8 ms·

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially o

by izacus 5y ago

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!".

thaumasiotes 5y ago
> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.
- wffurr 5y ago
  Doesn’t answering a TOTP challenge prove that you “have” the HMAC shared key that seeds the code generator?
  - thaumasiotes 5y ago
    Yes, that shared key is a password, a piece of knowledge known in common between you and them.
    - jimktrains2 5y ago
      A password is something you're supposed to "know", i.e. something in your head. A second factor is something you have, i.e. your phone, a hardware token, or access to a shared secret you don't store in your head. Password managers kind of mangle the idea and turn the password from something you know to something you have.
      - thaumasiotes 5y ago
        A password is information, something that can be freely duplicated. The idea of "something you have" is that the thing can't be duplicated. As soon as it can, it's no longer "something you have". Any number of people might have it. A person who has it might not be you. SMS hijacking, for example, converts your phone-based authentication to a password, where the password is your phone number. (Since an attacker who knows that number can pass the test.) TOTP starts its life as a password.
        tremon 5y ago
        Yes, it starts its life as a password. After that, it is never communicated ever again, and therefore, after the initial exchange, it's something you have. It seems to me you are ascribing properties to "something you have" that aren't warranted. The "something you have" needs to prove you were party to the initial exchange, not necessarily that you were the only one present -- that's why we use two factors, and not only TOTP.
        thaumasiotes 5y ago
        I can't follow what you're trying to say. > The "something you have" needs to prove you were party to the initial exchange This is not something that can be proven at all. Accordingly, proving it is not a goal. Anything that can be had can also be transferred. Your delegated agent's login attempt is just as valid as yours is.
        jimktrains2 5y ago
        I would argue that since the totp secret is never in my head it is not a password. Sms hijacking doesn't "convert" anything anymore than someone with a telephoto lens "converts" an old-style hardware token to a password. (Yes, I know the p in otp is password, and called that because it's entered by the user. It's not a password in terms of a factor you "know" because it's time-limited.) These are also fluid ideas that are used to describe roughly different failure modes for different types of authentication: Passwords are thought of as things the user can disclose. Totp and other "second factors" are thought of as things that must be stolen, or if disclosed have a very short viability time. Biometric are things that can't be disclosed, but can be lost, and (and when properly implemented) not stolen. You're trying to argue that these categories of authentication factors have hard lines and definitions when they're fluid categories being used to think about failure modes of a method. Each specific authentication method has its own strengths and weaknesses. Also, sms hijacks require a lot more than simply "knowing" a phone number. While sim cloning and ss7 attacks are known and very possible, they're still fairly complex. You can also social engineering tech support at phone companies to activate your sim for an account, but that is also significantly more difficult than simply "knowing" a phone number and also a failure of the authentication the phone carrier is using.
    - im3w1l 5y ago
      The key thing is that an attacker wont be able to keylog the shared secret, or trick me into typing it on the wrong site.
      - hedora 5y ago
        They will be able to trick you into typing it on the wrong site (more likely, wrong terminal) if they’ve compromised your machine. They just need to wait for you to log in. Similarly, they can grab the shared secret from the server. It’s marginally better than a password manager (though some of those support TOTP now), since they can’t pull all your credentials by keylogging your master password.
- izacus 5y ago
  The issue was that it was ONLY SMS - they immediately deprecated private certificates, 2FA "calculators" and other 2FA schemes. After the security backlash they now backpedaled and implemented 2FA with ONLY apps. Apps that ONLY work on iOS and Google Android. I had endless calls from family where they couldn't access their banks anymore because they had a Huawei phone or a dumb phone. Banks are citing "security" as explanation why they can't use smartcards, hardware tokens or even bring apps to desktop computers or phones without Google services. The funny part is - ALL banks did this at once. Why? Because the security consultants had "must have app" and "must check Google Safety net" on their check lists.
  - jsnell 5y ago
    The benefit of apps and SMS over hardware tokens, TOTP, smartcards, etc. is to have a out of band communications channel, not merely a second factor. This is crucial for dealing with malware that can change the transactions a user is entering on a banking site, and it being literally impossible for them to notice that it's happened just on the browser. With apps / SMS, they can be informed of the transaction details as part of the verification process on a secondary communications channel that hopefully is not affected by the malware.
    - noAnswer 5y ago
      chipTAN/Sm@rt-TAN device shows you the transaction details before showing you the TAN. This devices receive their information visually. Either via blinking code or via a coloured QR-Code. So they are are air-gapped.
  - noAnswer 5y ago
    > The funny part is - ALL banks did this at once. What country are you taking about? In regards to the EU 2FA thingy I start to belief to see a pattern. In countries who had established online banking standards with 2FA, nothing changed. But countries without, went ballistic. SMS or App only 2FA on every login and on every transaction. Yah, I can see that this is annoying. While for me with my German banks I still access them using the FinTS protocol with a banking software of my choosing. For transaction above 20€* I need a TAN from my chipTAN/Sm@rt-TAN device (Which shows you the transaction details). Optional I could choose an app. SMS was phased out years ago (By my banks. Others perhaps still have it.) (*only 3 transaction a day I believe. You can deactivate that so that you get asked for a TAN every time.)
- loloquwowndueo 5y ago
  You’re not familiar with U2F? Would you not install two deadbolts on your door if you needed the extra security?
- nl 5y ago
  TOTP is a second factor. The hash seed that generates a password is connected to the device.
  - thaumasiotes 5y ago
    The seed is all you need. The device is unnecessary.
    - nl 5y ago
