4 ms·

The purpose of most 2FA schemes is not to secure things, but to get a unique identifier of the user. The 2FA craze is overblown, for most applications a random

by tyz10 5y ago

The purpose of most 2FA schemes is not to secure things, but to get a unique identifier of the user. The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine. Of course, since cloud providers constantly have security holes and leak databases, perhaps 2FA is for covering up their bad practices, too.

ascagnel_ 5y ago
2FA is more to protect users from phishing attempts than for securing a database, at least in my view. If you fall for a phishing attempt, it means your attacker will need to take the extra step of breaching/replicating your 2FA setup, and the service provider can note the login attempts and notify you (giving you a chance to change your password, rendering the result of the initial attack unusable). 2FA is not for securing a database -- salted+hashed passwords do that.
- perryizgr8 5y ago
  > 2FA is more to protect users from phishing attempts Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password. My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam. So I feel 2FA is worse than useless for preventing phishing attempts.
  - ascagnel_ 5y ago
    I think you're conflating two things here: - 2FA one-time passwords shouldn't be used for anything but verifying a normal login attempt, not a password reset. Independent of a login, they should be totally useless. - If someone is phishing via a phone call, I'd expect that they already have the password in-hand, either because the bank themselves have been breached or because your grandmother was re-using the username/password combination on another website that got breached (a situation that should be taken into account as a common case when designing login systems nowadays). Again, 2FA isn't to _prevent_ a phishing attempt, it's to throw up additional barriers to someone attempting to phish. 2FA is also great for situations where someone else has been breached, since an attacker can't then immediately take a re-used password and shove it into a third-party system to get access.
    - perryizgr8 5y ago
      > If someone is phishing via a phone call, I'd expect that they already have the password in-hand, That's not how it works most of the times. Click forgot password on Gmail and it will use your second factor as a way to let you change the password. Most websites use the second factor as a backup, including bank websites.
  - yjftsjthsd-h 5y ago
    > My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam. For a second factor to be useful, they would already have to have her password.
    - im3w1l 5y ago
      In a theorethical world where 2fa means 2fa, but in reality the sms code is often enough by itself.
      - yjftsjthsd-h 5y ago
        Okay, then that's not a problem with 2FA, and certainly doesn't fit in an anti-2FA rant, because it isn't 2FA.
    - perryizgr8 5y ago
      No, you just need to know the account number and you can click something to the tune of "forgot password".
  - ajsnigrutin 5y ago
    > Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password. But this makes the SMS a single factor of authentication, which is bad. Combined with a password, it's still a good method, a lot better then just a password. If I forget my bank password, I have to go to my bank with my ID and reset the password there. I think they added a videocall + id option because of the plague, but going there in person was the only option back when i signed my contract.
- UncleMeat 5y ago
  2FA only prevents phishing if you are using something like a yubikey. The phisher can just ask for your SMS code or your TOTP code. You can go buy tools that completely automate this on the black market.
robjan 5y ago
Most people recycle passwords. You can say they are doing the wrong thing but it's the reality. When that recycled password inevitably gets pwned, 2FA makes the account more secure.
dragonwriter 5y ago
> The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine. Yes, but its very hard to enforce a requirement that a password actually be random; meanwhile, it is very easy to enforce the use of 2FA.
rocqua 5y ago
> The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine. There isn't a 2FA craze. There is a slow and painful acceptance from companies that 2FA is one of the more effective things they can implement. It is slow and painful because the login logic is threaded throughout most organizations. Moreover, it requires changing how all users work, and that always meets a lot of resistance. Despite all that, it is still growing. That is because password stuffing and password stealing are rather effective, and the number 2 cause of most infections (with the leading issue being phishing mails). 2FA, in one stroke, protects against these measures. It means password re-use by your users (which is inevitable) is a much lower risk. It means shoulder-surfing and keylogging are much lower risk. 2FA is one of the most effective security controls.
UncleMeat 5y ago
> for most applications a random password with length 16 would be completely fine Yes. If we could figure out how to actually get people to do this universally we'd be in good shape. But nobody knows how to make this happen at scale.

