3 ms·
Every day I sit at the same desk, at the same computer, logging into the same websites, using 2FA over and over and over and over while sites time out "for my p
by jodrellblank 6y ago
Every day I sit at the same desk, at the same computer, logging into the same websites, using 2FA over and over and over and over while sites time out "for my protection". It's a plague. Write a damn desktop app I can run locally, I didn't ask for people from Turkmenistan to be able to login as me, so you could sell me a halfassed web version of something.
Joseph Heller predicted 2FA in Catch 22 when he wrote:
"Almost overnight the Glorious Loyalty Oath Crusade was in full
flower, and Captain Black was enraptured to discover himself
spearheading it. He had really hit on something. All the enlisted men
and officers on combat duty had to sign a loyalty oath to get their map
cases from the intelligence tent, a second loyalty oath to receive their
flak suits and parachutes from the parachute tent, a third loyalty oath
for Lieutenant Balkington, the motor vehicle officer, to be allowed to
ride from the squadron to the airfield in one of the trucks.
Every time they turned around there was another loyalty oath to be signed. They
signed a loyalty oath to get their pay from the finance officer, to
obtain their PX supplies, to have their hair cut by the Italian barbers.
To Captain Black, every officer who supported his Glorious Loyalty
Oath Crusade was a competitor, and he planned and plotted twentyfour
hours a day to keep one step ahead. He would stand second to
none in his devotion to country. When other officers had followed his
urging and introduced loyalty oaths of their own, he went them one
better by making every son of a bitch who came to his intelligence
tent sign two loyalty oaths, then three, then four;"
Notice how 2FA turns into MFA? Keep adding FA until you're as secure as the security theater demands.
"To anyone who
questioned the effectiveness of the loyalty oaths, he replied that
people who really did owe allegiance to their country would be proud
to pledge it as often as he forced them to. The more 2factor logins
a person went through in a working day, the more secure he was;
to Captain Black it was as simple as that"
"Captain Piltchard and Captain Wren
were both too timid to raise any outcry against Captain Black, who
scrupulously enforced each day the doctrine of 'Continual
Reaffirmation' that he had originated, a doctrine designed to
trap all those men who had become insecure since the last time they
passed a 2factor authentication prompt a few minutes earlier."
- benjaminwai 6y ago> Write a damn desktop app I can run locally, I didn't ask for people from Turkmenistan to be able to login as me, so you could sell me a halfassed web version of something. Authy Desktop?
- nijave 6y agoHonestly Windows does this right with AD, Kerberos, Spnego You login to a physical machine with a password (the machine is trusted on the network via AD so physical access is one factor and password is a second) You visit websites and they use SPNEGO to land on Kerberos or NTLM auth which then bootstraps off the fact you're already authenticated to Windows. You never even need to see a login page It's achievable with macOS and Linux but afaik there's some more configuration to be done. The only place I saw with a setup like that was a bank and it was part of a new technology stack that almost nothing used yet With that setup there's almost nothing to phish if you can train people to only enter their password into the OS at login. You can pretty much eliminate the possibility of credential sharing but locking logins to certain machines