) to someone like Apple is a big plus.

edent 6y ago
I think that's a fair comment. It would be great to see more device come with built in support for this.
- md_ 6y ago
  Platform support isn't exactly the problem. Apple, Microsoft, and Android all support WebAuth (https://blog.mozilla.org/security/2019/03/19/passwordless-web-authentication-support-via-windows-hello/ https://blog.mozilla.org/security/2019/03/19/passwordless-we..., https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-the-web/ https://webkit.org/blog/11312/meet-face-id-and-touch-id-for-..., https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/webauthnapis https://docs.microsoft.com/en-us/windows/security/identity-p..., https://developers.google.com/identity/fido/android/native-apps https://developers.google.com/identity/fido/android/native-a...), so most (??) users are in fact covered. eBay, for example, offers a passwordless experience using WebAuthn--so it can be done, even on a major consumer site. The problem is really that until relying parties can trust that 1. Platforms will backup and restore key material from authenticators 2. Users will figure out how to use those backups (including if they e.g. switch from Mac to Windows) they will have to provide some fallback. (Realistically, that means "for the foreseeable future.") This relegates WebAuthn, unfortunately, to a "neat trick"--eBay's "passwordless option"--and not a security guarantee. (Phishers can always downgrade the user to passwords or similar.) What's needed in the interregnum is probably a way to make that fallback option more secure by, at minimum, conveying to users that it's not _normal_--so that phishing attempts targeting that phishable backup are less likely to succeed. Unfortunately this requires a lot of good UX design and unilateral action on part of the relying parties, which I think is tough.

sigmar 6y ago

> Buy a device, register it, install the app, What u2f app is this referring to? I've never needed anything more than chrome to use u2f on windows or ubuntu. Also seems weird to complain about setting up an app, when a few sentences before that they recommend installing a password manager...

edent 6y ago
YubiKey recommended that I install Yubi Auth https://play.google.com/store/apps/details?id=com.yubico.yubioath https://play.google.com/store/apps/details?id=com.yubico.yub... and YubiClip https://play.google.com/store/apps/details?id=com.yubico.yubiclip https://play.google.com/store/apps/details?id=com.yubico.yub... Should I not have?
- Ottolay 6y ago
  For U2F specifically you don't need apps except support in the browser. The apps you listed are used for other types of functionality provided by the yubikey, like OTP and TOTP.
- tytso 6y ago
  If you had used one of the $10 USD Webauthn (aka U2F) tokens, it wouldn't have asked you to install any applications. The "problem" is the expensive Yubikeys that you were whining about has lots of extra functionality that has nothing to do with U2F, and that's what the extra applications are all about. I happen to use a Yubikey because I want that extra functionality, including using it to secure the keys I use for ssh and for digitally signing git tags so I can securely push git pull requests. But that's because I'm a developer, and it's why I'm happy to purchase multiple Yubikeys (one for my desktop, one for laptop, backups including one that is on a keychain, etc.) Perhaps you were reading web sites that was giving advice for developers as opposed to for consumers?
  - wyager 6y ago
    OpenSSH >= 8.something natively supports U2F. No need for extra functionality.

swinglock 6y ago

So almost nothing can be done because > The top result on Google is invariably an advert for a scam site. No, use an adblocker. It's the modern antivirus and you should use one.

andybak 6y ago
Except as others have noted this statement is an exaggeration at best.

lrvick 6y ago

The Yubikey/WebAuthn comments are really ignorant and discouraging people from the best defense against this sort of attack that exists. First of all you can get WebAuthn devices for as little as $10 now. Second, there is no app to configure. You plug it in when it says register and tap it. Done. Third, if the WebAuthn device gets stolen the attacker presumably lacks a password. You can't use the device by itself. Also the vast majority of attacks are remote, not IRL. Fourth: fingerprint or pin authenticated WebAuthn devices exist if your threat model worries about physical access. IRL attacks are a radically different threat profile. I can't even with this article.

latopedej 6y ago
most people have a phone that can leverage webauthn, so you don't even need to buy anything. On top of that, webauthn can be configured to prevent phishing as well
edent 6y ago
Could you let me know where I can buy a well supported WebAuthn key for that price? Looking at Amazon UK - https://amzn.to/3oWGYe4 https://amzn.to/3oWGYe4 - the cheapest appears to be about £30. Unless I want to risk my security to some no-name brand with zero customer support. When I got my YubiKey, it told me I had to download an Android app to make it work. So, perhaps better documentation is needed? I'm sorry you didn't like my post, I'll try to do better in future.
- _wldu 6y ago
  Conor sold U2F Zero's for less than 10 dollars (years ago) and has a kick starter now to fund his new Solo keys: https://www.kickstarter.com/projects/conorpatrick/solo-the-first-open-source-fido2-security-key-usb/ https://www.kickstarter.com/projects/conorpatrick/solo-the-f... https://u2fzero.com/ https://u2fzero.com/ I have a few U2F Zeros and they have been working fine for years. These are simple devices. You don't need to overpay for them. Edit: Conor was building the U2F Zero tokens for $2.26 USD per unit. Read more here: https://www.conorpp.com/u2f-zero-year-in-review/ https://www.conorpp.com/u2f-zero-year-in-review/