by tyz10 5y ago

ascagnel_ 5y ago

2FA is more to protect users from phishing attempts than for securing a database, at least in my view. If you fall for a phishing attempt, it means your attacker will need to take the extra step of breaching/replicating your 2FA setup, and the service provider can note the login attempts and notify you (giving you a chance to change your password, rendering the result of the initial attack unusable). 2FA is not for securing a database -- salted+hashed passwords do that.

perryizgr8 5y ago
> 2FA is more to protect users from phishing attempts Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password. My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam. So I feel 2FA is worse than useless for preventing phishing attempts.
- ascagnel_ 5y ago
  I think you're conflating two things here: - 2FA one-time passwords shouldn't be used for anything but verifying a normal login attempt, not a password reset. Independent of a login, they should be totally useless. - If someone is phishing via a phone call, I'd expect that they already have the password in-hand, either because the bank themselves have been breached or because your grandmother was re-using the username/password combination on another website that got breached (a situation that should be taken into account as a common case when designing login systems nowadays). Again, 2FA isn't to _prevent_ a phishing attempt, it's to throw up additional barriers to someone attempting to phish. 2FA is also great for situations where someone else has been breached, since an attacker can't then immediately take a re-used password and shove it into a third-party system to get access.
  - perryizgr8 5y ago
    > If someone is phishing via a phone call, I'd expect that they already have the password in-hand, That's not how it works most of the times. Click forgot password on Gmail and it will use your second factor as a way to let you change the password. Most websites use the second factor as a backup, including bank websites.
- yjftsjthsd-h 5y ago
  > My grandmother almost told her SMS 2FA to some scammer on the phone claiming to be from her bank. If they asked her password she would have immediately understood the scam. For a second factor to be useful, they would already have to have her password.
  - im3w1l 5y ago
    In a theorethical world where 2fa means 2fa, but in reality the sms code is often enough by itself.
    - yjftsjthsd-h 5y ago
      Okay, then that's not a problem with 2FA, and certainly doesn't fit in an anti-2FA rant, because it isn't 2FA.
  - perryizgr8 5y ago
    No, you just need to know the account number and you can click something to the tune of "forgot password".
- ajsnigrutin 5y ago
  > Usually, 2FA enables phishing. People generally know not to share their passwords. But scammers are now triggering the password reset mechanism and phishing people for the 2FA code. People are not as careful with that code as they are with their password. But this makes the SMS a single factor of authentication, which is bad. Combined with a password, it's still a good method, a lot better then just a password. If I forget my bank password, I have to go to my bank with my ID and reset the password there. I think they added a videocall + id option because of the plague, but going there in person was the only option back when i signed my contract.
UncleMeat 5y ago
2FA only prevents phishing if you are using something like a yubikey. The phisher can just ask for your SMS code or your TOTP code. You can go buy tools that completely automate this on the black market.

robjan 5y ago

Most people recycle passwords. You can say they are doing the wrong thing but it's the reality. When that recycled password inevitably gets pwned, 2FA makes the account more secure.

dragonwriter 5y ago

> The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine. Yes, but its very hard to enforce a requirement that a password actually be random; meanwhile, it is very easy to enforce the use of 2FA.

rocqua 5y ago

> The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine. There isn't a 2FA craze. There is a slow and painful acceptance from companies that 2FA is one of the more effective things they can implement. It is slow and painful because the login logic is threaded throughout most organizations. Moreover, it requires changing how all users work, and that always meets a lot of resistance. Despite all that, it is still growing. That is because password stuffing and password stealing are rather effective, and the number 2 cause of most infections (with the leading issue being phishing mails). 2FA, in one stroke, protects against these measures. It means password re-use by your users (which is inevitable) is a much lower risk. It means shoulder-surfing and keylogging are much lower risk. 2FA is one of the most effective security controls.

UncleMeat 5y ago

> for most applications a random password with length 16 would be completely fine Yes. If we could figure out how to actually get people to do this universally we'd be in good shape. But nobody knows how to make this happen at scale.