      Sure.
      - ascar 5y ago
        No need to be sarcrastic. He is absolutely right. The seed is all you need in case of the common TOTP algorithm. There is no connection to the device. In fact, in Google Authenticator you can even conveniently export all running TOTP to another Google Authenticator without any connection with the apps or anything else whatsoever.
        nl 5y ago
        That wasn't supposed to be sarcastic at all. I was in total agreement with him - you can in theory run the algorithm by hand. It isn't especially relevant though - 2-factor is "something you know, something you have". You need to have the hash.
    - hedora 5y ago
      So, it’s a password. All I need for password authentication is the password and a device that can generate a one time proof that I know the password. TOTP just seems more secure because the password is never displayed to the end-user.
      - nl 5y ago
        It's not a password. A password/passphrase/passcode is something you know. A hash for a TOTP is something you have. 2 factor means something you know and something you have (or something you are): https://dis-blog.thalesgroup.com/security/2011/09/05/three-factor-authentication-something-you-know-something-you-have-something-you-are/ https://dis-blog.thalesgroup.com/security/2011/09/05/three-f... (And yes in theory you could remember the hash, and have a custom TOTP client that lets you enter it in. But unless you do this it is a theoretical argument only).
- donatzsky 5y ago
  TOTP is no more a password than whatever one-time code you'd get by SMS. In fact, TOTP is arguably more secure, since it isn't nearly as vulnerable to hijacking as SMS is.
  - thaumasiotes 5y ago
    > In fact, TOTP is arguably more secure, since it isn't nearly as vulnerable to hijacking as SMS is. Indeed, this is an argument you can reasonably make. > TOTP is no more a password than whatever one-time code you'd get by SMS. But this isn't; this is just a blatant lie.
- lucideer 5y ago
  > TOTP is fundamentally a password I see this view a lot. It's wrong. TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. TOTP in fact has one property that makes it potentially* the most secure of all 2FA methods: it can be used airgapped. As the credential you type into the 2FA form is not the saved secret. * I say "potentially" because the relative inconvenience + human factors conspire to make it less secure than e.g. U2F in most cases. But assuming hypothetical perfect conditions, there would be nothing more secure than TOTP for 2FA.
  - thaumasiotes 5y ago
    > TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. Are you familiar with SRP? TOTP has all of the properties of passwords, and no properties that passwords don't have. That makes it... a password.
    - lucideer 5y ago
      I guess you can argue the definition of the word "password"; language is fluid, especially English. I would say SRP is strictly a misnomer (though it's a useful conflation). Generally speaking password is a value provided for authentication (if it's no longer being "provided", as in SRP, it's something different... but I understand using a familiar word for that something different is helpful when communicating). Either way, in saying TOTP was "just a password", the point you were trying to make was that TOTP is "no different than and therefore no better than a 2nd traditional password". The fact it's not transmitted makes it very different to, and better than, a traditional password. So whatever you want to define the definition as, the point stands. > and no properties that passwords don't have It has 1 property that passwords don't have: it is not transmitted!
      - batch12 5y ago
        There are authentication mechanisms that rely on passwords but work by not transmitting the password too. One example is kerberos. TOTP is a password. The fact that it is a password doesn't matter though since it is something you have (and can't know) which augments the something you know. This satisfies the intent of MFA.
- backspace_ 5y ago
  Top of the pops?
dkdbejwi383 5y ago
The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.
- Cthulhu_ 5y ago
  After 15 minutes, or 15 minutes of inactivity? The latter is defensible at least, in e.g. a public area where there is a risk of people leaving their desktops without locking them. I mean that's another policy issue that can be addressed (a policy that locks a system after x amount of inactivity), but as an app developer you can't know much about the system things are running on.
  - Retric 5y ago
    Careful. Filling out a long form isn’t 15 minutes of inactivity, but a huge range of websites assume it is.
    - hallway_monitor 5y ago
      PTSD causes me to copy and paste big blocks of text out of a text area before submitting every time.
      - ta988 5y ago
        sounds like what an extension could do. store in localstorage the last hour of forms. I especially hate clicking submit to get an error and an empty form again.
    - alistairSH 5y ago
      Ugh, a form that takes 15 minutes or more to fill out, without any feedback or other interaction, is itself a UX problem. It should at least be auto-saving.
PebblesRox 5y ago
I use Coface for work to check credit for potential customers. Instead of a password, they require a 6-digit pin. It can't be auto-filled or entered with the keyboard. There's an on-screen number pad that you have to click on and the numbers are scrambled - they show up in a different arrangement every time. Such a pain!
- ShaneMcGowan 5y ago
  Ah yes, the 2005 RuneScape bank method of security, very high tech
- hedora 5y ago
  You could probably outsource the pin entry to a human or AI based third party service.
  - colejohnson66 5y ago
    Such as Amazon’s Mechanical Turk?
- _jal 5y ago
  I think this is the manifestation of non-logical associations humans make. When I was a kid, a teacher told me learning was supposed to be hard and unpleasant, and I believed her for a long time. Only when I started enjoying myself in spite of that did I see it was wrong, and I started doing well in school, and (more importantly) pursuing my own interests. There's a similar thing with security - people assume good security must be painful, so making it painful becomes a goal. Sometimes this is sincere, sometimes (TSA) intentional theater. But either way, the result is intentional hostility to the people who use the system. I'd bet money they have a one-sentence answer for why it does each of those things ("order is scrambled to prevent shoulder-surfing"), but have done zero testing to determine whether those theories are correct.
  - ascar 5y ago
    I always associated these with key logging prevention. What drives me nuts however, is websites/apps that allow me to type my password but not paste it. Like they want to force that a keylogger can grab it? Another favorite of mine are password conposition rules, which do nothing but reduce security and are everywhere :(