nyanpasu64 6y ago

"Security Key by Yubico" is significantly cheaper than YubiKey, and supports open-source protocols ("U2F and FIDO2/WebAuthn") but not corporate 2FA protocols. It doesn't address the keychain/password issues though.

_wldu 6y ago

Nice blog post with interesting views. I leave my YubiKey plugged in all the time. It's basically a permanent part of the computer.

nijave 6y ago
Same, and many websites have support for multiple keys so enroll a couple of the cheap $10 ones (per device) and then you can use TOTP or just printed codes as a backup. Even if your device is stolen 1) it's unlikely by a technically savvy bad actor (and if you're at risk, you probably have had special data security training anyway) 2) you're still only stealing one factor. Your device should also be encrypted with a password which would protect any passwords [managers] on the device

2Gkashmiri 6y ago

https://www.amazon.in/Auto-ePass-2003-FIPS-Token/dp/B00S7LULYY/ref=mp_s_a_1_4?dchild=1&keywords=epass+token+2003+epass+auto&qid=1610898933&sprefix=epass&sr=8-4 https://www.amazon.in/Auto-ePass-2003-FIPS-Token/dp/B00S7LUL... does anyone know if its posible to reuse these fips pki tokens? they are cheap enough.....

vaduz 6y ago
It's essentially a smartcard (certificate storage) in a more convenient form factor for most users, so you could use them to store your RSA keys - though personally I would not trust them - but they are not FIDO/FIDO2 so they are almost useless in the context of the article.

yangwuzrite 6y ago

The author of this article has no idea how 2FA works or why it's used. 2FA is used to prevent or mitigate the impact of phishing or other attacks where a password is compromised (password reuse, random guessing, keylogger, etc.). The author does bring up one hypothetical attack -- a man-in-the-middle attack -- where someone can trick a user into providing their 2FA or triggering an authorization (like with a Duo push). This requires the ability to execute a real-time attack. FIDO/U2F/Webauthn (I still haven't figured out exactly what you're supposed to call them) security tokens solve that use case by allowing the website to authenticate directly to the token. That can't be phished -- even if you're tricked into a fake website and given a fake webauthn prompt, AFAIK there's no known way to proxy or otherwise intercept that second factor authentication to allow a phishing attack to succeed. His complaint that the token doesn't have a password is largely pointless -- the token is the second factor, the password on the site is the first. If you're using passwordless FIDO2 logins, then it does have a PIN. Long story short, this guy is full of crap.

flas9sd 6y ago

for one, html email is vicious, terminal email clients can help to not fool you with visual alignment. I like the feature `From: <> via <>` in the view, maybe this tipped her off - "palette.cloud" is an unlikely envelope-sender for github mail. Reactivating an old gmail account, I can't see how to enable the feature. In a muttrc, you can get context with showing you more headers. ignore * unignore from: to: cc: date: subject: user-agent: x-mailer: return-path: authentication-results: hdr_order date: from: return-path: to: subject: user-agent: x-mailer: authentication-results: A client could by default show "unverified" and use spf+dkim to get to verified. The "unverified" could be signal enough to enable spidey sense

TACIXAT 6y ago

This is a weird post. Yubikeys are absolutley the solution here, also a password manager. A decent password manager will check the URL for you.

chungy 6y ago
There are many legitimate situations in which a login domain is changed and a password manager no longer works. So then you manually open the password manager, look for the password, copy+paste, and save the new entry. How can you be completely confident that this isn't an attacker?
- TACIXAT 6y ago
  In that rare case you just check the URL. Contact the company if it is a high value login. You can also verify by searching for the site and clicking through to see what their webpage offers as ground truth.
- tialaramex 6y ago
  Right. One of the good decisions in WebAuthn is that this type of nonsense simply isn't possible. It's designed so that you can't do this. When the big boss absolutely insists that ourcorp.example must rename to xp4ifis.example because of whatever nonsense, there's nothing to argue about, it won't technically work, it can't be done. Like if they decided it would be better branding if up was down, too bad. In almost all cases these were just about vanity (e.g. the university where I studied and had some of my first jobs renamed itself and gave every web site new URLs, purely out of vanity, at considerable cost with no benefit) and so when they discover it can't be done technically they just give up and continue to use the old name for authentication, meaning your security posture is intact. In the few other cases you're now going to have to have a conversation with your users about why you broke everything and need to begin over. I sure hope the gain to your organisation was worth it.
  - guenthert 6y ago
    Not too long Scottrade (2 or 3 't'?) got bought by Ameritrade. All Scottrade accounts are now accessed exclusively under the new domain name. Recently Ameritrade and Charles Schwab Corp. merged ...

