5 ms·

A password is something you're supposed to "know", i.e. something in your head. A second factor is something you have, i.e. your phone, a hardware token, or ac

A password is something you're supposed to "know", i.e. something in your head. A second factor is something you have, i.e. your phone, a hardware token, or access to a shared secret you don't store in your head. Password managers kind of mangle the idea and turn the password from something you know to something you have.

thaumasiotes 5y ago
A password is information, something that can be freely duplicated. The idea of "something you have" is that the thing can't be duplicated. As soon as it can, it's no longer "something you have". Any number of people might have it. A person who has it might not be you. SMS hijacking, for example, converts your phone-based authentication to a password, where the password is your phone number. (Since an attacker who knows that number can pass the test.) TOTP starts its life as a password.
- tremon 5y ago
  Yes, it starts its life as a password. After that, it is never communicated ever again, and therefore, after the initial exchange, it's something you have. It seems to me you are ascribing properties to "something you have" that aren't warranted. The "something you have" needs to prove you were party to the initial exchange, not necessarily that you were the only one present -- that's why we use two factors, and not only TOTP.
  - thaumasiotes 5y ago
    I can't follow what you're trying to say. > The "something you have" needs to prove you were party to the initial exchange This is not something that can be proven at all. Accordingly, proving it is not a goal. Anything that can be had can also be transferred. Your delegated agent's login attempt is just as valid as yours is.
- jimktrains2 5y ago
  I would argue that since the totp secret is never in my head it is not a password. Sms hijacking doesn't "convert" anything anymore than someone with a telephoto lens "converts" an old-style hardware token to a password. (Yes, I know the p in otp is password, and called that because it's entered by the user. It's not a password in terms of a factor you "know" because it's time-limited.) These are also fluid ideas that are used to describe roughly different failure modes for different types of authentication: Passwords are thought of as things the user can disclose. Totp and other "second factors" are thought of as things that must be stolen, or if disclosed have a very short viability time. Biometric are things that can't be disclosed, but can be lost, and (and when properly implemented) not stolen. You're trying to argue that these categories of authentication factors have hard lines and definitions when they're fluid categories being used to think about failure modes of a method. Each specific authentication method has its own strengths and weaknesses. Also, sms hijacks require a lot more than simply "knowing" a phone number. While sim cloning and ss7 attacks are known and very possible, they're still fairly complex. You can also social engineering tech support at phone companies to activate your sim for an account, but that is also significantly more difficult than simply "knowing" a phone number and also a failure of the authentication the phone carrier is using.
  - thaumasiotes 5y ago
    > Totp and other "second factors" are thought of as things that must be stolen, or if disclosed have a very short viability time. TOTP gets set up in the first place when the website discloses your seed to you. It's not something that can't be disclosed. Seeds get disclosed all the time; workflows are built around it. > Biometric are things that can't be disclosed Huh?? Biometrics are things that it's impossible to avoid disclosing. If you're ever in a police station, they are free to sample your DNA. You shed it all over the place. If you ever handle something, you just disclosed your fingerprints. If there are any pictures of you out there, your face is public information. > sms hijacks require a lot more than simply "knowing" a phone number. I didn't claim otherwise. The intent of my sentence above is to say that a context which involves a working hijack attack converts an SMS challenge from a second factor into a password. If your attack is working, knowing the phone number is sufficient to authenticate as the victim.
  - 5y ago
Aeolun 5y ago
Not entirely. The thing I know turns into the main password to get into the password manager for every site.

thaumasiotes 5y ago

A password is information, something that can be freely duplicated. The idea of "something you have" is that the thing can't be duplicated. As soon as it can, it's no longer "something you have". Any number of people might have it. A person who has it might not be you. SMS hijacking, for example, converts your phone-based authentication to a password, where the password is your phone number. (Since an attacker who knows that number can pass the test.) TOTP starts its life as a password.

tremon 5y ago
Yes, it starts its life as a password. After that, it is never communicated ever again, and therefore, after the initial exchange, it's something you have. It seems to me you are ascribing properties to "something you have" that aren't warranted. The "something you have" needs to prove you were party to the initial exchange, not necessarily that you were the only one present -- that's why we use two factors, and not only TOTP.
- thaumasiotes 5y ago
  I can't follow what you're trying to say. > The "something you have" needs to prove you were party to the initial exchange This is not something that can be proven at all. Accordingly, proving it is not a goal. Anything that can be had can also be transferred. Your delegated agent's login attempt is just as valid as yours is.
jimktrains2 5y ago
I would argue that since the totp secret is never in my head it is not a password. Sms hijacking doesn't "convert" anything anymore than someone with a telephoto lens "converts" an old-style hardware token to a password. (Yes, I know the p in otp is password, and called that because it's entered by the user. It's not a password in terms of a factor you "know" because it's time-limited.) These are also fluid ideas that are used to describe roughly different failure modes for different types of authentication: Passwords are thought of as things the user can disclose. Totp and other "second factors" are thought of as things that must be stolen, or if disclosed have a very short viability time. Biometric are things that can't be disclosed, but can be lost, and (and when properly implemented) not stolen. You're trying to argue that these categories of authentication factors have hard lines and definitions when they're fluid categories being used to think about failure modes of a method. Each specific authentication method has its own strengths and weaknesses. Also, sms hijacks require a lot more than simply "knowing" a phone number. While sim cloning and ss7 attacks are known and very possible, they're still fairly complex. You can also social engineering tech support at phone companies to activate your sim for an account, but that is also significantly more difficult than simply "knowing" a phone number and also a failure of the authentication the phone carrier is using.
- thaumasiotes 5y ago
  > Totp and other "second factors" are thought of as things that must be stolen, or if disclosed have a very short viability time. TOTP gets set up in the first place when the website discloses your seed to you. It's not something that can't be disclosed. Seeds get disclosed all the time; workflows are built around it. > Biometric are things that can't be disclosed Huh?? Biometrics are things that it's impossible to avoid disclosing. If you're ever in a police station, they are free to sample your DNA. You shed it all over the place. If you ever handle something, you just disclosed your fingerprints. If there are any pictures of you out there, your face is public information. > sms hijacks require a lot more than simply "knowing" a phone number. I didn't claim otherwise. The intent of my sentence above is to say that a context which involves a working hijack attack converts an SMS challenge from a second factor into a password. If your attack is working, knowing the phone number is sufficient to authenticate as the victim.
- 5y ago

Aeolun 5y ago

Not entirely. The thing I know turns into the main password to get into the password manager for every site.