by izacus 5y ago

thaumasiotes 5y ago

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

wffurr 5y ago
Doesn’t answering a TOTP challenge prove that you “have” the HMAC shared key that seeds the code generator?
- thaumasiotes 5y ago
  Yes, that shared key is a password, a piece of knowledge known in common between you and them.
  - jimktrains2 5y ago
    A password is something you're supposed to "know", i.e. something in your head. A second factor is something you have, i.e. your phone, a hardware token, or access to a shared secret you don't store in your head. Password managers kind of mangle the idea and turn the password from something you know to something you have.
    - thaumasiotes 5y ago
      A password is information, something that can be freely duplicated. The idea of "something you have" is that the thing can't be duplicated. As soon as it can, it's no longer "something you have". Any number of people might have it. A person who has it might not be you. SMS hijacking, for example, converts your phone-based authentication to a password, where the password is your phone number. (Since an attacker who knows that number can pass the test.) TOTP starts its life as a password.
      - tremon 5y ago
        Yes, it starts its life as a password. After that, it is never communicated ever again, and therefore, after the initial exchange, it's something you have. It seems to me you are ascribing properties to "something you have" that aren't warranted. The "something you have" needs to prove you were party to the initial exchange, not necessarily that you were the only one present -- that's why we use two factors, and not only TOTP.
        thaumasiotes 5y ago
        I can't follow what you're trying to say. > The "something you have" needs to prove you were party to the initial exchange This is not something that can be proven at all. Accordingly, proving it is not a goal. Anything that can be had can also be transferred. Your delegated agent's login attempt is just as valid as yours is.
      - jimktrains2 5y ago
        I would argue that since the totp secret is never in my head it is not a password. Sms hijacking doesn't "convert" anything anymore than someone with a telephoto lens "converts" an old-style hardware token to a password. (Yes, I know the p in otp is password, and called that because it's entered by the user. It's not a password in terms of a factor you "know" because it's time-limited.) These are also fluid ideas that are used to describe roughly different failure modes for different types of authentication: Passwords are thought of as things the user can disclose. Totp and other "second factors" are thought of as things that must be stolen, or if disclosed have a very short viability time. Biometric are things that can't be disclosed, but can be lost, and (and when properly implemented) not stolen. You're trying to argue that these categories of authentication factors have hard lines and definitions when they're fluid categories being used to think about failure modes of a method. Each specific authentication method has its own strengths and weaknesses. Also, sms hijacks require a lot more than simply "knowing" a phone number. While sim cloning and ss7 attacks are known and very possible, they're still fairly complex. You can also social engineering tech support at phone companies to activate your sim for an account, but that is also significantly more difficult than simply "knowing" a phone number and also a failure of the authentication the phone carrier is using.
  - im3w1l 5y ago
    The key thing is that an attacker wont be able to keylog the shared secret, or trick me into typing it on the wrong site.
    - hedora 5y ago
      They will be able to trick you into typing it on the wrong site (more likely, wrong terminal) if they’ve compromised your machine. They just need to wait for you to log in. Similarly, they can grab the shared secret from the server. It’s marginally better than a password manager (though some of those support TOTP now), since they can’t pull all your credentials by keylogging your master password.
izacus 5y ago
The issue was that it was ONLY SMS - they immediately deprecated private certificates, 2FA "calculators" and other 2FA schemes. After the security backlash they now backpedaled and implemented 2FA with ONLY apps. Apps that ONLY work on iOS and Google Android. I had endless calls from family where they couldn't access their banks anymore because they had a Huawei phone or a dumb phone. Banks are citing "security" as explanation why they can't use smartcards, hardware tokens or even bring apps to desktop computers or phones without Google services. The funny part is - ALL banks did this at once. Why? Because the security consultants had "must have app" and "must check Google Safety net" on their check lists.
- jsnell 5y ago
  The benefit of apps and SMS over hardware tokens, TOTP, smartcards, etc. is to have a out of band communications channel, not merely a second factor. This is crucial for dealing with malware that can change the transactions a user is entering on a banking site, and it being literally impossible for them to notice that it's happened just on the browser. With apps / SMS, they can be informed of the transaction details as part of the verification process on a secondary communications channel that hopefully is not affected by the malware.
  - noAnswer 5y ago