tommywg7 6y ago

What about certificates? The fake GitHub almost certainly does not have a valid certificate. Isn’t that our one defense against these things?

tialaramex 6y ago
The problem that a certificate just assures us this is indeed https://githubverification.com/ https://githubverification.com/ which it is This leaves a human to try to make deductions about whether githubverification.com is github.com which is something humans are terrible at, so game over. If you have WebAuthn then your browser also takes responsibility for only letting you use your github.com credentials on github.com and not even bothering you with any other possibilities that you might think could be safe and are not. That's why WebAuthn prevents phishing.

ajross 6y ago

The linked article is correct, but uncharitable. It correctly states the behavior of two-factor auth systems but incorrectly understands their value. Yes, 2FA won't protect you from being phished by a site if you aren't careful. 2FA absolutely will protect you from a phishing site using the password it stole. So no, when someone says "Use 2FA if you might be phished" you shouldn't be replying "That's not how 2FA works", you should reply "That's right! But let me explain why you are still at risk of password theft and should still be careful."

shawnz 6y ago
The attacker could proxy the 2FA request from the real site using the password you enter and therefore you wouldn't be protected.
- Spivak 6y ago
  Yes, that’s basically the author’s point. But it does protect you against someone trying to use your password on another site.
- FeepingCreature 6y ago
  Yes, you can MITM 2FA, but you can't timeshift 2FA.
- cortesoft 6y ago
  Right, they could have access to your account, but not full access. A good website will ask for 2FA again if a user tries to do something destructive (like change password, email, or disable 2FA). They wouldn’t be able to do those things.
  - deleted 6y ago
    [deleted]
  - TacticalCoder 6y ago
    > A good website will ask for 2FA again if a user tries to do something destructive (like change password, email, or disable 2FA). They wouldn’t be able to do those things. The page mocking the login page where you need to answer the 2FA will simply phish your 2FA then, after a little delay pretending there's some lag, would say "wrong code, please try again". Now the person enters a second 2FA (which, due to the delay, would be different than the first one). As I've just commented in a top-level comment: I've seen sites using a 72 hours delay before any destructive change can be made, coupled with the sending of an email containing a link allowing to unilaterally prevent the change. I've also seen sites using two 2FA (TOTP style), one for login, one for any setup/destructive change. And there are sites using both techniques. It's not 100% foolproof but it's better than "one 2FA phished and it's game over".

cordite 6y ago

I recently experimented with the Yubikey OTP feature. Like TOTP, it can be proxied through as there's no challenge that includes signing the website name like FIDO. Also.. The Yubico OTP feature types using QWERTY with letters and no numbers. As I use dvorak, this resulted in considerable confusion as two yubikeys behaved the same. Interestingly, copying the credentials between Yubikeys will not result in an accepted yubikey OTP. The serial seems to be used somewhere in the calculation. A yubikey, using the CLI tool, can have TOTP credentials stored inside. This can be used in conjunction with grep and sed for any CLI scripts that may interactively request a TOTP.

underdeserver 6y ago

The author recommends BitWarden, but it seems like it's run by one guy. How do I know he doesn't go away? Get hit by a bus?

yumraj 6y ago
run your own instance of Bitwarden.. there's a nice dockerized server available written in Rust
t0astbread 6y ago
You don't but any good password manager should have an option to migrate away from it quickly.

GolDDranks 6y ago

Let's say I've got 2FA enabled. I get a confirmation link to my e-mail. I click the link. Because the e-mail is sent by the real site, the link leads to the non-phishing site. The scammer has my password, but is still unable to access the site. How does that not help? Of course if it's a 6-digit code or something, then they are able to stole my it like they did with the password.

jakelazaroff 6y ago
I wouldn’t call sending codes by email “true” 2FA, though, since your email address can also be used to reset your password.