    chipTAN/Sm@rt-TAN device shows you the transaction details before showing you the TAN. This devices receive their information visually. Either via blinking code or via a coloured QR-Code. So they are are air-gapped.
- noAnswer 5y ago
  > The funny part is - ALL banks did this at once. What country are you taking about? In regards to the EU 2FA thingy I start to belief to see a pattern. In countries who had established online banking standards with 2FA, nothing changed. But countries without, went ballistic. SMS or App only 2FA on every login and on every transaction. Yah, I can see that this is annoying. While for me with my German banks I still access them using the FinTS protocol with a banking software of my choosing. For transaction above 20€* I need a TAN from my chipTAN/Sm@rt-TAN device (Which shows you the transaction details). Optional I could choose an app. SMS was phased out years ago (By my banks. Others perhaps still have it.) (*only 3 transaction a day I believe. You can deactivate that so that you get asked for a TAN every time.)
loloquwowndueo 5y ago
You’re not familiar with U2F? Would you not install two deadbolts on your door if you needed the extra security?
nl 5y ago
TOTP is a second factor. The hash seed that generates a password is connected to the device.
- thaumasiotes 5y ago
  The seed is all you need. The device is unnecessary.
  - nl 5y ago
    Sure.
    - ascar 5y ago
      No need to be sarcrastic. He is absolutely right. The seed is all you need in case of the common TOTP algorithm. There is no connection to the device. In fact, in Google Authenticator you can even conveniently export all running TOTP to another Google Authenticator without any connection with the apps or anything else whatsoever.
      - nl 5y ago
        That wasn't supposed to be sarcastic at all. I was in total agreement with him - you can in theory run the algorithm by hand. It isn't especially relevant though - 2-factor is "something you know, something you have". You need to have the hash.
  - hedora 5y ago
    So, it’s a password. All I need for password authentication is the password and a device that can generate a one time proof that I know the password. TOTP just seems more secure because the password is never displayed to the end-user.
    - nl 5y ago
      It's not a password. A password/passphrase/passcode is something you know. A hash for a TOTP is something you have. 2 factor means something you know and something you have (or something you are): https://dis-blog.thalesgroup.com/security/2011/09/05/three-factor-authentication-something-you-know-something-you-have-something-you-are/ https://dis-blog.thalesgroup.com/security/2011/09/05/three-f... (And yes in theory you could remember the hash, and have a custom TOTP client that lets you enter it in. But unless you do this it is a theoretical argument only).
donatzsky 5y ago
TOTP is no more a password than whatever one-time code you'd get by SMS. In fact, TOTP is arguably more secure, since it isn't nearly as vulnerable to hijacking as SMS is.
- thaumasiotes 5y ago
  > In fact, TOTP is arguably more secure, since it isn't nearly as vulnerable to hijacking as SMS is. Indeed, this is an argument you can reasonably make. > TOTP is no more a password than whatever one-time code you'd get by SMS. But this isn't; this is just a blatant lie.
lucideer 5y ago
> TOTP is fundamentally a password I see this view a lot. It's wrong. TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. TOTP in fact has one property that makes it potentially* the most secure of all 2FA methods: it can be used airgapped. As the credential you type into the 2FA form is not the saved secret. * I say "potentially" because the relative inconvenience + human factors conspire to make it less secure than e.g. U2F in most cases. But assuming hypothetical perfect conditions, there would be nothing more secure than TOTP for 2FA.
- thaumasiotes 5y ago
  > TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. Are you familiar with SRP? TOTP has all of the properties of passwords, and no properties that passwords don't have. That makes it... a password.
  - lucideer 5y ago
    I guess you can argue the definition of the word "password"; language is fluid, especially English. I would say SRP is strictly a misnomer (though it's a useful conflation). Generally speaking password is a value provided for authentication (if it's no longer being "provided", as in SRP, it's something different... but I understand using a familiar word for that something different is helpful when communicating). Either way, in saying TOTP was "just a password", the point you were trying to make was that TOTP is "no different than and therefore no better than a 2nd traditional password". The fact it's not transmitted makes it very different to, and better than, a traditional password. So whatever you want to define the definition as, the point stands. > and no properties that passwords don't have It has 1 property that passwords don't have: it is not transmitted!
    - batch12 5y ago
      There are authentication mechanisms that rely on passwords but work by not transmitting the password too. One example is kerberos. TOTP is a password. The fact that it is a password doesn't matter though since it is something you have (and can't know) which augments the something you know. This satisfies the intent of MFA.
backspace_ 5y ago
Top of the pops?