dathinab 6y ago

I think password managers are the first step you should take and FIDO/U2F hardware keys are the second similar important step. With that even if your password manager get hacked you still have a secure account as they didn't got the U2F at the same time a password manager is a must have as it's prevents a lot of phishing attacks from even getting any chance and is quite convenient, too. The problem with hardware keys is that for many people they are not so easy: - You MUST generate and safely store recovery keys, storing them in your password manager is suboptimal, but better then not having them. (Not having them means potentially losing account access permanently.) - You often need to enable it. - You should store it with your keys, which dependent on habit might not be around your PC (in my case they always are in my pocket so :=) ). - If your site doesn't support U2F/FIDO you might need an additional phone + app, or laptop app to get the numbers out of your key. So while I think it's a must have for every developer to have a hardware security token lie a Yubikey it's not something I could convince e.g. my Dad or Sisters to use.

yumraj 6y ago

There is another issue, I think, with Cloudflare serving in the middle. For many websites the Cert is owned by Cloudflare and shows Cloudflare as the Organization and not the website owner. In that case there is no way for me to figure out whether I'm on the actual site or a phished site. For example see this (it is the Visa opt-out website that was posted a few days ago on HN): https://marketingreportoptout.visa.com/OPTOUT/request.do https://marketingreportoptout.visa.com/OPTOUT/request.do Supposedly the above it authentic, but the Cert is showing Cloudflare as the Organization. Now unless the claim is that Cloudflare will never serve phished websites, which I doubt unless Cloudflare is doing a human validation for each client, this is a problem.

invokestatic 6y ago
This is an issue with any domain-verified TLS certificate, which make up the overwhelming majority of certificates in use. Only CAs which offer organization-verified (OV) or extended-verified (EV) certificates, typically at exorbitant prices, does the TLS certificate attest the publisher of the website.
- yumraj 6y ago
  > Only CAs which offer organization-verified (OV) or extended-verified (EV) certificate, typically at exhorbitant prices, does the TLS certificate attest the publisher of the website. Even so, I’ll expect financial institutions to have that. Note: I’m not saying the above is a Cloudflare issue, perhaps someone at Visa was being stingy - I’m just saying it’s an issue and would be bad if that becomes the mainstream.

nrvn 6y ago

I have a question: if a website is clearly involved in phishing how does one report such a website and what is the process of blocking the domain name and chasing the owner?

lifeisstillgood 6y ago

>>> The top result on Google is invariably an advert for a scam site. Wait what now?

m4tthumphrey 6y ago

Slightly OT: Odd timing but one of my services sent me a push notification earlier about setting up a "personalised code" which would be included in all emails. I thought this to be a novel way that could _help_ with the email phishing problem, if adopted and implemented properly.

unilynx 6y ago
The user still has to notice that the personal code is missing in the phishing emails. If you could trust users with "always check for this personal code in the emails, ignore emails without it" we could also trust them with "your bank will never email you a login link"

jfrunyon 6y ago

> The average YubiKey is £50. There are a few around the £30 price point. That’s a huge expense given the small number of sites that support them. A wide variety of sites support them. I'd estimate around 1/3rd of the services I use daily (both personally and for work) support them. (That said, I got mine for $30 by signing up for a magazine subscription, and wouldn't have paid significantly more. And, of course, some of my services have been chosen because they differentiated themelves from the competition by Yubikey support.) > Buy a device, register it, install the app, configure it, find the setting in the website, enable it, hope your machine has the right sort of USB ports, press the button at the right time. Except, with U2F, that's not true. It's just "buy a device, plug it in, find the place on the website, wait for a prompt, press a button". > Convenience. My YubiKey is on my keyring. My keys are in my coat. That's a pretty personal problem. For me, my keys are either on my belt loop or on my desk, which means it's always handy. Of course, you can also get one of the models which is designed to stay plugged in, if that is compliant with your threat model. > Risk. YubiKeys have no password lock of their own. ... if you’ve stolen my laptop and the YubiKey is plugged in True, which is why they're not generally suitable for standalone use; only as a second credential. Also, if your threat model has you worried about them being stolen together, simply don't leave them plugged in together. > Support. WebAuthn is a great standard – but only a few sites support it. That's still as false it was when it was your first point. > If fake-github.com said “Hmmm we’re having problems with our WebAuthn backend – please use a one-time code from your authenticator app for added security” would you be fooled? At the very least, it would probably cause me to double-check that I was on a legit site. Overall: I don't think you give enough credence to the fact that it's real, secure, convenient 2FA. No more digging your phone out of your pocket, unlocking it, navigating to the app, and then setting your phone down so you can type in the code. And then locking your phone and putting it back away. Personally, my Yubikey goes into my laptop at the start of the work day (the first time I use it), and it doesn't come out until I'm done working (well, or if I need to use my keys). All I have to do is tap the button after I put my password in.

smokey_circles 6y ago

No. 2FA is designed to authenticate that this is you logging in. Wrong off the bat. The "they just use your login token" is akin to "they just hacked the CIA's database". Just. I also don't see how the author thinks that the same users who struggle with yubikey won't simply search for the github.com login on githud.com in their password manager. Bitwarden and co are great but the default domain creates a problem where login.signup.domain.com does not match login.domain.com and so users are used to searching. The bit that completely lost me was the lamenting of convenience with the YubiKey. Security and convenience are polar opposites. Coupled with the "tech bros" comment, I am not sure this is in good faith at all

paraknight 6y ago
> The "they just use your login token" is akin to "they just hacked the CIA's database". Just. He's saying that they can basically MITM you, which is true. GitHub asks attacker for token, attacker asks you, attacker gives token to GitHub on the spot, presto.
- smokey_circles 6y ago
  Ah, I did overlook that one. That said: I remain unconvinced that 2FA is a trivial thing to beat. Now we're talking about an active attempt to impersonate you, as opposed to a general catch-all-the-2fa-less-logins Put another way: If you ran this phishing site, would you focus your time on the logins with 2FA enabled (which if I've understood correctly means you'd have to catch them in the window the token is valid for) or the logins without?
  - TheGeminon 6y ago
    If you use your phished credentials immediately (e.g. inline with it being phished), then it doesn't make a difference if they are using 2FA. You use the credentials they entered to login from a backend system automatically, and then if that ends up with a 2FA prompt, you show the victim the 2FA phishing page next, instead of redirecting them to the real app/whatever. This obviously does have its own downsides (you have to maintain a login infrastructure, as well as your phishing infrastructure), but this was even seen before 2FA became common to detect if an incorrect password was entered into the phishing site. It is definitely an improvement, but TOTP doesn't provide much protection from phishing, and as it becomes more popular more phishers will need to accomodate for them in their campaigns, further reducing their effectiveness here.

goodpoint 6y ago

Another aspect that people always forget is that 2FA protects only the login process. Any successful attack against your browser (or any other application on your workstation) allows the attacker use existing and future browsing sessions. The attacker can simply wait until you log onto your bank account and remotely control your browser.

as300 6y ago

Correct me if I'm wrong but I've seen oauth implementations that require you to be redirected to the site you're giving credentials for to finish the flow of authentication. Wouldn't this make it a lot easier to determine that you're being phished, if you have to go to a whole different web site that warns you that you are giving external parties access to your credentials?

anticristi 6y ago
Indeed, using OAuth everywhere would make the success of such an attack less likely. However, I feel strongly about not letting a single organization act as my identity provider. I don't like putting all eggs in the same basket.

anticristi 6y ago

Time to implement Password Authenticated Key Exchange, e.g. Secure Remote Password, in the browser? Here is what I suggest. Let there be a field <input type=pake challenge=blah />. Whatever is typed into that field is unavailable to the front-end code. Instead, the browser computes a one-way function of the password, challenge and origin, and makes that available to the front-end. The devil is in the details, but I'm pretty sure that a robust security analysis could eventually produce a solution that allows any user to type any password in a "super-password" field, and rest assured that the phishers are out. The next issues would be: - How to prevent "downgrade" attacks, i.e., the user should immediately notice if a legacy password field is used. - How to convince the Internet to adopt this.

janwillemb 6y ago

+1 for bitwarden as password manager. It did indeed save me a few weeks ago from a phishing attempt. After reporting it to my employer and warning all my colleagues it turned out to be the tech department doing a white hat test to educate the employees :)

scottmcdot 6y ago

Is there potential for a simple popup in, say, 1Passwordx Chrome extension that, if the base url doesn't exist in any key chains, that reminds us to watch for phishing sites?