dkdbejwi383 5y ago

The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.

Cthulhu_ 5y ago
After 15 minutes, or 15 minutes of inactivity? The latter is defensible at least, in e.g. a public area where there is a risk of people leaving their desktops without locking them. I mean that's another policy issue that can be addressed (a policy that locks a system after x amount of inactivity), but as an app developer you can't know much about the system things are running on.
- Retric 5y ago
  Careful. Filling out a long form isn’t 15 minutes of inactivity, but a huge range of websites assume it is.
  - hallway_monitor 5y ago
    PTSD causes me to copy and paste big blocks of text out of a text area before submitting every time.
    - ta988 5y ago
      sounds like what an extension could do. store in localstorage the last hour of forms. I especially hate clicking submit to get an error and an empty form again.
  - alistairSH 5y ago
    Ugh, a form that takes 15 minutes or more to fill out, without any feedback or other interaction, is itself a UX problem. It should at least be auto-saving.

PebblesRox 5y ago

I use Coface for work to check credit for potential customers. Instead of a password, they require a 6-digit pin. It can't be auto-filled or entered with the keyboard. There's an on-screen number pad that you have to click on and the numbers are scrambled - they show up in a different arrangement every time. Such a pain!

ShaneMcGowan 5y ago
Ah yes, the 2005 RuneScape bank method of security, very high tech
hedora 5y ago
You could probably outsource the pin entry to a human or AI based third party service.
- colejohnson66 5y ago
  Such as Amazon’s Mechanical Turk?
_jal 5y ago
I think this is the manifestation of non-logical associations humans make. When I was a kid, a teacher told me learning was supposed to be hard and unpleasant, and I believed her for a long time. Only when I started enjoying myself in spite of that did I see it was wrong, and I started doing well in school, and (more importantly) pursuing my own interests. There's a similar thing with security - people assume good security must be painful, so making it painful becomes a goal. Sometimes this is sincere, sometimes (TSA) intentional theater. But either way, the result is intentional hostility to the people who use the system. I'd bet money they have a one-sentence answer for why it does each of those things ("order is scrambled to prevent shoulder-surfing"), but have done zero testing to determine whether those theories are correct.
- ascar 5y ago
  I always associated these with key logging prevention. What drives me nuts however, is websites/apps that allow me to type my password but not paste it. Like they want to force that a keylogger can grab it? Another favorite of mine are password conposition rules, which do nothing but reduce security and are everywhere :(