niftich 6y ago

This is a good article about the weaknesses of the trust models of navigation on the web. The author uses a password manager that also fulfills the role of a personal 'have I seen this site before?' database, which helps them associate a URL to its conceptual entity, in their quest to determine if the site they visited was the site they intended to visit. In this exact form, this is a feature that's absent from mainstream browsers today. Because browsers do not have this, people instead turn to all sorts of other signals to judge the site's identity, but each one of those signals is designed for another purpose, and ought to not to be used directly by the user to make such determination. But no other signals are available, so they get used nonetheless. Some people look at the URL before clicking it, or the URL bar in the browser after they've already navigated to the site, and try to judge from the URL whether the site belongs to the entity they intended to visit. This is fallible for a bunch of reasons, including: (1) people often read visually instead of comparing codepoint-by-codepoint, so reading errors or homoglyph attacks are possible, and browsers can only meaningfully mitigate against the latter; (2) very few people keep a computerized allow-list, so they check against expectations in their head; and (3) some organizations will make use of domain names that greatly differ from their own name, which works contrary to the instinct of a URL-judging user who consider themselves 'cautious', and it's difficult to stay aware of all this. Some people look at the TLS certificate, and try to judge from the information displayed by the browser about the cert whether the site belongs to the entity they intended to visit. This is fallible for a bunch of reasons, including (1) DV certs only prove that someone (i.e. anyone) had control of the domain at the time near the cert's issuance, so its value as a trust signal to the user ought to be zero and immediately reduce to the prior case of mentally validating the URL by its character content; (2) EV certs validate against a legal entity in some jurisdiction, but as the 'stripe.ian.sh' stunt has demonstrated, jurisdiction-by-juristiction registries of legal entities are a tool for a different use-case and were never intended to collectively ensure globally unique Organization names; and (3) in their rush to ensure widespread TLS deployment on all sites, and their involvement with efforts to bring short-lived cost-free DV certs to everyone, browser-makers began de-emphasizing the UI distinctions between DV certs and EV certs some time before the true shortcomings of EV as a user-facing trust signal were widely demonstrated. Some people look for the visual design of the website. This is trivial to fake. Some people will rely on browser-resident bookmarks, browser history, or 'top sites' tiles to navigate to common sites they've visited before (or to sites the browser-maker pre-loaded into the listing). This is a great way to preserve the trust chain and reduce the likelihood that the user arrives at an unintended site by mistake. But these features do not directly address the case of a person navigating to a URL they were linked or provided from an arbitrary source, such as the example raised in the article. Building blocks exist today that could be used by publishers and browser-makers to aid users in judging URLs. Some of these will require past UX decisions to be undone. For example, top sites could become their own Root Certificate Authorities [1] and be listed in browser trust stores; these companies would be expected to issue certs for sites associated to themselves. This would eventually reshape the cert landscape so that a parent-child relationship between issuer and subject could be meaningfully distinguished from a 'provider and customer' relationship. Companies that provide services to others, such as payment processors, could also become root CAs and sign for their customers. These changes, and a browser UX that once again shows the cert issuer, would go a long way towards reducing the likelihood that users are fooled by sites trying to impersonate top sites. If this were to come to pass, other CAs would be expected to pivot to minting certs that play the role of a trustmark, by conferring a degree of ongoing assurance that's useful to the user (which, in fairness, was the original point behind EV certs). They would do this by establishing strong brands around their trustmark, issue certs for a short lifetime, and monitor the site on an ongoing basis to see if it's still deserving of their trustmark. This would result in a business model similar to those of EV certs, but a trust model that's based on the user's trust in the CA's exercise of good judgment befitting their brand. [1] https://news.ycombinator.com/item?id=13495262 https://news.ycombinator.com/item?id=13495262

dgudkov 6y ago

They author makes a few good points, but I find the author's critique of Yubikey weak: >Cost. The average YubiKey is £50... If that's too expensive for ensuring your internet security, then either you underestimate the risks, or undervalue your information. If a Yubikey cost 10 times more it would still be a bargain. >Usability. Buy a device, register it, install the app, configure it, find the setting in the website, enable it, hope your machine has the right sort of USB ports, press the button at the right time. Pressing the button at the right tight was a joke, right? Although, I admit it may be challenging for people with disabilities. Websites making it hard to find 2FA settings is not a Yubikey's problem, it's a website problem. Setting up a Yubikey is rather straight forward too. The main issue is the inability to clone a Yubikey programmatically, but that's the price of security. >Convenience. My YubiKey is on my keyring. My keys are in my coat... That's can't be serious too. I won't even elaborate on this. >Risk. YubiKeys have no password lock of their own. At least my crumby Android has a fingerprint lock to prevent people getting my 2FA tokens. But if you’ve stolen my laptop and the YubiKey is plugged in, then you’ve got the keys to my kingdom. That's actually the only valid point I somewhat agree with. Again, this is largely mitigated by developing the right habits. You don't leave your car keys hanging in your car's lock after leaving the car in a parking lot, right? Then why do it with Yubikey? If developing a new minor habit represents a problem, then either you underestimate the risks, or undervalue your information. An additional password/fingerprint protection would be nice though. I agree on that. >Support. WebAuthn is a great standard – but only a few sites support it... Again, this is not a Yubikey's problem. It's a website problem.

acupofnope 6y ago
> YubiKeys have no password lock of their own I don't know if the author of the blog post means something else but if you're using 2FA tokens (i.e. Yubikey Authenticator) you can put password protection for additional security.
- mynameisvlad 6y ago
  In some scenarios, Windows 10 will also require a PIN to use a key: https://docs.microsoft.com/en-us/azure/active-directory/user-help/security-info-setup-security-key https://docs.microsoft.com/en-us/azure/active-directory/user...

sneak 6y ago

You don't need a $50 Yubikey token to do U2F, there are ones in the $10-15 range. Most sites that support U2F support enrolling multiple tokens, so just have one in each machine. Theft of a machine still needs your password to access the accounts, so it's not "keys to the kingdom" as the article suggests. I feel that this article is... wrong.

slaymaker1907 6y ago

2FA can actually prevent phishing, though it requires close integration with the app and the authenticator. It's actually quite similar to CSRF prevention. On the site itself, display a random nonce to the user for confirmation then send an request for authentication to the authenticator with said nonce which the user can confirm. The battle.net authenticator does this. For added protection, you can prompt the user to select which nonce is correct to force them to verify it is correct. The Microsoft authenticator does this sometimes. The downside of this approach is that it requires a constant connection between the second factor the service. It also relies on the fact that the service authenticates itself via TLS or some other means, though that is a relatively minor issue.

howlgarnish 6y ago

Fake 2FA works if it's stateless, eg entering a code from Authy or a physical token. However, stateful 2FA like sending an SMS to your phone, or popping up a notification on your banking app is much harder to spoof, and would have protected the user here.

mapgrep 6y ago

All the complaints made about yubikey and webauthn could be made about 2fa 5-10 years ago. Hardware tokens gated by software (ala yubikey + webauthn) are clearly the next step in auth. It’s an accident of circumstance you even need to buy a yubikey - your iPhone, iPad, laptop, android whatever can do everything a yubikey does. There just needs to be enough demand and time for OS and hardware vendors to come around to shipping and integrating this stuff by default. Suddenly you’ll own 3 or 4 yubikey equivalents without buying any special auth devices. 25 years into the web and our login tools remain pretty barbaric. Maybe in 25 years we’ll have it sorted out. But change is coming. Call it 2fa, webauthn, whatever - regardless of the details username/password auth (on its own) is dead.

snarf21 6y ago
Yeah. It is mostly about integrating and standards. Private keys in the secure enclave already does everything Yubikey does. All phones already have it. The OSes just need to support FIDO and then we don't need passwords anymore (assuming a passcode lock on device). Essentially everyone would have 3FA (something you know, something you have and something you are)
- BlackFly 6y ago
  Secure enclaves as a second factor break the assumptions of 2FA threat models. If I compromise a single factor (your device) then I can gain both your password and your second factor. The best second factors are separate devices with their own screens that indicate what you are authenticating to/for before you provide your authentication. Of course, nothing ever stops a user from deputizing malware.
  - snarf21 6y ago
    I guess I'm not seeing the difference between the secure enclave in a phone and the secure chip in a Yubikey in regards to threat models.
deleted 6y ago
[deleted]

staticassertion 6y ago

The criticism of YubiKey seems kind of unfair. For one thing, it doesn't actually explicitly state that they totally address the major issues in the article. Instead it's "in theory" and "can help". No, it totally addresses the issue of phishing your 2FA token and it does so in practice. The pricepoint mentioned is over twice what the cheapest Yubikey is - $24.99 [0]. The author states the "average" cost is £50 and "there are a few around £30". Again, 24.99USD for USB + NFC yubikeys that support U2F/webauthn. 'usability' and 'convenience' are the same thing but split into two points, which give the impression that there's a whole other issue, but it's really the same thing. > Buy a device, register it, install the app, configure it, find the setting in the website, enable it, hope your machine has the right sort of USB ports, press the button at the right time So for TOTP it's install the app, configure it, find the setting on the website, enable it. So Yubikey adds the one additional step of "buy it", all of the others are the same for all other forms of 2FA. "Press the button at the right time" come on... as opposed to "find the TOTP and type it in on time" ? The 24.99 USB Yubikey also supports NFC, so like, "has USB or NFC" is the requirement - I'm seriously struggling to think of a device that doesn't meet this requirement. The author states that leaving the yubikey in the laptop increases risk. I find this to be a mixing of threat models personally - we've solved credential phishing with the 2FA token, but now you're talking about a threat where the attacker has unfettered physical access? I just don't see why that's relevant, sorry. And for support, I think it's important to note that most sites are not sensitive. But a couple of important sites are. The most important is probably email, since email is effectively an auth mechanism for most other sites via account recovery. So just by protecting email you're protecting every other site. That's really important. IMO, Yes, Yubikeys should get cheaper. I certainly hope they do. At my company I give every employee 2 Yubikeys and they are theirs to keep - they're free to use them for personal accounts. I hope more companies do this in the future, essentially distributed U2F to the workforce. But, otherwise, I really think that the benefits are being drastically undersold and I think that the criticisms are really not particularly fair. [0] https://www.yubico.com/product/security-key-nfc-by-yubico/ https://www.yubico.com/product/security-key-nfc-by-yubico/

TacticalCoder 6y ago

Although I agree that 2FA like Google Auth/Authy/etc. doesn't authentify the site, I'd like to comment on this: > Then the fake site uses your real token and logs in as you. > > Game Over. Depending on how the site's security work, it's not totally game over. I've seen sites, optionally (you still have to turn the feature on), requiring a 72 hours delay before any setup change is taken into account (like, say, a password change). During this time a warning is sent by email and you can at any time during these 72 hours, unilaterally, prevent the change from happening. So it may be "game over" in that the attacker can login and see all you account/activity/data (which, yes, is really bad) but it's not totally "game over" as in it doesn't mean "logged out of your account" (unless the attacker also compromised your email ofc, but now we're talking about something else).

cratermoon 6y ago

Something people here are missing is that unless the phishing site uses your credentials right then and there within the existing session, they can't do much even if they do capture your 2nd factor. But if the site just captures your credentials and puts them in a database of site/username/passwords, they are useless later, even if they also store your 2nd factor of the moment. The next time someone tries to authenticate with your stolen username and password, and the MFA challenge comes up, they will be stuck. The factor they captured phishing has long expired, and the site has no ability to provide the correct value for your 2nd factor at a later time. So in other words, 2FA does provide additional protection in this scenario, unless the malicious party has programmed the system to also hijack your session. I honestly can't say for sure how often the phishing sites use session hijacking vs. just collecting for later use. If the first scenario is most common then no, 2FA doesn't help much. If the second scenario is typical, then 2FA provides significant additional protection over just username/password.

ecesena 6y ago
This is true for all 2FA methods but not for FIDO security keys. With FIDO, the hostname of the site you're browsing is signed in the assertion, therefore the attacker -even with automation- can't reuse it on the target site. This is why FIDO claims protection against phishing. What the author says is that the attacker, when you're using a FIDO security key, can simply say it's not working and force the user to switch to a different 2FA method, therefore in the end phishing the user.
paulryanrogers 6y ago
Session jacking can also allow disabling MFA unless sites are careful to re-verify the MFA before doing so. Or before changing the password or adding additional tokens / generating backup codes. Security is hard. And features make it porous.
- cratermoon 6y ago
  Yeah, a site needs to issue an MFA challenge to any MFA change attempt.

anotheraccount9 6y ago

I think the negative aspects stated by the "hardware authentication device" is overkill. It's really easy to use and cost is relative (gets cheaper with use). May be real issue is that we're not using these new solutions and are still relying on unnecessarily complex passwords to save with master passwords. In some cases, 2FA can be a pain in the butt to manage when you have hundreds of them. A couple hardware keys and voila.

Fazel94 6y ago

Is GPG Auth the answer? It is tied to the site keys and not the address nor even the CAs. It forces you to check and think before doing your thing. And It is easier to use than 2FA, since it is one factor, open your key one time, the key auths you as long as you want.

WhyNotHugo 6y ago

This is why password managers are so important. A password manager won't offer to auto-complete if the protocol/domain does not match with what you've saved. This is an immediate red-flag that something fishy is up.

red_admiral 6y ago

FIDO is a subset of 2FA, and it's one of the protocols that yubikeys etc. implement. While it won't protect you from all attacks, it does make the standard MITM harder. To take the OP's example, if by mistake you are tricked into visting githud.com or something, they can get your password (bad!) but if they try and MITM the FIDO, they'll send a digitally signed message for githud.com on to github.com. This will not work as intended (except for the user, because their github account isn't compromised yet.) Indeed the point of FIDO as I see it is that it's less security critical for the end user to validate the identity of the site, which optimistically speaking about 95% of users will fail at anyway.

als0 6y ago

> WebAuthn and hardware tokens are probably the future. And they’re probably the best way we have to verify site legitimacy. But they’re also currently a poorly supported usability disaster. I was looking for the punchline but it seems like there isn't one. Complaining about hardware tokens and then saying they are the future doesn't contribute much...

GaryStu100 6y ago

I was able to recover over $17,000 I lost to fraud. All thanks to this pro hacker Arthur Vitali who helped me track funds and eventually wired all the money back to my account within 3days. I am more than grateful. If you need help please contact Arthur on EMAIL- Quickarturhack @ Gmail,com WHATSAPP +17025301177 He also does phone hacking, credit fix/score boost, all social media accounts hack, website hack and a lot others